{ "Event": { "published": true, "date": "2026-04-26", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-26", "timestamp": 1777248182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "bc313f93-76cf-4d33-bd20-d8f6937a2815", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ad2aea-415c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777200246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200246, "uuid": "1051ef1f-9759-41dc-bd25-704e28b50abf", "comment": "Malware payload (Mirai)", "value": "bd2701abf974ca122ffd1f9a17e06e26", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200246, "uuid": "5bb9b825-3e72-4f77-973a-d7f2578cca1d", "comment": "Malware payload (Mirai)", "value": "0006adae5e1b13f11153125bc7ecd2816e03fc0142634646625a1ca9b7c29390", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200246, "uuid": "510146a0-d8a2-4b00-889b-5092049b1cdf", "comment": "Malware payload (Mirai)", "value": "0899d1e660463ccfbdeeff4ca80ff81363306af8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200246, "uuid": "9a8de384-44f0-4c82-b0fa-ee837099a103", "comment": "Malware payload (Mirai)", "value": "5cf1cacf86647af6487ef0c2d6efb4aae53763944213f4fd831f00082a46bbe901f21bdc2d6e52551aa9e0b5101e9e03", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200246, "uuid": "b23cf706-898d-4784-9d4a-fba1e8efcd02", "value": "T140333A35B6752A1BC8D8987D22F74328B2F4168E28F8CB1F7D720E4EBF6085025176B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200246, "uuid": "1f1e8861-3fbe-4000-b4b7-7fa8cf513ff2", "value": "768:vj72UF999I26p/d1DNwm+B54HpX2KlNhdtBBYmhju/QJwO+351TSOj:v3pF1IDp/nNwDB54HpmKlzB+mIQJa3e8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777200246, "uuid": "3202ccf9-9fb1-4f34-a297-3900c019a591", "value": 50256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777200246, "uuid": "2ae6acfa-6f20-488b-9f79-9467414d97e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200246, "uuid": "9969a809-2e7c-4139-b5c4-b0fdd5524b3c", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65d7e12-4168-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777205422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777205422, "uuid": "57f4074f-0229-4827-8130-574cd56aeda5", "comment": "Malware payload", "value": "c7a1c5c0c8b403a79f658f5247b025f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777205422, "uuid": "ad019129-a02e-4ca3-9450-8d7f9ce2c813", "comment": "Malware payload", "value": "001a10b946d41f8794c110f97cd46b961fea0c0d50c92efaef1d166adaffe8b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777205422, "uuid": "1bb867b7-b165-44ca-9858-1c46b03362e9", "comment": "Malware payload", "value": "4742d8622786354fb8f67180270e6c08f5de711e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777205422, "uuid": "aa379f16-ed80-4fd3-a785-9651121d7412", "comment": "Malware payload", "value": "3b1bb80fbc0281bc48cff8b0588f823e93422722c96c4c960a61accab04ab7b386e2ef430119fd2d20a30571fce2d2bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777205422, "uuid": "4607a7ab-e6f0-4f03-a42a-d45fbad6eb89", "value": "T12F08332BB042C482D85B9EFA9F81D1108FBB5BC03AD79016756EB2BED7710C09E5A717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777205422, "uuid": "cce8df6d-659c-49be-a1f1-615ee6dc996f", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777205422, "uuid": "a2ece989-3b0e-4536-8ca7-c6bd8ab85b39", "value": "1572864:j2hT/KfvpEv3LEpGdJM8Y9Hmo0UBPq46PVaZkmmZ3QDh5R1R/W:j2RuQ3LEpIiUQPUgqh9Y3R1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777205422, "uuid": "bde26361-7c2f-4f90-b5cc-b9cd04a366e9", "value": 79386456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777205422, "uuid": "5b3120d6-3f35-46fb-9554-58f07d031242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777205422, "uuid": "c25d8af7-5957-4f7a-8743-bf37c4b0f870", "value": "setup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8af9911-4173-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777210096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777210096, "uuid": "aa276a3a-b121-4a9e-a2b1-2e91a74594a4", "comment": "Malware payload", "value": "7a7fde26d083456e3b0618decf84c598", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777210096, "uuid": "e5d6b826-4f3a-489b-b334-c08348cfe6e1", "comment": "Malware payload", "value": "003ff73d7b3a8f7ed6c414ef4946caf6cfac1c991a01de44813983533a9cf46e", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777210096, "uuid": "09424a56-f65d-42ea-b0b0-bf9bb4615feb", "comment": "Malware payload", "value": "989e80953de0000c360fb808ebbff5950fd6a4ee", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777210096, "uuid": "8d339490-1e79-4bc8-8f4d-33226e0b7d58", "comment": "Malware payload", "value": "7d3dabe4e8b629d9d36f472144e6620ed059e085483fb0440344cebbc4439e65e1d583002f23e9724c3a4cb05e8201b1", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777210096, "uuid": "4e7e5de1-2836-401f-bf14-6636ae07ef19", "value": "T1F4867D19F7A414F9ED67827CC8564902EAB2BC5647A0D7CF03A04A973F236E09E3E751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777210096, "uuid": "7b81833d-be45-4443-bf91-c3d2aab5317d", "value": "5eba1ee31e60f732d8e4ee9189427d66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777210096, "uuid": "52aa6307-3e92-429a-a3e6-1bccb432b2a0", "value": "6144:zC4HM6abm9BGReZ5LhdWh2/1NL2GiR8Uyn:mqwq9B5ThdoA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777210096, "uuid": "292617a9-80de-4d22-833d-84cd65364b7d", "value": 8388608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777210096, "uuid": "1b5f5b59-ec64-493c-b2b5-7fdcdd3bdf4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777210096, "uuid": "122aaded-8a55-41ac-ba3d-e3550cf01087", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad71127-418f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777222153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222153, "uuid": "45edf186-6415-43df-84bf-bb358756a365", "comment": "Malware payload (ConnectWise)", "value": "717774caa8061bb8803423dfe8a22f83", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222153, "uuid": "22f8580e-c70d-467f-96b4-aae9d6a847dd", "comment": "Malware payload (ConnectWise)", "value": "02869c0b1be19455ac499e11574fc0b2d7683e426f1c4128cbd038e254b4c495", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222153, "uuid": "bbb6509e-8713-4e62-a850-da1016fbe10e", "comment": "Malware payload (ConnectWise)", "value": "31bf9b8cf37593e5a2b8db533f621df9ac6bd08e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222153, "uuid": "8df119f5-4e71-4e50-b4e5-b04e32598628", "comment": "Malware payload (ConnectWise)", "value": "f0dc1452270baa57a56a70951fe59a8d086b5516cd1499d67776d6d015075a79c9bcc611c5146f6dbaf6536ecf41ab9c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222153, "uuid": "85b8a9a8-92aa-4986-bb86-af8f78b938b4", "value": "T1DE646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222153, "uuid": "c14bb97e-ad2f-43eb-95ec-f6e02b04c57a", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222153, "uuid": "16771afc-2329-4717-be52-66f558aa9fda", "value": "6144:6mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9b:J1iw7gryNkSV1hy1Z1u2JLu9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777222153, "uuid": "92778d25-aae0-451f-8310-35f4b3d9334c", "value": 312568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777222153, "uuid": "f41a2f60-48a2-4ef4-9d85-1a5003162cd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222153, "uuid": "5c9a6ae0-8e27-45bb-b22c-4b2b4d9a720e", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb580fd9-419b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777227334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777227334, "uuid": "eadf1686-5c15-41d8-8503-8630d06b968f", "comment": "Malware payload", "value": "7f38f78a529c806e29905ed425f87f3a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777227334, "uuid": "c9354e03-865f-4e00-b1d5-0196e5c6db3b", "comment": "Malware payload", "value": "03f6cd790090de091c69dc208a927126e6ef13a0293aa5f3c2896b89dbbd2558", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777227334, "uuid": "3d2a9b2b-d94a-48f8-9f6a-cd0f43eab13c", "comment": "Malware payload", "value": "d838b1902f30a973905b1d7e89b1b300daa9abaa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777227334, "uuid": "c156afa9-67b6-47cd-8791-709cda3e928f", "comment": "Malware payload", "value": "7e72e2c4825cf054c7c9a8a1f94708d807b1bc80d76ee970fdff23608d1b545ff2180c423f46294ce46d93a9d40fa5a6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777227334, "uuid": "49799c6c-a6a7-4174-9237-a1c9277f13f8", "value": "T13D976CECA1D6E53629DB7564A73B0E2F9613F0D18EE10110BB24DF0829DAE4F469BE50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777227334, "uuid": "2ae457af-392c-4502-bff6-8879910ceb6a", "value": "1536:5RtWzRtWzRtWzRtWzRtWzRtWzRtWzRtWzRtWzRtWzRtWzRtWzRtWzRtWzRtWzRtd:U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777227334, "uuid": "dc83b349-854e-4b77-9265-087de3c607f4", "value": 41883892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777227334, "uuid": "4045b5a8-0308-46c2-a24b-a608dd6b80f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777227334, "uuid": "35978640-709f-4cd7-afef-3e3dcc93996c", "value": "BRITIS~1.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1939174-41a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777233331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233331, "uuid": "43baa5b5-93ab-4e2d-bfa0-3496c6963787", "comment": "Malware payload (Mirai)", "value": "da8e7dbd950c773953a37cffd1de82e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233331, "uuid": "85661d19-0058-4bc0-a0ef-742d6880d016", "comment": "Malware payload (Mirai)", "value": "04b314ebfad0d5cfbc156c7d625bb7664a0162ec42e584e688cd046bbe2dc9ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233331, "uuid": "e15cf914-2d6b-495f-bb5d-97c50f7ab062", "comment": "Malware payload (Mirai)", "value": "58521f2cc8243f8de789221d3d58eccfb609d615", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233331, "uuid": "685561dd-f869-4b1f-b43c-21e386f25b80", "comment": "Malware payload (Mirai)", "value": "0baafbc4d44627e24b3733620539f5bb223774a75e43bc3034f05e68990fc4779350abf9ad8eecfab401c87f58a81584", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233331, "uuid": "ef2b31f7-5164-46e9-a336-d6b57c6ec734", "value": "T1689328C6B401DC7DF80FDABB4463290EB630E3611A935B26675BBD53AD321E05917F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233331, "uuid": "76635fb2-6bb8-460d-bc72-3064f68899fa", "value": "1536:LsdLEbXJld3JWU6FRs/yNLn/MiBQ9FW6O35Pb8bMThLbKrTsX5vH1M0zfTnVQ3uF:LrWXFIyNLn/Cw6O3BfuAvVMqYuaB/wz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233331, "uuid": "b3b0c78f-035f-48d6-b945-a3cd7c599625", "value": 96732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233331, "uuid": "0d0c875e-3657-4306-b96f-bf42e64d9868", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233331, "uuid": "ba30b56a-b80c-4d39-843c-925fe4bf50b9", "value": "luxzz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ba8817-41c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777244398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244398, "uuid": "a750934f-5c21-4cbc-9834-d99d93f9ec3e", "comment": "Malware payload (Mirai)", "value": "ced65c2252779cda9c3033dab8f4e269", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244398, "uuid": "9ab99b48-f0e0-4782-b3a0-28b37868b964", "comment": "Malware payload (Mirai)", "value": "05b38040011f67a00577d9c56f0cee773982c9c38684fe10290aa5656c68d2d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244398, "uuid": "fb17807f-8064-4921-8bd3-f0c0dd759595", "comment": "Malware payload (Mirai)", "value": "30cb993a7f377027fa8f60b08a6311724457b79f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244398, "uuid": "dc84129c-6699-47cc-bd92-0841c9dbd7e1", "comment": "Malware payload (Mirai)", "value": "bca122f216b5699a525dc6de55b9cdf9dfffad2547d48ef4b87a834785d3e045aedbbd8fb6d7e649be74cb88f307df3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777244398, "uuid": "370e1a8d-c521-44b4-8f4d-14a75528786c", "value": "T1F2145C537B60AF62C228C63108F3C76267F532D217D1D149662DEB1C3A227896D5BFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777244398, "uuid": "563f7038-75e8-4189-89b3-4c77b9dcb227", "value": "3072:8mSUK8AQkIIerIbkn2zutMBAFfs+kVGavjm1d64dd6vwORRMr:tNAQRIeruwCBqk+CBZvwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777244398, "uuid": "0bcb8de1-033d-4e8c-ba21-02300a876751", "value": 196992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777244398, "uuid": "36261a99-21cc-4bd6-887b-f129285e3930", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777244398, "uuid": "f2660148-afb1-4738-9fbb-2526e1ef4be7", "value": "agent_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5dc0716-41af-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777235835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235835, "uuid": "fa5bab30-2a09-4942-9dd4-cc0eeb39eaf8", "comment": "Malware payload (ConnectWise)", "value": "b775d36ef830a8dc15957f84707bbd08", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235835, "uuid": "c51efcbe-1421-464b-9685-82075a14f989", "comment": "Malware payload (ConnectWise)", "value": "05ba3e93942cd4b71ba8f29ade598c7379e6c31da4bf4d4423a3b78403ebc735", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235835, "uuid": "555c88ff-79a2-4e88-8c8b-8afd5eb9aa89", "comment": "Malware payload (ConnectWise)", "value": "f181e7965e8db0ace7cc92e527fb453d95dc059c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235835, "uuid": "90f96727-83b6-48b0-a45f-504544bf9fe4", "comment": "Malware payload (ConnectWise)", "value": "362d80a0b0650ecda6a986e12cf67a9308a9cf9c43c1f60e732e4b264b923c3eb4bca60a829b79ee9a955abb66720c98", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235835, "uuid": "113a0a44-d5cb-42b1-97da-8d7cb41b105c", "value": "T1DB646C11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235835, "uuid": "26946024-5754-49c4-9ba2-325ca1b4e840", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235835, "uuid": "da9d18df-3255-4844-9b98-67aabf288850", "value": "6144:amlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9P:p1iw7gryNkSV1hy1Z1u2JLu9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777235835, "uuid": "82814763-69d5-4900-ace4-6ac2fadc3c12", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777235835, "uuid": "098a80fa-5587-4825-8a61-5281b80e34d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235835, "uuid": "a3cd5369-b8fb-480d-9751-4d577ac9c6a5", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827de434-41ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777235319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235319, "uuid": "138a2b65-fe87-4a67-b1af-869230b306e3", "comment": "Malware payload (Mirai)", "value": "410e3a9f8d714a4559f742bc8fbed175", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235319, "uuid": "6e721661-a332-4998-ad4c-1dd048d15ddd", "comment": "Malware payload (Mirai)", "value": "05c435a4a852396e89e91b566311f4782b0faaf4f0cd22329680b7f8217c6702", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235319, "uuid": "f7b9a008-86b8-446e-a2f6-905c2baf8a7e", "comment": "Malware payload (Mirai)", "value": "3bbc5ed346fe190d81cc612af8a293a3f8772fda", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235319, "uuid": "9adefdf8-1828-4724-864b-1b1a69d5772f", "comment": "Malware payload (Mirai)", "value": "6caedcd2b5123d41b3dab5e5f9ef39bad6eaea9478f6ca54c5aa773a54b1f612ddfce6b2544a029e264004b68ac9eeb6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235319, "uuid": "33791778-e988-447f-abab-c2ec4658d07e", "value": "T1FB6181A5290B8AB22CBA8F6322AD41143187C1E61CEF7F55DBDE24E888ECD56F440742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235319, "uuid": "ede7ce4c-a837-46c8-a777-e11abcbbb441", "value": "96:i2J12gb2vB2QD2y32mv2jp21V22zL2RZ2Yz2k/32rpL2zd2wbY:nJEgqvwQyyGmejY1k2GRIYik/GrpazsH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777235319, "uuid": "31e458d4-0903-4d48-bd79-ced34a6f0165", "value": 3284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777235319, "uuid": "cd0fadf0-977c-41fe-b8b4-0ffcb6bf7956", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235319, "uuid": "b9eeeeba-ba17-402d-bcd0-17cde547b4cc", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960be677-4199-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777226332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777226332, "uuid": "ef3d0ddc-7f97-42d8-8597-6c27e8d31039", "comment": "Malware payload", "value": "79ccc97d9712d464d234eb26e5ca0d2b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777226332, "uuid": "6f5aba13-1489-4729-aa4a-860a3eda06fa", "comment": "Malware payload", "value": "0694447345db71f736d16a75926e06c4d81f8dada3e24dfead440d5d212f2d56", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777226332, "uuid": "a5959336-747b-4f0b-8cdb-b7e445491581", "comment": "Malware payload", "value": "8e9ab18ac85e94d4abd6f8148306c5c808818516", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777226332, "uuid": "5a5b40d3-fdea-4a78-9b9b-95bee230b332", "comment": "Malware payload", "value": "0ee49c1a23c8bf9887c4e7cfe0b4234fe64d3da17a3653ba3650b98b8ad89d71413bc9ac2109045756ad1ee388ad27b4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777226332, "uuid": "62c7ba56-e716-4612-a401-89f49e0e0cdc", "value": "T15AA74CEA72DDD63A45C6316156A608BEEE1470C88FCD4214FCF05B202CAEE1D861F7E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777226332, "uuid": "9f61216f-d7cb-4706-b8dd-73fec6872859", "value": "12288:+SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSe:D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777226332, "uuid": "a03e4923-afd7-4252-b93a-74c4f794706e", "value": 47628060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777226332, "uuid": "06a70547-e6f1-4cfd-b6ca-d35f60db5688", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777226332, "uuid": "6d0a4210-15f6-4db1-8adc-bb39de6d6f8b", "value": "PROPEL~1.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d590507b-4114-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777169316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777169316, "uuid": "9cdb547b-a4ff-4170-9dd0-3a7e75eccbaa", "comment": "Malware payload (AsyncRAT)", "value": "03e091a3c8352836779312e31affb2bf", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777169316, "uuid": "71e43a52-0369-453d-9c39-b0fc306a3007", "comment": "Malware payload (AsyncRAT)", "value": "0729f408d5386d401f611358b5b7080afc070d352ad0fbbc45df1e901fb92a57", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777169316, "uuid": "0723c201-275e-4e5f-867d-0cffdc59d689", "comment": "Malware payload (AsyncRAT)", "value": "de9e064fdf15f17d80d8f82c315ef6813fd0dbdd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777169316, "uuid": "00869691-0cf2-4e72-8841-3cdb2e0cc1a4", "comment": "Malware payload (AsyncRAT)", "value": "f759549d89629b4d8e44612dabe7e30faddc33f36274cc65e6cc7701f57454b76cee22f0f580531f7409438469eb4211", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777169316, "uuid": "a32ce702-fc1c-4945-8960-8956e05bc47b", "value": "T13EF186052CCA857601F792354F296691FA1D02CB0711E6EE3ADCC0449FBF3E745BADA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777169316, "uuid": "5d16d900-8fd9-4cc9-901e-51d9636fbec6", "value": "192:Lj0SPdPePMPsP3MAtkQ5CXZLocad6o3ZpH5SlvblCYliF7TK:dPdPePMPsP8RpLocad6MkJ9liF72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777169316, "uuid": "8f60f7b8-188d-4d17-a25e-04567668d6de", "value": 8136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777169316, "uuid": "7101978f-a0a3-4172-9bec-3684a69be19b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777169316, "uuid": "cbde8b4a-dd2b-42af-b0b3-b27010c3f3a0", "value": "das.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03393dff-416f-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1777208047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777208047, "uuid": "6ea6db28-697b-42e8-b37a-91007d827cd7", "comment": "Malware payload (Joker)", "value": "06c56c48b3ed08e3c1a4e46be83b2392", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777208047, "uuid": "e4de6a10-57cb-4470-8314-f1e57280ee1d", "comment": "Malware payload (Joker)", "value": "08110b5fea63d2fe13c908bee8a02fa0f37dd99f5280a1449ff10200b7aca9a9", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777208047, "uuid": "95b93920-3564-4349-be70-bb7bffdb9fba", "comment": "Malware payload (Joker)", "value": "2df8216f185975bb2681f5a718d8913bde0ab8b2", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777208047, "uuid": "bb048627-e975-46b0-8eca-3f238a1d48cf", "comment": "Malware payload (Joker)", "value": "46700aae6156e118d002d96e36f8f6274d30161b2bba6f879c51defe398bbf0eb76a353ab89673411b6518471c868ade", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777208047, "uuid": "2881d7ea-b726-4e7d-a5b5-01b1dc8e31e9", "value": "T115872309FB0DD82FDEE7B07C4D96025262663C8D8201D35B6521F21DBAB76D48F2ABD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777208047, "uuid": "a20a4a1d-583b-4272-9ddb-ff9f71c31e8b", "value": "786432:UqI36Ceo2pwtKzZGB9BWMIlS8rA8uFMtYxArZotcmQ2:xI36CWKmIpWMf8rvqMDatcmQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777208047, "uuid": "645e3aa7-ffaa-414a-9e0b-cf82bf96a74e", "value": 36880691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777208047, "uuid": "5157e4a3-f7d9-4462-a3a1-7dffb0efb682", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777208047, "uuid": "83b7fa8d-e5cf-4555-880d-0f01bdad1bf8", "value": "com.cleanjunk.cool.junkcleaner_1.5.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b4a70eb-4190-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777222234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222234, "uuid": "992eac6a-1aca-4a85-83e9-9b992b4e4f0f", "comment": "Malware payload (ConnectWise)", "value": "ecf64056baabbab8987a07dc27a18332", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222234, "uuid": "6000c6f5-6f74-4759-888d-9fbc5f20772e", "comment": "Malware payload (ConnectWise)", "value": "0821bc0fe90d6c0d3505db85b8dd5afe4102fa59d5f3ee610be6931f061a152f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222234, "uuid": "4b881d6f-2dfc-40ee-81f4-dc35217f7271", "comment": "Malware payload (ConnectWise)", "value": "25d916df603b4c3152a954dc6761d9795e1ad329", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222234, "uuid": "b5cd2883-a630-4603-9890-219fb624b6a4", "comment": "Malware payload (ConnectWise)", "value": "05ceaab521671767e1b83443153281bca2363f692e113e93a2c84d4dd1ba8961b051f5036d5f4e9e833be2a608235b97", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222234, "uuid": "1236d5ab-7e11-4db2-922e-3901ff889bed", "value": "T1B1646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222234, "uuid": "afe8b40f-806c-4338-9737-548f1bf19e6c", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222234, "uuid": "25fbfa7f-f358-4223-8bd1-9b63e540efc7", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:51iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777222234, "uuid": "c0bcefdb-5cb0-42e1-bc75-f9a1ae7c97e9", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777222234, "uuid": "cde71f50-2f73-45eb-9da2-f46c2275aaa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222234, "uuid": "7615946d-a9a0-4d38-911b-0789c66136d2", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858b1ffc-4172-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777209554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209554, "uuid": "22d92185-3a94-432d-ba5b-02ea2059cc4c", "comment": "Malware payload (Gafgyt)", "value": "88f446494ac50a5d12a1f82d98dcf5dd", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209554, "uuid": "a305d50d-3c3b-4ba3-bdc9-dcf1d5460c5c", "comment": "Malware payload (Gafgyt)", "value": "09a437a57ee7b02d6ad061967d770a56dd92b7458167a578746bcb05571d9db9", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209554, "uuid": "90db4e45-2057-4800-8f1c-c16293692f20", "comment": "Malware payload (Gafgyt)", "value": "20e601620c5004a96bce2679ed3f836234476669", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209554, "uuid": "bdc1048c-43d7-4c41-bc24-e8311b0c5c1d", "comment": "Malware payload (Gafgyt)", "value": "8bbf7674ff6d1c3246fcae514715ccab94a469503a0b8c5c6e7735267b33202f6610cc4f1e6b89e84c0964efab23077b", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209554, "uuid": "5a99e219-7f11-4956-94c1-fdeede288151", "value": "T102442956BD419F17C5C262BBFB9E825837167B78C6EF3102D914AFA4338A49F0D3A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209554, "uuid": "412fd01b-d223-401e-a7a3-4cb36ebb7cf5", "value": "6144:BxLk1xjF+CHInTaXzuSuI4JUKz5Ey7jj87rY:Bxconiz8I4JfFEKMrY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209554, "uuid": "722222cd-cf9a-4b08-97a9-6d32dcd6dca4", "value": 266272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209554, "uuid": "54a7c3be-da04-4eb9-93f2-d952134937e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209554, "uuid": "a11ef21c-e6ee-4e7d-9e8b-e7a1a59f90f7", "value": "redis-conteinerd-shim", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb2402e-41a9-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777233085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233085, "uuid": "475d5e6e-ca84-49b5-9e57-c2c1b77a6cca", "comment": "Malware payload (ConnectWise)", "value": "9e3e9979d816dd5f549680c842cf6519", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233085, "uuid": "48782aae-9bf8-4306-a783-df36538d4882", "comment": "Malware payload (ConnectWise)", "value": "0aae9ab8b3a6469a0381d52536956c175223a334d445c15c129f909dbeac1da8", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233085, "uuid": "a17f1a65-5ef1-4f17-9b88-7bb17fb86106", "comment": "Malware payload (ConnectWise)", "value": "c9213b5a4165963a54923e034395366da960747f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233085, "uuid": "2d9ffc31-bd2d-458e-8c70-bdde647c531b", "comment": "Malware payload (ConnectWise)", "value": "cc1bb99aca62b11097a95b4b9553be68437a3dc44fae51e5d6eb5a2dca9e335f5ffb71b5249ef83b0390a93128a44a2f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233085, "uuid": "937dddd0-cae7-4b3f-a942-85d683cea626", "value": "T1B446F141B3D295B6C0BF0638D87A526A6674BC108312C7FB57E4BD697D32BC04E327A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233085, "uuid": "9a56eea7-4f04-4d96-83d4-b29f97a38208", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233085, "uuid": "4c0177d1-2e14-4ead-8621-22a519dbb33c", "value": "98304:1us6efPDFdRPc3BwN5x70dX2DSiGN+EzdBP:sfefPDFLsBwN5x70AShv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233085, "uuid": "44924d4a-59a0-4456-8f47-f6ac542aff1a", "value": 5777488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233085, "uuid": "ccab09e7-640f-435b-8c80-792096f6566d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233085, "uuid": "6a07bf14-ac2c-4a0c-973f-25166e7bc087", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92807daf-412d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777179941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179941, "uuid": "65b6f9c0-42f5-433f-bb90-79aa625fab08", "comment": "Malware payload", "value": "d03273c4e1097b7fdfaa69efd004317d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179941, "uuid": "ba784754-bdfb-4e76-a669-4315c5ef842f", "comment": "Malware payload", "value": "0b2ced5e9775cc88cfc27d2d84946d3e2fc8c7eeedfe344a254f3162ebe658da", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179941, "uuid": "2fe8aec3-ef9f-4b07-9f84-e2395df5673a", "comment": "Malware payload", "value": "4f31c40548778688abf97472bd4018cfa9907a13", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179941, "uuid": "944f2a9e-a383-4050-ad74-43e679be0ebe", "comment": "Malware payload", "value": "2061fc0be1cd298a3a3040419596a012456de81e71574b65114919be5991d96da7101d5ba1e742df7912eb9b22876a91", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777179941, "uuid": "5ce819a5-853f-43ec-b538-169d030be3ea", "value": "T12D64682A942915DA0F7DD8E5152A03D87921C7FD7E3E318E0FB8BEB43F7A991420B605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777179941, "uuid": "04115842-c696-40ac-9cbf-75ba3d9bceab", "value": "96:xEu1/WfGf1rE8WWWzbWWWWWWWWWWWWWw2zQWiWNTfdLiqRKqkdAE8WWWtnWWWWWp:Erm32D1wQJFsFcUDZa6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777179941, "uuid": "457cbf42-afef-4906-b033-cd08f4b6459f", "value": 313121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777179941, "uuid": "a628d273-231e-4620-9682-b686dd09751e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777179941, "uuid": "d0312d7d-a719-4458-931b-c781a5c604d0", "value": "adobe.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89924b3d-4172-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777209561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209561, "uuid": "3e2ae56a-86e8-4e66-843b-14d2ade99552", "comment": "Malware payload (Gafgyt)", "value": "50980b07a91e6ddf57e9cff26f12f9e6", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209561, "uuid": "42e69159-0254-4d32-8ce5-a9c943be2350", "comment": "Malware payload (Gafgyt)", "value": "0c5c70a2de859bc2f5e75372b70b71675f6da3c06e869b1a4ae947d9efdb7aef", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209561, "uuid": "6e049fcd-7736-4871-ba5f-db831b8951b0", "comment": "Malware payload (Gafgyt)", "value": "1173f94f455f21e4db3970f9f3e0e7a573c44fb9", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209561, "uuid": "564bedcf-8cfd-4cd7-9f5e-18101f7ffc9a", "comment": "Malware payload (Gafgyt)", "value": "000b0c381a723686e049fa88c6388c25e41f19529ff8687f1d70118d4d1dcc530fce83a4658917497e698ac0bd53409b", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209561, "uuid": "4062a7d2-c9e6-48ca-82ce-288fbee8818f", "value": "T12793025F9F0CE566EA40ED39D9402AE7365793C17602EB79D52403AC8432E0FD2ADB23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209561, "uuid": "ce31ea9d-481d-4ff9-a25c-4d00a5c218a6", "value": "1536:9l85pMYfa6LUYzdp6ZkRDIj93kijDmI63zu1vd1tkVd1bonBhNL:kZh2aRDIj93ki5lDkVbsB3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209561, "uuid": "7d75e58f-2005-4993-b1fe-9c0dcf696b82", "value": 92520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209561, "uuid": "32a35cf4-4a79-4c70-a2ec-701c11f8342d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209561, "uuid": "93e1ea6f-b748-48d2-9832-2de69007ef9e", "value": "redis-initd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf29e04-414f-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777194615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777194615, "uuid": "0809aae8-7b97-4f25-87e2-6609cf765fbf", "comment": "Malware payload (NanoCore)", "value": "a46d44d0258b0f906cba5b91c64ee24e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777194615, "uuid": "62a874b2-d6c2-4ca4-b99d-dc587723d27c", "comment": "Malware payload (NanoCore)", "value": "0c74741774b4c897f607b6ff684ce3ddd8ea00af5fa723877d1e8bab3b6d53d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777194615, "uuid": "7646cf83-32df-4d69-ab56-2edb4af0d3d9", "comment": "Malware payload (NanoCore)", "value": "924b2b42aa08c8974bd1720a23f3fadb467504b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777194615, "uuid": "11c57c9e-a55f-4c4e-83b2-3e91f0a58c1f", "comment": "Malware payload (NanoCore)", "value": "daea28d6f60ab8d84fdfc99efaf2992bb5972fc10831c65701b56720324d65a82eaaec47e9a1f96aca7c2dae5bd1a94b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777194615, "uuid": "0cfd7510-4f47-465e-9ea8-74b07473f879", "value": "T1F414CF563BA8893FE2DE86B9602212579379C2D398C3F3DE2CD855B34B167E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777194615, "uuid": "aead70d5-3060-4823-a430-2d50e196f1cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777194615, "uuid": "1a940112-4e79-4496-b726-649ece9a2732", "value": "6144:sLV6Bta6dtJmakIM5TZliMCZNG2v8zO+nHe:sLV6Btpmkqiz77Gtn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777194615, "uuid": "5d191528-eafa-42a3-a9c4-b6b3ec42b857", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777194615, "uuid": "83b210ff-80c1-4378-aa2a-3a8bc9f80987", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777194615, "uuid": "1725c7a8-a540-4657-8b2c-9c5316637fbd", "value": "rattnano.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c94d7e-418f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777221883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221883, "uuid": "c567342f-7636-4a9b-b844-3943636f408e", "comment": "Malware payload (Mirai)", "value": "a0be236a7db7b9ff8f099f062a1752e5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221883, "uuid": "d46591b6-8d8a-4eed-9126-f68aa3e327d5", "comment": "Malware payload (Mirai)", "value": "0d8728e19d66bd67ca942b47bf2876ba30346f68960e1faf5d33b9ec03a2f4a4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221883, "uuid": "99c187be-1cb9-4f0e-9439-4391d7f512e8", "comment": "Malware payload (Mirai)", "value": "d61a275d40e244308b431684a9c13c62ad3b4ade", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221883, "uuid": "dc915130-5a71-47fc-bb6b-88d43029da29", "comment": "Malware payload (Mirai)", "value": "b976c1392da74ad89ed0f724953ee51581e2dd2908258f4a6af4af70ee43b77a8c2f2988c0ede1e7bdbf9ba293bb01be", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221883, "uuid": "605d01b9-7086-4349-a2b1-6114d65f9ccc", "value": "T14941604B73CBB721EEE3E473759560202282C588D0ED5B4CF2D83ADDD0ADCA472699C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221883, "uuid": "c868f884-8225-4a74-9e11-7d8a8b9b435b", "value": "48:K8fgNeRbKzAHNl4tCZQLc5qYTERBY1D1A1V1a1huBaX1mTwFqOYg3fvYNI:K8fgNeRuzAHNl4tCZQLc5qYTERS1D1Aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777221883, "uuid": "7cc52b74-650b-4187-bbec-8643fbc7bbb1", "value": 1996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777221883, "uuid": "a83256f6-0756-4e22-900a-13f7be3063a7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221883, "uuid": "0b064cb6-475a-48b8-a577-e8b403889ad0", "value": "fuckjewishpeople.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ded72f-41a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777232580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232580, "uuid": "e46a0fa9-184b-4c83-b3e7-0a51dc0f8d46", "comment": "Malware payload (Mirai)", "value": "a4047aaecbcc7e2aaee3e65c3200fd62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232580, "uuid": "7b787b2c-de5f-4ca6-8b74-ecfc55b6a330", "comment": "Malware payload (Mirai)", "value": "0eef60dbcb9f788c9445a28746467c642cdb44c5cba160aae6a2182cc21bca4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232580, "uuid": "704c1614-fd4f-4bee-8926-92f41932e8b1", "comment": "Malware payload (Mirai)", "value": "a01cc6a90d8f14f3927b69db0a8c00289cbcba35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232580, "uuid": "c6a640d2-1bbe-4719-99d8-724b6e0e2a87", "comment": "Malware payload (Mirai)", "value": "ed8db4c50d5f1b023ae338579dbaab0cff04217fc972831828824c2a97605347612f2e70062a2c201bb35c7f84e93ce4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232580, "uuid": "a08264c9-870e-47d8-897d-a66d05a32d87", "value": "T1BCC3E897F801DFB7F407D37604934C09B530BBE50AA25A72736734A7AD760D56823E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232580, "uuid": "36c79b8c-792a-4172-abce-eeb16a6c0267", "value": "3072:Kpu0+8YpAy+O3y8+ihRA1XttbI30yxBYFt:W0Aihi1P00yxGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777232580, "uuid": "745b8560-f49a-42d9-822c-4809a728e5cd", "value": 123048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777232580, "uuid": "1ae8a8f7-37e8-4233-a761-db822f99ee5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232580, "uuid": "db2d3b14-dc02-4f40-a03e-21ae9438fab8", "value": "shabak.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01728e5c-41c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777245410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777245410, "uuid": "1c4ef3f8-56aa-4926-9eed-dee4133419c3", "comment": "Malware payload", "value": "68365e45bbf301dffe943a52f674696d", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777245410, "uuid": "7ec7c8c0-472c-43e4-be08-82f82843f4cd", "comment": "Malware payload", "value": "0f09ea034ef2cdf9d7de7773a0f80880643050fac39fb3409c14f3f061378d9a", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777245410, "uuid": "45695101-0f74-49e6-90e6-b2d2a4a8ec11", "comment": "Malware payload", "value": "69810cbee590e94c81aaa1d0865ba802f89f0466", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777245410, "uuid": "f1d02599-9109-480b-a9fd-3fcbc8424112", "comment": "Malware payload", "value": "b5a85e641e41557aae0c5424fa10bfb80752484d6a3dd0162b4aa9b6b5d8e0f73cecdc1e6416e3de81c345328579ef1d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777245410, "uuid": "9f83ac2c-a90a-41c8-ab49-31b254645004", "value": "T12C070F3DCEE8423EC2B7C929D9CA4A17F85A091B231CFD4A64D773975527183BCA211E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777245410, "uuid": "a3d3d92b-4bb5-4e4d-b1f0-b1407f2345b9", "value": "3072:SfC8pbP3luExvrprCm9jVaQ01EaKk3zHrDcjWxYt5ZtvcPc5GtOivGN6/DFybCVJ:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777245410, "uuid": "3c733f44-7ccd-43f5-b875-b2ab1b8d3479", "value": 18292890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777245410, "uuid": "74bd709c-a070-4d21-ab2f-d396858713d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777245410, "uuid": "dbd93b66-6071-46a9-832d-cb7cdfe0b669", "value": "nuuop.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe6c101-4121-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777174943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777174943, "uuid": "868910a8-76aa-4152-86df-bdd59a04e5d4", "comment": "Malware payload", "value": "41786ba8662a74f1b6349dd91d1a6ab4", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777174943, "uuid": "99253510-2981-42fb-af24-239112e4ab4b", "comment": "Malware payload", "value": "0f3f78a6217be71d60b2000a6436f405f07123357984b4977447369849fbbc47", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777174943, "uuid": "3d359a4a-03e6-4c26-a7fc-a458a27638b2", "comment": "Malware payload", "value": "45439f4fb6a6d3b6abf8f0a0506618b78f3fef83", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777174943, "uuid": "90d6fd45-dea4-43fb-9c51-3708fa0924be", "comment": "Malware payload", "value": "ec37945efdcf7ffb6cc2b13097e49bce895c4a4f590d91ec156f50fa45347eedfdb39275e1877678d9d4c2f10b65df84", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777174943, "uuid": "f7f49835-6e13-4a05-b4b6-5f8fcbc2dd83", "value": "T18301FE10DE8CC26D603947722432E84EF7EB1513A3039CD9B849C1663F707689CB5A76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777174943, "uuid": "00981d1e-3fa6-4f8c-9e7c-0084bd2ceaa1", "value": "12:VteghMees4cmcYOBPEgZ5HhcVKxMFDu9t8aVuaVeCqRSUz3naHSuDR7wL:/egxMTO9EuHhc+rKBCqZnnuNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777174943, "uuid": "c0a97f5b-5b02-4d9c-9c18-6cba2da8155c", "value": 753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777174943, "uuid": "9e5a2b95-16ed-4279-a66d-c2d287a8b215", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777174943, "uuid": "7979ebc3-82d6-4e7f-a281-ca5ec434ec92", "value": "VBS3(1).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1995b8-415c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777200308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200308, "uuid": "be06c4d0-e4f3-4074-a1eb-3a63f3ffb082", "comment": "Malware payload", "value": "8b43394f7cc2827b69051ca879517f6c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200308, "uuid": "b4c86f04-6946-4326-a5b2-699edf7287e2", "comment": "Malware payload", "value": "0fcbbe433ab1b3cddf82078b0d343478fdb48aa59a10e0661a96ea93189bd3be", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200308, "uuid": "fb7aaf9f-2686-49c2-98a3-7f6c910da8f9", "comment": "Malware payload", "value": "459f01ccd9687a3e110cf39ff23330348525f400", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200308, "uuid": "a3c203f9-a425-4e09-bdfe-8a4ae039da68", "comment": "Malware payload", "value": "a5bb9c595ecb9bc18589df1fc62e3069a4055e3bf86994b4a63624b7952adbe4cfaa77e43788205770d32ede982217a6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200308, "uuid": "ebbee94b-5824-4870-a886-565909f2bd6d", "value": "T118011052D7D290073ABC89A9BAA4A18CD50C348336929098BCDD1660EFB4D5F30F1F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200308, "uuid": "430726f1-3fc6-4139-b06a-7488de378f7d", "value": "12:jGmmvPdnsCGMOd2z+fQk+TfQwWflszP01WQN8QNTZQZ8qTogUIKjiqvSj:5eVYMY2qQkKQwWfFlDTZC8OU3Oj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777200308, "uuid": "c55c00df-3a17-4e10-8a67-7ad7ffeb82d5", "value": 771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777200308, "uuid": "223fca4d-e111-4a6e-8318-23f8c26c434b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200308, "uuid": "fae1370d-b79f-4fe1-981d-6c705912395d", "value": "test.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8354092f-41af-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777235750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235750, "uuid": "e0ae59cd-4534-4857-ba26-4a5abb39b640", "comment": "Malware payload (ConnectWise)", "value": "f8789269ca9432c7d8eefd946d85d2fc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235750, "uuid": "6aa9970b-c773-4b56-b75e-4a76fa973898", "comment": "Malware payload (ConnectWise)", "value": "1151c11c4e2a407d9ac3fdbdaafd6ba876b700624109f4019d372e00c6e15692", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235750, "uuid": "ced56c90-312a-49a8-9d75-53fb33329e92", "comment": "Malware payload (ConnectWise)", "value": "6fe7cb98d3b3bdc1db93f3babc6fb1e3a1b33b8e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235750, "uuid": "9a146027-3e47-41df-b0cc-c35688639a16", "comment": "Malware payload (ConnectWise)", "value": "4c924a95670ba0aa032c9a075451576bf732768d100d87adca73c444c430427988388abfa7e2c9197e2e2f1dad1c9390", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235750, "uuid": "5472b38a-3515-4556-aa9b-4f173afbe2bb", "value": "T1C546F141B3D695B5D0BF0638D87A42A65634BC108712CBFF57A4BD296D32BC08E7237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235750, "uuid": "69e10187-5a8a-489b-bf51-ae6a40e73b6e", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235750, "uuid": "dce9684b-cd92-4dbd-b797-e5c17871f6b6", "value": "49152:afRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8if0:Gqs6efP3rn/TYGVxz3GBwRVkGuyXOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777235750, "uuid": "53049217-8ac3-43b7-9355-d779aca2a2e5", "value": 5672400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777235750, "uuid": "409efe35-7341-4246-bdf1-613c2f996a48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235750, "uuid": "7ab519b1-40fe-4ed7-9657-f89018c68b2b", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a240a357-4163-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777203160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777203160, "uuid": "e071ad8b-343d-4c6a-bdbd-39fb63a5e9e0", "comment": "Malware payload (Smoke Loader)", "value": "c51cef8c2d0572471bce9d370b3368dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777203160, "uuid": "ff5bec01-1e6d-49c7-b227-cb4d311987f0", "comment": "Malware payload (Smoke Loader)", "value": "119722e6e370e280de412860f429a037caf0d86d19d88100510423334638ea1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777203160, "uuid": "6033846d-f704-495e-ad96-7bc826175c20", "comment": "Malware payload (Smoke Loader)", "value": "95666d03cf54f0a68d71d2fc3d5cbed912e4c9e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777203160, "uuid": "61859057-72c9-4f62-acaf-db894cf8f847", "comment": "Malware payload (Smoke Loader)", "value": "3c9921040663956fa8636d43305abaa49cab2e87fc605c046e6eb2965ceac5d1fae6b0a52ebc4558251e5390699e0cc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777203160, "uuid": "52e2ff38-afd1-4783-b738-2347fa562676", "value": "T170B56B027D9104AEC459B7314CF63681B735F8480B2667D32F97AA783EA7BD01D7A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777203160, "uuid": "f625bfd1-649a-4dab-8ff2-c72bc846eb5d", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777203160, "uuid": "72b4a329-eb71-429c-9c9d-a749f3277711", "value": "49152:JFOnQ73+LP81iBTupbiBVHIsaadmqY2luHDsN:JGLI0jYCujsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777203160, "uuid": "aace0d23-08ae-4941-9d9f-7eaf4b49b74a", "value": 2472456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777203160, "uuid": "63d7155f-ccd6-44fd-bc38-33d72482738a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777203160, "uuid": "4de071d3-9637-4396-b8e2-bf2c7a4422dc", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671358e7-4171-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777209074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209074, "uuid": "4178bc0e-6e02-4846-985a-d59c0212792e", "comment": "Malware payload (Mirai)", "value": "acb4a6c7c4ca98da70613f8e4a3b6325", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209074, "uuid": "89af5516-0788-4912-b654-46c52c43cd1c", "comment": "Malware payload (Mirai)", "value": "11bebb5b642c72dab008ee8ff3bfd7e58e6f3b8df5bc0e12fe66871a7295bfa4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209074, "uuid": "722eb44c-0009-4146-a020-ce109b05e945", "comment": "Malware payload (Mirai)", "value": "1581be97ac297c5c2680e88363e9b7ff588aac88", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209074, "uuid": "90062b44-f8c7-4e14-9f9d-f6f99bd100c4", "comment": "Malware payload (Mirai)", "value": "442254c064f1671cae3885443b5336e5bf7b8c9afeae15451ff7d68a7c4571e1bdead7b5c49a09ae96de4d33c1d0a5ca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209074, "uuid": "1ce76ec7-ca88-4b39-b734-b091cc44615d", "value": "T14AC30956F8819B11D5D151BAFF0E124E77131B3CE2DE7312AD24AB307B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209074, "uuid": "449541e2-7a7f-43c4-9e7c-bed45d1aaa2e", "value": "3072:f2D7YhjFMX+maR8TcDeRqQV3tNQYciYTG1w:f2D76aX9aKTcRQVnoiYq1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209074, "uuid": "af2f1f52-6b87-4ddf-8703-b4f01512b04d", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209074, "uuid": "eeb4ad91-a3ac-439e-a8f6-947b8fdc37e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209074, "uuid": "39907197-4c90-4e70-b9c7-a8317a0789f7", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac3fc20-4168-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1777205295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777205295, "uuid": "8256a4d4-51ea-4303-ba3c-25da7e55ac75", "comment": "Malware payload (Vidar)", "value": "8d2e4e5635de185fc6dbb581baac33bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777205295, "uuid": "6d85a9a8-8fcc-4858-a24c-d81cf7f6c59b", "comment": "Malware payload (Vidar)", "value": "11d895cb72047599468d278ac5bd5ecca8a3d52258679281013fbcc76886aca0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777205295, "uuid": "076d9e96-d7b5-4971-9199-205b42905163", "comment": "Malware payload (Vidar)", "value": "6a261e6d66caa45c134a8ad79614cd3ce9819c42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777205295, "uuid": "4829df3e-05bb-4bef-9f9d-4542689275a3", "comment": "Malware payload (Vidar)", "value": "33c74e80d9ec71c11191f74fc3abaecfabf46b11c52500ad5ad5ca9f279c5f75fb180bb73b93fae1c30b5e0631a6ecf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777205295, "uuid": "83720b7e-2836-4ad9-bd18-73bd87367425", "value": "T1FCC58C0BACA409FAC4AE93728CB751927B31BC5A0B3263D71E917AB82F736D04D35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777205295, "uuid": "a780a00e-38af-4f53-bd16-df729dbde24c", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777205295, "uuid": "92cdd637-6bcb-49d5-b14a-d5d50957a4da", "value": "49152:cU+Xt+jRjovpYaLWnYjkVLwXQYRCha12sm:cU1tEgQkVMAYoa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777205295, "uuid": "06a2ed90-c076-4e73-adc1-e47579e6c6cd", "value": 2575536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777205295, "uuid": "b4be62b9-e9ab-43c0-b647-f2d7259fb2a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777205295, "uuid": "93c6fb5f-1bb1-45a3-8d6d-276b242e2632", "value": "Lumen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "389138e8-418a-11f1-a769-42010a9c0008", "comment": "Malware payload (Vjw0rm)", "timestamp": 1777219733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777219733, "uuid": "594f1520-0ba7-4bee-9f81-fb9ca27f8e26", "comment": "Malware payload (Vjw0rm)", "value": "8f3aa1c4ed9b81bf8fcb81ab033aee90", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777219733, "uuid": "6e867941-a639-4b8d-b782-0343d1fd1ca5", "comment": "Malware payload (Vjw0rm)", "value": "11eb2b29915425091ac5b82efaf2a6a1ca688af1d5702d1fde7376335c5ff42e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777219733, "uuid": "a3645989-44aa-41a7-8e20-e2f0c0aa4c46", "comment": "Malware payload (Vjw0rm)", "value": "a90f437f0de3f84b9cb2258f1b5627565635bafa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777219733, "uuid": "0d78969a-5623-4a9c-bd1a-1b5449a211c8", "comment": "Malware payload (Vjw0rm)", "value": "f95bcf79d9e3ec6932382449b7b16392e695aa593a0ac0eb28291b54e9297ec01bf2a09aabbf70b9a8b72bc6bf00c9bb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777219733, "uuid": "c4e743b1-343c-4634-b63b-f457d8ec49be", "value": "T18B32B09B2360A4B15B9264B835CB1FF029535931962FA59080EBF2C8BD204BCDEA742D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777219733, "uuid": "edd69da3-635f-45d9-964f-222d13380f8f", "value": "192:ziYu/VbDlmTTZhoNdy85K2zpA5xoddwRwfUEVdsfkZsnZ9PIBaP0sgWc+Q:eZ1RmnZi9LzeDo0Rw1vZsnZ+sP0FWc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777219733, "uuid": "03446d0a-abde-476a-93a6-05cacf3fb346", "value": 10962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777219733, "uuid": "bc7d5643-3f41-48b9-a9eb-2e4dc99c658a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777219733, "uuid": "5743b24b-902c-4a85-9ff7-2b36439040ad", "value": "d45ezxzafe.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f561055-416c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777206806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777206806, "uuid": "6b92ab8d-2cef-4bb9-97ce-407e68b21b9d", "comment": "Malware payload", "value": "bd0e97e3336885f5abe8e0fb06657147", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777206806, "uuid": "0b34ef64-33cd-43ca-8a29-28ba8154a1fc", "comment": "Malware payload", "value": "15f848dfe1797a6356ea510a4cc46985be164ef15e25a0496ff0882726ead4cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777206806, "uuid": "c8baa27a-f74e-4cf2-b7e9-567d2e12d984", "comment": "Malware payload", "value": "0a2f47dd8bcfa255d069b26787f2aebca19a3a42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777206806, "uuid": "63a94015-46ce-4fa2-84d2-e33935b35d93", "comment": "Malware payload", "value": "a411845211e7127756b2194df345ea231ce23bce8b477dc211e3b64a4e5fa9f714832b23b005d8827657aa2a79c1d418", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777206806, "uuid": "eee0e69d-60fd-4a50-8606-aee0476f52b4", "value": "T12F0833F704C0E6B2D5BC00F574DA4326BDEE8C6DA99346572020BDBD16B2D9806BE8D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777206806, "uuid": "b28695f8-de41-4a36-a3bb-59f59d9e89a5", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777206806, "uuid": "ac0af374-75ce-4046-b474-4e886a22d366", "value": "1572864:QBJP/ohmR5ksB5P87xTWIO5bhr5SmBIrVkYBZYGsJkZp0Y5M23G:Q7/uc5lcxKIs35BIBkYBZY6j/M23G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777206806, "uuid": "936dc701-e38f-4360-b080-873a38dcbd89", "value": 78634312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777206806, "uuid": "c0f6e1c0-098d-4e82-9665-fb292b0834bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777206806, "uuid": "154fd423-bd96-459d-9248-1e6999ebb702", "value": "setup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46cc501f-4174-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777210308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777210308, "uuid": "a45b58a0-e025-4c6c-ad0e-eb5f717d4e4d", "comment": "Malware payload (ConnectWise)", "value": "8b4c09e3714f9c06e2df37520601a03b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777210308, "uuid": "689c7cf6-a7cc-4b68-84c9-e423c9b45a9b", "comment": "Malware payload (ConnectWise)", "value": "169b85eb15c09b3ff981fdffb6676b440f2c02bee83006dcbf662019a87bec0d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777210308, "uuid": "45447794-4eba-479b-8ac6-cae37cf81b05", "comment": "Malware payload (ConnectWise)", "value": "5de866e664096077cca44053f8967e1503802fd7", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777210308, "uuid": "b1e340dd-91ad-43a1-ad24-c1011229a8ac", "comment": "Malware payload (ConnectWise)", "value": "80d72ce1aea3dc394138027633b6d06ee768b9f2ceb484318a559bd2422f86ad86945582a8fcea0ce18cb68d8bcb6c7b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777210308, "uuid": "0deb2dab-68b8-4605-a06a-51555968a49d", "value": "T1E546E101B3D695BAD1BF0638D87A56A56734BD049312CBBF5394BD392E32BC04E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777210308, "uuid": "58788388-7cba-49de-8afd-d6f4acc24959", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777210308, "uuid": "5ecc8eed-01e3-41ec-8d0d-6dd2ad944ad3", "value": "98304:6zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlu:6hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777210308, "uuid": "0262b1e7-846a-4fbe-b9d3-c11463808fae", "value": 5658056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777210308, "uuid": "abc54a3d-aae0-4751-a443-51aba7f616d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777210308, "uuid": "618b3ea4-9bd7-4888-92cd-d14d03871f1b", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f69281-41a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777232583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232583, "uuid": "d5446ac5-65da-4712-b75c-93c99ae6d613", "comment": "Malware payload (Mirai)", "value": "2f5df7e178b41eb27f4ef0230a52adaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232583, "uuid": "3672394a-d9ac-41c4-9ec4-95a6cf0ad1f1", "comment": "Malware payload (Mirai)", "value": "169c4571a232a0cf8e491c812ff4216bb9dbe2cdc8dfbe36e1385c4f50be552a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232583, "uuid": "0455e532-0bbe-4aa3-97d6-632c8b868456", "comment": "Malware payload (Mirai)", "value": "25e333f78a61c4a53587bc0a72b826ddb13a3909", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232583, "uuid": "467cb4fb-0d08-46f2-a77a-f8382558f12e", "comment": "Malware payload (Mirai)", "value": "a4abcf92c0773d1a8d7a21923b8267f0ea0073a021bf695160a6e41fd1e0f0f8048fc133ffce87aa355989c3bb28b49b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232583, "uuid": "9d01887d-e7f7-4e1a-ade8-345208c33384", "value": "T1C404433E7E21BF7FE268863107F66FB0C75921D232E19241E17CD2185EB528D189EB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232583, "uuid": "6ea83a0f-036e-430d-afba-b74bb5a7b910", "value": "1536:CGb6ES9SaWqOFdyW7d6VAie2rK4zTTs/3R/CH6uT4MHCYNJ2rK4oHyWaH/uNkdYV:RFrdSspAaUVjn2y0WyqSkcnnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777232583, "uuid": "eee127c2-a881-4457-8747-8a3080daca38", "value": 176088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777232583, "uuid": "f607569b-53ac-4c19-a0f3-7e66cf7aa62d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232583, "uuid": "7c74d46a-3a93-4303-a27e-53b37515efac", "value": "shabak.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a32c49-411d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777173235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173235, "uuid": "6ff4f4ff-a437-4af9-9aff-15d0badd279a", "comment": "Malware payload (Mirai)", "value": "bda63ab75863767a307e7aeb191acc49", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173235, "uuid": "6ef69701-a45b-4c77-beda-10bef305d1f3", "comment": "Malware payload (Mirai)", "value": "16ba1c828690746ecfc497b7e0e4264651fbea3d343e0e760a2ede577e1a9289", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173235, "uuid": "2ab648f5-ca1c-4bd5-9965-8ef9eea2692b", "comment": "Malware payload (Mirai)", "value": "fa43436a63c594bd4abe26144bb62c195c246677", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173235, "uuid": "e3b4822b-a224-44d4-b99d-95709faa17cd", "comment": "Malware payload (Mirai)", "value": "98e1465b7375276daf80055aa8893b9aaf8706041c824327d318ab2f5d73659f628a8a139d6a3796a777b64d928f84e2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173235, "uuid": "dd1009b8-cf43-4e1c-b8d4-cd0e4ebe423c", "value": "T18333FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173235, "uuid": "bbbcaca4-d73d-44e2-bb9b-54ebace51732", "value": "768:gduPBFnHooqR8qOCKq2tH4Kg9e+TK806MMUVjzkfQXObHud2oGg:r/hqaJxDg9eqK806MHdkfQX6HuCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777173235, "uuid": "02fa2834-ebd4-42a2-8d85-a51b74eba6b8", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777173235, "uuid": "11dfcf42-d62b-4acb-9bba-68513cdf5cb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173235, "uuid": "a0a6c91c-56e7-4704-82a2-c696dee02419", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589e30a5-414b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777192729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777192729, "uuid": "09d3e452-3f42-4c6e-9d72-7c21c4ff8bf6", "comment": "Malware payload", "value": "cfc9f18a9274644b22bda48e9d805104", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777192729, "uuid": "6d50026a-79f2-47b0-a4c9-2dcc39b938a9", "comment": "Malware payload", "value": "17779098e34634b2e205945a52f7fe3c8c932b4b10c9226024a8a89e37d2883f", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777192729, "uuid": "cace4cf6-cff2-4e8a-89de-815d0c04d6ef", "comment": "Malware payload", "value": "41a912e7556f9284c8c470261f32764b5f56fff0", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777192729, "uuid": "59a1f23f-69ce-471d-8a75-83f625f338ef", "comment": "Malware payload", "value": "5d1072887e07322033caacee1c9564c77a0d3fc74f305cfcb05706c03ec81daf5e5f18289340ea6d779f37a395997aa5", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777192729, "uuid": "fb45ba65-e2fc-4350-984e-7019ee8504fa", "value": "T181C5B065F3C866D9D426DA398B05E333C1B2B9224776E0CB0A96130A1FB7ED15F3B605", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777192729, "uuid": "65589dd5-0475-40fb-b1ad-f7771a8c9b4b", "value": "a7cbd8fd11c0829facbb4d7067a14fe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777192729, "uuid": "421a876a-bc9a-4a31-8ef0-b44c57069d06", "value": "49152:Ru+egoCbyg3fr3PbIHZGWIgohPV41jaeaSKePzreByXqS1Y1VUj:bQL3HZGWIgohPV41jaeaSKePzreByXqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777192729, "uuid": "3bfd4fbe-57b6-43d3-b759-72e3f316c487", "value": 2612224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777192729, "uuid": "ba3080fd-461c-434e-8864-0364395231bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777192729, "uuid": "e489ec85-2087-4586-9b9a-0b70a3a2bc57", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e236ed-411e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777173288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173288, "uuid": "84e412e7-1258-4956-af60-12312245b38f", "comment": "Malware payload (Mirai)", "value": "6a9c6f4a832cb56f940581ed72576940", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173288, "uuid": "a22bf25c-60c3-4be0-80e2-b0223ff8ef50", "comment": "Malware payload (Mirai)", "value": "17b895fcfb6dc7a85a49fb1e3cdd9bcb1558486460044e44a7ecedd66da2aa62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173288, "uuid": "6e6cc0be-fa5d-4fb5-a42e-100cdb9c01f6", "comment": "Malware payload (Mirai)", "value": "9f2ade02a8fbd9aed4a1a0fa579d424b27727562", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173288, "uuid": "c356316e-b25f-4a38-bd84-0c97b8b48fe6", "comment": "Malware payload (Mirai)", "value": "705203f0e94ca98e5dd26c9340d0a3512e5c757461541eaf848e15573aa8d21eb295c76c1bedeeabf0238a07e9082a98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173288, "uuid": "b14244de-e80b-423a-93f2-fff37b423e79", "value": "T130431891B8819A23C5D4137AF56E56CD372023E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173288, "uuid": "7c1d9bf8-45c0-4f65-b049-7f8e8d34c69f", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TW:/M99jmL8BZp9IFUoWKdYuvQ5XIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777173288, "uuid": "c5ed7976-5f02-4c12-a32e-f5ea012a8936", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777173288, "uuid": "3a0529e2-6eca-4ab2-9b2d-2726dbcb61ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173288, "uuid": "35f38aab-3183-4a8a-8829-4331f40b84d0", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c34f3b-41aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777233762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233762, "uuid": "821f9bdd-d560-414a-95d0-6021e310b1c7", "comment": "Malware payload", "value": "c215639f1cf36de5a1a867ab31c04405", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233762, "uuid": "a32848ce-4cc7-4433-ba2d-7b33b2483542", "comment": "Malware payload", "value": "1848fa2af5371d00bc4f0346ae1f5afd843677ca87de377a3f7b2433c0b7b187", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233762, "uuid": "eb3a97f9-09d2-45d9-ae24-7dbbd22ae9a9", "comment": "Malware payload", "value": "f972e37095b25f257cd18260c33510bca8cae6e2", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233762, "uuid": "d6656341-c11f-40ab-8508-61ff180ebeb9", "comment": "Malware payload", "value": "17a7c8403829c54d2147fd9e4a23b777a7e23e82a1ef299a77048e223d38a7122597ed05e445f853797697ea09b0a48e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233762, "uuid": "18cce27f-d664-4dc0-a13e-08bccaf74ed4", "value": "T1A812ED21B527B237DB77E210E10B6E13672B12C3A8648791365720AF64F7607C03E6EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233762, "uuid": "d79b28cd-078f-401b-afa8-653c4b4c6f2d", "value": "96:4Hxo/7j+JvqJ/KmjdUk6waxdqsn0KYbGWLM6Xxn9RouSWRLf/AMSAMcl2z/wwaA9:4HuT3bf0t34aW3m8zAc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233762, "uuid": "78667be6-7b0d-44f2-a30d-e0ccffee8c89", "value": 9514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233762, "uuid": "e108f7fd-829d-4079-a771-f9e61500f536", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233762, "uuid": "dc32d98d-069b-4906-a34d-2d4bc5ceadbb", "value": "1.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bedcdb17-41cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777247876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247876, "uuid": "e2e4c7d4-4d7c-4cc6-9e03-659f8afc9bb4", "comment": "Malware payload", "value": "8af3c685635228d4af2abee0ffefb1b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247876, "uuid": "c571f5ce-8475-4c6a-8dbc-c4288d324c15", "comment": "Malware payload", "value": "18ff201b2a1eddf913af74a02ac80eb3d17f7a759c23a101c11c2027dc29c58d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247876, "uuid": "1bd25617-af53-4ed3-b1e5-31c58004bc9b", "comment": "Malware payload", "value": "77cc1c8bbff04d44bfa54128d6f4f630636e069b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247876, "uuid": "79646708-07c6-4791-aee6-5338793d7f72", "comment": "Malware payload", "value": "5e783350d5f2c82f9bc03e663960ab93ff5b7c0a1a544a27d526cf99eb0506bcd9f26eea00621281b5f0e2ed33fa86ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247876, "uuid": "e078d212-f16f-4345-a1e8-0464eb139aae", "value": "T15DA328A3CC762F58C628D5B4B0B18F796B93AA6081475FBE1567C27480C3D8DF6063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247876, "uuid": "a9a0c3ef-dfdb-4568-8a09-485c8b59c00f", "value": "1536:71ufPeqU2CVKCsNV7lsLPC9z+NzWuBx/3RhyXA8:wbU2RC4kPCtSzWu3/3L18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777247876, "uuid": "72ba2686-c736-46a4-bdea-50e424fa8daf", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777247876, "uuid": "e9cde95a-7973-46ab-bdd8-93d1b0451093", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247876, "uuid": "cd61d806-4587-4dd5-ba7c-725ab2d67edf", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "999d8718-417c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777213883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777213883, "uuid": "9dd0ce08-6c09-47bb-8afd-2747547fd8f3", "comment": "Malware payload", "value": "595e71979aa2ae2c33a3d9f5bcc21214", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777213883, "uuid": "c57b8921-7708-4ecf-b1b7-4c41e1c70ac6", "comment": "Malware payload", "value": "19d63e967e6ee32741deb53bed11ddccd61600d4757ed6fe00d0b2418a5f0d61", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777213883, "uuid": "daf1421b-584a-46d5-8a0d-a7775f52b424", "comment": "Malware payload", "value": "5d8a2453e5870a6dafd1d7c805b10ebd79311143", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777213883, "uuid": "ba1e72fa-5ef5-4694-a13c-e96778f16154", "comment": "Malware payload", "value": "2b77c9f80209d103c8631809230299cb3c4e1a120463ccc1a0fa62f078aa743f31d7dfb70dbc73d35a8011db5b93f824", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777213883, "uuid": "647ac1dc-7e5f-49b8-9240-80dc8702761c", "value": "T19D213A96A49334B18BC78C771766F2C2950E53135B638D8C7C5CAB246FE5823BC90EE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777213883, "uuid": "19ddf853-7148-431f-8118-c2b8b21907a8", "value": "24:EWn2DOIRwZs/KIhZ43RNzJXALLwCOzMnIK4msFxAWVTE:E+CO1ZoKIw3RNzJXAL8COzWIK4msvAqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777213883, "uuid": "6fbbb43a-c967-41bc-805f-82cc527d7b6e", "value": 1249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777213883, "uuid": "8f64b086-c519-4638-b349-f1947b05c4c1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777213883, "uuid": "94a302fd-6529-4c48-86b9-903cce28b9a8", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0f1cea-41b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777236942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236942, "uuid": "26cd9386-524e-495f-b196-3a62b0e8f9cf", "comment": "Malware payload (Mirai)", "value": "0c1bab5eef8749d0e6acd9ecece4760b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236942, "uuid": "b7c27107-4ec8-4b86-86ec-12a8da438b1d", "comment": "Malware payload (Mirai)", "value": "1a4bed6c420861c0ea326ee48ccc6c915639a3e9ecef7c4376289763800248b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236942, "uuid": "eee41bd8-669a-4356-bacb-ac761cecbc6b", "comment": "Malware payload (Mirai)", "value": "5322f04dc5842d71e7b2f239c846ad5c135fac1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236942, "uuid": "09e1bc40-aee1-43db-9501-3dd5b45586c1", "comment": "Malware payload (Mirai)", "value": "8dfc625f9e000f19c0ee82adbd5c512ab69d78685bfe5ba8beb45f211b907f5bd1172fcdcce28f271c982ccd00ddca66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236942, "uuid": "8beecfd8-66a7-4f29-abcb-b0767a51701b", "value": "T1A213F29792E4862FD2FE027C45CFEDEF0501D1295A48E0E9BDF475C4D692B38123CA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236942, "uuid": "8d147669-4099-4d3c-ba17-d736af7b30e1", "value": "768:HWQAQNQgkHDeiQbMwxN4HkgZIJC3N/hUTZ190NuKUW8inbcuyD7UGQRjX:2UCgkHDeigBH4H1IJKC0zUinouy8GyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777236942, "uuid": "244a059d-e396-4e8a-b115-36cdf59236c8", "value": 42120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777236942, "uuid": "e2564fd1-08b2-4115-9752-f140111f81a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236942, "uuid": "f9e7a7fc-acfa-496f-95e7-333a969aa372", "value": "023782pler.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818254b2-419d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777228016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777228016, "uuid": "9b02e5f8-23bd-4c31-90dc-e7626bc4e199", "comment": "Malware payload", "value": "b764aa0e75918269a27c915d638004e7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777228016, "uuid": "b2a5f36a-b640-4896-8489-c82c01e627e9", "comment": "Malware payload", "value": "1a79bab5e2f28a10b616ddf4dc059145cf62f061b06c5d2cde5e99e0496ae531", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777228016, "uuid": "1c05cb02-6ba1-47a2-9223-ac55d4443072", "comment": "Malware payload", "value": "2c932da446f6319f96d744255cfd8fa15e0853f5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777228016, "uuid": "8317c9a9-930c-420f-877a-2183b7d2569e", "comment": "Malware payload", "value": "8851d2d02ca1595ba09e42d7931195a18649661898a194b01bc1df6436c57f53e8529e572ff7499e17d37d94afca6067", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777228016, "uuid": "aff8758b-f298-42c8-9d84-22aa1c2424eb", "value": "T1F4976BFC70E9D2B394CF36F07A610E7A975988C086C543048A12EB615A95F2C679FE7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777228016, "uuid": "cf9b7bda-84bf-4138-9985-d8089e622c2c", "value": "6144:QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAS:D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777228016, "uuid": "29993e6b-20d2-41a9-8f46-bc41f69370ad", "value": 41203512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777228016, "uuid": "c42c3e40-abad-4595-9c64-69205597b9fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777228016, "uuid": "f413c0da-5367-41f1-84b2-f357b8932c6c", "value": "OPTO-M~1.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a79e24-41a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777232229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232229, "uuid": "a5aab01b-e862-473c-b313-cea07814202a", "comment": "Malware payload (Mirai)", "value": "e25fc6a2fbe4158aad17b79a83f56e97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232229, "uuid": "40185ebf-ae43-44af-9766-85a2e1ae7690", "comment": "Malware payload (Mirai)", "value": "1b03db850754bc1c3bb1d11cd8e79d304b35866ba5638f7a013723e34c89ac77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232229, "uuid": "b620b039-7a74-4ae6-8065-94654a7184e0", "comment": "Malware payload (Mirai)", "value": "e9a193a6cb582a113ac4f4e1f8154cafedbbe42c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232229, "uuid": "6b90217e-5a63-4c44-a8bd-0e3b4fd0b015", "comment": "Malware payload (Mirai)", "value": "838e918f2403db75bf703150611193fb1516d202785161b0305561f897b243fcc39fbd50595c1ed6a50ede95a8ace96a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232229, "uuid": "67e9438b-c473-4c61-938d-6d29fc294244", "value": "T1A5C3065BFB0D0783D89759F02D3B3BF18B5DAAE011E452C56629EAC147368F22121FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232229, "uuid": "7ccebdc8-04db-4b49-bc8b-a678d401397a", "value": "1536:itb0nSZ/lScYm6L7GIxmgfUSGMAcdYRpdL/egw1OCq3GHuo7InXQtNpUiYGZfWa:5Se5HK0USGMAcyRTmoouomQqcOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777232229, "uuid": "e12f0e5c-bf83-4782-a62a-52e9482425ab", "value": 124052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777232229, "uuid": "5c7651c1-064b-49ab-ab4f-178021207f74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232229, "uuid": "27b7623e-2116-4dd7-8c25-46b231569c7d", "value": "shabak.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "854fcc07-41c8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777246491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246491, "uuid": "d42e8861-09a8-42bb-bc55-5c6d61fb1ab4", "comment": "Malware payload", "value": "a3e9be1a4d81e7b977e5ee76a337d835", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246491, "uuid": "9791066b-17e4-4178-860e-51e6884519a1", "comment": "Malware payload", "value": "1b7a145d3b87773c1ec102691b6141b4c0b52bc73a12f63cc57fe0cd927c60c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246491, "uuid": "a0717360-0e40-446a-804d-b36678580f09", "comment": "Malware payload", "value": "dff3ec7e5f167b54d21a08f7e1f9128eca9118bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246491, "uuid": "8fb90a6a-af10-43ad-a9b8-f8fc592e6966", "comment": "Malware payload", "value": "3cceefd94f89360930a21bdb9a617c13365db4ecdd17b4a6e8acdd0725ac0177ef7df675eeac24358baf877462629e26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246491, "uuid": "31fb3be7-8582-4b8e-828f-5ac65780bfee", "value": "T17857DF77814638E9E9B98CB4D01025416DAC788B5778A3C7BAC871E667EB7E08D3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246491, "uuid": "8ed1beef-314b-427e-8415-f240027e4a00", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ8:cqYUQuVDt0TZE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777246491, "uuid": "870b3a58-3782-4e71-aec1-2409fe6aba0c", "value": 27394048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777246491, "uuid": "f8ff8be4-e759-4d9c-b0ce-56fbb602ca60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246491, "uuid": "24251684-4093-4869-8a88-5787ddec8cf5", "value": "1b7a145d3b87773c1ec102691b6141b4c0b52bc73a12f63cc57fe0cd927c60c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ccef7c-415e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777201158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777201158, "uuid": "28971558-4042-4f45-904b-1ffbf7fe7a1a", "comment": "Malware payload", "value": "a9a52c7cd6cde6161563502940a538b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777201158, "uuid": "f30af541-2f8f-4631-8532-d2b6055ea614", "comment": "Malware payload", "value": "1c01250a5da1b4a0bd7d3b2eb2cecc13c618132b7938f131d6337a3bb93acc5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777201158, "uuid": "8523fbe0-4647-480b-90ae-47e12f2ba214", "comment": "Malware payload", "value": "c6a4afa0743bf0263ba9f2e2e489da4cde0e8da2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777201158, "uuid": "c565810c-f734-41e1-87ea-5cb8d9c9d651", "comment": "Malware payload", "value": "ac3173cecc5082882cc1e849a71d1f44ba0252c4f354214208301a7887956039aab8c2eee9ae49b19202250b99c89462", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777201158, "uuid": "d4550ad7-af3e-4060-a9ff-2fec4f736b3b", "value": "T187B57C1BB6A208ACDDBECC74C34EA473E724B4894312716B1FD45B502B2AE64EF1D791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777201158, "uuid": "a6716522-ea96-4440-9195-a41980ef26d7", "value": "49152:5D/5FIU6iKmJg3adhECkNFvxCqYXrISv:5D5C+TqLCcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777201158, "uuid": "85ad32b3-04ef-46e8-9440-492423567f25", "value": 2328840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777201158, "uuid": "d9fa11ce-c11d-4dbf-bc9b-a29d22836259", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777201158, "uuid": "7be66672-663e-4e02-9da3-dbdd4b0b58d1", "value": "earnify-client-x86_64-linux-android", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dbdf51b-415c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777200012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200012, "uuid": "a6234bdc-6824-41ae-8914-44ffafca4d29", "comment": "Malware payload (Mirai)", "value": "112b9834d213f6be3f7f8682f1c53377", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200012, "uuid": "d3c3e678-912a-414e-8f44-3ec223b8027b", "comment": "Malware payload (Mirai)", "value": "1c045921303fba7c37e7405af3e7963153518a433f5c9a95fd272aabf031b8d9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200012, "uuid": "2c9a2f06-6d00-41cc-9f8e-6998be7c4f13", "comment": "Malware payload (Mirai)", "value": "e97e50e3e5bfe1ab756e009fe45d06e74fb6f59b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200012, "uuid": "9a5d2fe8-7680-4ee4-8d09-8cf6f38f0fd9", "comment": "Malware payload (Mirai)", "value": "4d7e09738c3e86c294cfa81ff728b2f9c0b4c4fd8d6a3b4f2e1052e5e7226e6bb746c6574b1ad36edb6644111d904536", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200012, "uuid": "1e93bb48-f5fe-4c9d-b7cf-1c984322045a", "value": "T123330A997C828D2AC5D012BBFA7F02E9331563A8D2CB7313D8149B587E8A51E4F67781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200012, "uuid": "1e6520d1-4bd0-4f40-8bde-cda8447193aa", "value": "768:Uo8D636IXLb1aG+xC3pXNyTtL9SbOQuw5lCM42zJWzRTW3t3lkXiKcP4sxILIxas:Uo8G3NLIxCs12OFw2yzJqW3zxILIE63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777200012, "uuid": "3d74dc85-ef1b-4517-8add-0915a155b803", "value": 50287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777200012, "uuid": "7d3dc7f8-5a5a-4d31-b368-b98f4e596a69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200012, "uuid": "bbcd8e89-85b2-4483-91c6-d9fd94afae13", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8662f581-410f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777167036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777167036, "uuid": "e63c12dd-1eb4-4f29-8ab8-65fc93db16ac", "comment": "Malware payload", "value": "dcfb4e9f7054f359ebe25b5e798879dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777167036, "uuid": "d2278026-df34-4d98-9a99-27b48b9b6bbd", "comment": "Malware payload", "value": "1ce5ff9824b3b2f5f1e0adc59eb50de5a5ec461f3b35ad10717ede86825bbdc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777167036, "uuid": "7d78ba62-b08c-4648-a814-af87feb58e7c", "comment": "Malware payload", "value": "d4fa26413560afc438ad03362c5ed5964b350a0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777167036, "uuid": "4bd052a6-55e9-46a0-b673-76486fa141a4", "comment": "Malware payload", "value": "c25c3cf6c51e0a6eaf0b2dc349b08d1797d48b36b16e87eaa00ab41d07a0b3d2bf21c5def8e32daf4fde5b7fa51fb3ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777167036, "uuid": "505db9aa-2f2b-4785-8368-1e2a550a9ffa", "value": "T107363973A49154E4D2EED574C6256213BEE0389B273423CB7BD076E11B7ABE49A78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777167036, "uuid": "f9a2b946-8a6e-451a-91fd-6fb5077d947b", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQT:cqYUQuVDt0TZEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777167036, "uuid": "e8f1c8df-de05-4b10-9c33-809a464311ae", "value": 5177344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777167036, "uuid": "3463d99b-0801-4da1-9a60-b022fc104894", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777167036, "uuid": "705bb506-3110-4b91-bcb3-d46a7cd56e8c", "value": "1ce5ff9824b3b2f5f1e0adc59eb50de5a5ec461f3b35ad10717ede86825bbdc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d05b661-41a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777232572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232572, "uuid": "1c006d86-0c6f-486c-898d-d25a569c4003", "comment": "Malware payload (Mirai)", "value": "7b449663978679e9aef4bc737f5e587b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232572, "uuid": "df7ed385-d1a1-4213-b410-c8cd049152b0", "comment": "Malware payload (Mirai)", "value": "1d8bc4ebbeb82ed04026c40177138c3912f7feb77fb701d5877ae55ecda60445", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232572, "uuid": "3adf0fb6-335f-479b-8a74-e0e1251c3225", "comment": "Malware payload (Mirai)", "value": "8bf18ab6c3dca9ea7a44915d33025ea0e6ada08d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232572, "uuid": "eb048322-ac16-484c-8095-a5479fcbd127", "comment": "Malware payload (Mirai)", "value": "58ea871976ea4788cb776a1e6cca2ed9d4a5e6739d78c41dd781bc8dbdbab0b8040dcd6c69c4b9e2a6dfb2b6da0d78d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232572, "uuid": "136f2fd1-5b05-469d-9316-39d6b494f458", "value": "T14CC3D748FD55572FC3E372FAEB8C06CD362A1FD8A7DA31225A345EA023C5BD52939520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232572, "uuid": "7206d321-537f-42ef-a841-0275bde3a624", "value": "1536:337rbr4hd8Qx6gNP1EZIMEfJG5SMGt6uEntEBTi/i1fpbHLg6XEAJnqOTjvF1Alf:nAhd8QZNdEMffMG07ntEBTiUr1VbO4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777232572, "uuid": "d088d194-9ae2-4f14-b583-b1fbb12e77ab", "value": 123884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777232572, "uuid": "367c3cac-5a89-42cf-b0f6-7b89def06e8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232572, "uuid": "7d5d212d-28e8-459f-9ef6-7e8f8b281c9f", "value": "shabak.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66752095-41c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777246868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246868, "uuid": "c3b71cbf-9bbd-4c87-b23f-5a8264c618ab", "comment": "Malware payload (Mirai)", "value": "1f6956055553bf37ba73dd32dc50bbaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246868, "uuid": "1976c2d7-9317-4db3-9c05-d2b7e26cc94b", "comment": "Malware payload (Mirai)", "value": "1db9447d151ff2bb667695c6069f740389deca47c28023781e781f29f4381810", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246868, "uuid": "514837c8-67b8-4a6e-b554-affbff222aff", "comment": "Malware payload (Mirai)", "value": "ac223ae3524455939e5e5e8c86db83732113df63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246868, "uuid": "40494e81-7481-4473-b4bf-0af0353d0277", "comment": "Malware payload (Mirai)", "value": "e1c3c4c3faf3a1e0b6ecfcaf53fb19d08897c01f6436e4387c927e3eacbb9d1f5ff7004d18920ff5510048725aacd1b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246868, "uuid": "2835be80-0ce1-4bbb-a0d1-86b5d37cd561", "value": "T19C244D46AA908F13C5D2277AF69F414933329764D3DBB3068D286FB83B8765E4E37205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246868, "uuid": "ccd765ba-e274-43b5-8bc8-c9355a6507c0", "value": "6144:KEY+bvz7Di63wYabs1VXn23S1OT12M/9YHLF/:KEY+bL79AYabs1VXn2Iq3/Qt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777246868, "uuid": "d2fabba9-70dd-4e88-9150-b5fd610a2eaa", "value": 214629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777246868, "uuid": "9f6977d5-350d-40ff-9b7f-3d15cd29f5e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246868, "uuid": "d4364cf5-6760-4018-9401-8a0aa417087f", "value": "Yboats.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7b030e-410b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777165276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165276, "uuid": "33561417-15f4-44e0-ae69-fbb34eff193e", "comment": "Malware payload (Mirai)", "value": "e10653fb946fe342237f8bd91571172e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165276, "uuid": "7afb3fb5-363a-4f36-a76a-c8a55e86c2e6", "comment": "Malware payload (Mirai)", "value": "1dd18fab721f0ac83de9e66b32e72afba657f98a5dc2e03bfc5ce622fd8455ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165276, "uuid": "846a3973-99dd-4e39-b88b-b39001778d11", "comment": "Malware payload (Mirai)", "value": "d59a4ada28425376b9145b773dc7ad2dddf7e9be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165276, "uuid": "c61bc250-5376-4ddf-b541-885879899324", "comment": "Malware payload (Mirai)", "value": "3cf75fef53fb2bce1206e1e9f26169912a190c19d0ae93ac7ecd64650a90f1b5f9407ce28c4d941d84c51d3d5d1c7a4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165276, "uuid": "6806b917-93a5-4956-92eb-55ac590e755b", "value": "T141042A46FC919B26C6D725BBFB4E428D372B1768D3EE720399255F20378A85B0E37241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165276, "uuid": "ea71fa21-3399-4574-a129-b2b768d089ab", "value": "1536:5AYToxCMBU6wQOx6bxWGfbNqOhkCh/KfCy/KgtI7XGPMeWAD/eirpT0lR1A2LFSI:532UrHxahy1e72kAS64R1H6lKMNxMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777165276, "uuid": "b9b76afb-4a79-42f6-b8f9-5dc3718721f9", "value": 178576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777165276, "uuid": "25520f34-0785-498e-a5e2-d1cec042998a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165276, "uuid": "8baf9dbc-ad80-4f4a-aa0d-9d801a9c0b77", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f5431d-411d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777173210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173210, "uuid": "b5cf71a1-aebb-4077-ad59-fad4ee93ef94", "comment": "Malware payload (Mirai)", "value": "3350de03336124727621095d9dd53ef1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173210, "uuid": "0bb1db3c-07af-4e35-b7f2-29558426eda9", "comment": "Malware payload (Mirai)", "value": "1dfca3774ddeb0ae37a15306cddbb71db78188645057a02d2bf54c38490affd6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173210, "uuid": "1a5f4444-570c-4e61-83f2-df8f256592b2", "comment": "Malware payload (Mirai)", "value": "460201ecb0b8f6207309d13b07a8a34f1c26386a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173210, "uuid": "4f6a4cde-9b43-43a6-8f77-87b3fc2f0834", "comment": "Malware payload (Mirai)", "value": "36d7c6845baf99d107b603f5a6b548518c9fc4a2cd7ac7745f56b7f8f587af0f3e4a364c7b8b877099b879233a474efc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173210, "uuid": "8dee9049-1e42-41b5-aeac-6e8e6ee6c307", "value": "T185B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E76C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173210, "uuid": "6a8b1b79-ee34-4368-ba2d-a615b27e2343", "value": "1536:0u27gBY9FSSpj3z5Qxw6YaWWgg1L/LWy:19sSyzz36YaWWgg1Lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777173210, "uuid": "6d01c31a-51fd-4156-81ab-f2b9840b36a2", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777173210, "uuid": "f0d6a3f6-58be-4583-b501-9f71b0e1a91b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173210, "uuid": "168a97c7-8021-4d79-8a2a-5fb910c1c711", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a421f06e-412d-11f1-a769-42010a9c0008", "comment": "Malware payload (WSHRAT)", "timestamp": 1777179970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179970, "uuid": "fe331063-84dd-492c-9df9-5a6e954949aa", "comment": "Malware payload (WSHRAT)", "value": "a1455a81d58689e88a962098e27bb004", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179970, "uuid": "29b5661e-1d2e-4e6b-88ac-528dc65d283e", "comment": "Malware payload (WSHRAT)", "value": "207ac97e60aeb989a14feaae8a365f5b35233ac7800f1357b325a0bd8d3bdd5c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179970, "uuid": "33fc09ed-b0a4-43bb-9b04-479e8b9b5cf2", "comment": "Malware payload (WSHRAT)", "value": "4e756cdd328d705819da6cff1204c949110a60d2", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179970, "uuid": "7e84d073-375d-4dc3-b714-f998c9cd44a1", "comment": "Malware payload (WSHRAT)", "value": "c25837e350b2a7f36a4924f8f0abbfd6594c59049efb5e2caf5c109a72444f9dd146aae0290a6bb9f3ae1e81bcfb6f25", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777179970, "uuid": "52aa2d95-5200-42f1-b615-362f04d009e8", "value": "T18E04F15FBA0AC47E867072A0693B570DC2A5D1DB1026C055BABDC8CCBF3565842D3AF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777179970, "uuid": "2c0970a7-4e3f-4a71-9d49-58a1a25bee75", "value": "3072:dAg8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:dAg8xSQmshISeWmM6iRC3eGKoAklgF28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777179970, "uuid": "059f35fe-0074-47e7-ae84-d471e9e6def4", "value": 184487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777179970, "uuid": "4870de81-8d7b-47b6-8606-4c18ada3a766", "value": "text/x-asm", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777179970, "uuid": "892d079f-d3e4-406f-af65-a3ee90d22e7f", "value": "qwrGC.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0992fe2-4193-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1777223800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777223800, "uuid": "7d7b3db3-f117-4026-9c04-86097abb7651", "comment": "Malware payload (Amadey)", "value": "07068a5ebe66b24112d96a3effab9b8e", "object_relation": "md5", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777223800, "uuid": "ba2dac57-23b9-4883-b38a-58351b2e61fb", "comment": "Malware payload (Amadey)", "value": "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052", "object_relation": "sha256", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777223800, "uuid": "0b0859ca-47a2-4354-aa8c-dba705c9eff4", "comment": "Malware payload (Amadey)", "value": "85c069cae53057e9e063697635a696ac97a17000", "object_relation": "sha1", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777223800, "uuid": "0189b1df-bda7-4b68-bcb2-623dcd4a3aea", "comment": "Malware payload (Amadey)", "value": "38add32c8b8d8edb6c82794b12d7bc676b40f37b6d09f67f4cde15b3158305b0b11ef0155670acc6055890091fd35dcd", "object_relation": "sha3-384", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777223800, "uuid": "1b7577aa-1772-4d7a-a4d2-84e5f161d4e5", "value": "T181A56C80ADC654B3E1463231607672AF7730980E0F7ED693DAA5ADBCBB3F6911827714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777223800, "uuid": "2c0311d8-241f-42ec-9ac8-16e2928fc74e", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777223800, "uuid": "5ee7c655-1acd-4522-b768-966c65c86623", "value": "24576:t855YT1BKHAV0g/L5zHC+LdfNLZVlI+tqW02ofyGAUavl//a/4IbjXH1HIKb3cuR:tIGTLdPLdt3l/hSVTbsuLTi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777223800, "uuid": "512fe2f3-c750-4ec8-a69f-a90742985810", "value": 2191536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777223800, "uuid": "d464384c-2e58-46d6-bad6-aa6db82bfa7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777223800, "uuid": "c40c92bc-c845-48e1-8a84-5939a7116f4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a9379d-4110-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777167524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777167524, "uuid": "cf6f0805-ad6a-4449-a572-0382aeb8c789", "comment": "Malware payload (AgentTesla)", "value": "2dd2a87dd1f57ad05321c33ce740aa13", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777167524, "uuid": "4d482102-46c4-4842-8d01-f97d4d68e1f7", "comment": "Malware payload (AgentTesla)", "value": "2157d5e624b87bdf43d26bbf90a87b1e8b33c8a75b7f37bc7c0da20efcf4c873", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777167524, "uuid": "5b44c537-64bb-4ab2-85b1-7b674fe51fb1", "comment": "Malware payload (AgentTesla)", "value": "5240f77202672b713b5d4a1ae7995e1ae7c951ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777167524, "uuid": "6f8e45bf-15c8-49dd-bdf5-60ce27029c0c", "comment": "Malware payload (AgentTesla)", "value": "bda3166d635cc7cdc986b168e17d089cbdb3cc4e05bbc11582528e0c13a9271e8fd1ca4aaf48a28a937562f6be25c551", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777167524, "uuid": "9ee8b064-08a7-4a63-8102-00e5ff74a51c", "value": "T1D92533701C865DB6087DAA8F4A7BD71BE8B50F27E47510D5328C38C913267F890EBA76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777167524, "uuid": "e1b9c0e0-4bc6-4721-8f93-c51e831ea572", "value": "24576:EbZyQAAN+mS5ZAJsjHu3v+r4fvccNmhWJmko/g:2PfSG+SzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777167524, "uuid": "97415f54-2e52-4946-a172-222787cd861c", "value": 971212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777167524, "uuid": "e8a2c6e0-1eaf-4ebe-aa02-359778e4ab99", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777167524, "uuid": "658f5b38-a750-4618-aee4-cf4b431a4321", "value": "KO6QMN4W.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "298b044a-411e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777173322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173322, "uuid": "86faa428-c232-429c-a03e-05327b8dfa8b", "comment": "Malware payload (Mirai)", "value": "beb1949a885c2e1c4f399d92cdccd9de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173322, "uuid": "df38413f-1f44-45b0-be2a-d856328c589a", "comment": "Malware payload (Mirai)", "value": "21f3912c547f679778d8584fade75b624a0facaa6d67ee2b06b02cbfea77da8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173322, "uuid": "3ca13dbb-c208-4ae2-a122-bff794948cf8", "comment": "Malware payload (Mirai)", "value": "8869acf1238c703a9031b4da09fb0d7d2d23a1c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173322, "uuid": "fd72f2fb-0a8b-41df-9409-ff9907e22958", "comment": "Malware payload (Mirai)", "value": "5c6afbb607cce51beaaad0c29774571745cd425f3f4b135cb70704757d25d5eb0111d9326ed113ed19556be68c06e5d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173322, "uuid": "e0e23209-0ab6-4869-a46f-684b3042bd83", "value": "T19B73A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173322, "uuid": "807c6503-d549-405c-b7c1-b19072c37830", "value": "1536:zJPEBmW5iNWqcGTTwnXHZ84OqdZerEStg:zJPEB8NWq9wqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777173322, "uuid": "80ec1bc0-1037-44ff-a8c6-e67c06ccbbab", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777173322, "uuid": "de14620e-b896-486b-97a8-797d61b04018", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173322, "uuid": "37049d8e-0185-4d8b-b065-683fb0ef366f", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb33398-4172-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777209570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209570, "uuid": "6b938aa9-4263-4d33-909f-d36af65bfc81", "comment": "Malware payload (Gafgyt)", "value": "f0d0ab41161006982830c530f3314b4b", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209570, "uuid": "7ff039b9-abb7-4d6e-a0aa-4d433f4a9b5b", "comment": "Malware payload (Gafgyt)", "value": "21f92590e7403745fcbeafde18424f589eea808771f8a6e6d35c9509be1a8a42", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209570, "uuid": "d129def0-e211-4e49-ba5f-ab200cb05de2", "comment": "Malware payload (Gafgyt)", "value": "f5bbf91bb895b14c70b25ff55463d492f6c3c91a", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209570, "uuid": "51eeed5a-8258-4f44-baa6-53aab51a00af", "comment": "Malware payload (Gafgyt)", "value": "1ffa8ec67466d89774282c95fb0378961421ce6e5390fae50ab458240cbfedb1539c4b097e13affd31aa0f1678dfa0fd", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209570, "uuid": "1be8cae9-03d2-474b-bf34-139041cceafb", "value": "T124347BA3DD215F96C223A5F0B0F1CEB80F42B91589471EA9A5B7DAF54183EC9F1053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209570, "uuid": "529d3852-4324-40e1-a4d5-82b886ea8e9a", "value": "3072:xCXr0tGfs0Ekqc5ve8AHGcrLQWzAoNQ6alUm9hzZbbWhbsHZWjkoxZTwCyJorj:QJEP8AHGcrLQhoO6alUm9hzFtEjkM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209570, "uuid": "81cf94d5-6912-4d7b-bcd7-4f6437f0e458", "value": 233968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209570, "uuid": "62e01ad3-1779-4b37-857e-375db5e5ec74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209570, "uuid": "51f799bc-bf5d-4a55-ab31-3cbaff9f8c77", "value": "redis-sbomd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27fcd402-4198-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777225718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777225718, "uuid": "b140f2b2-6096-4042-ae3d-0c10199db3df", "comment": "Malware payload", "value": "75816b926df83d15509e1d7f47f2ef24", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777225718, "uuid": "5bff8526-4a10-4590-afb9-676914ea2e58", "comment": "Malware payload", "value": "2268ab04dd1b82b9b91f02299160da2a7c474ba9a3dd9816e0492056c6aa90da", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777225718, "uuid": "80a5f665-65e0-4107-a42d-5c1415c4a77a", "comment": "Malware payload", "value": "5208491d43cd7bad2e47ffdae923aec5e2ce2b7e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777225718, "uuid": "426757d4-9435-4502-adab-8d0b2687a748", "comment": "Malware payload", "value": "9b576a7100da672cf57c4ec99715cf99e9d657070b973eb89f20e7e7478c955cb5d309669b373c74fe9321bf00b991a5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777225718, "uuid": "cb4db69d-6d11-455f-b1f8-3e37fc3901a4", "value": "T1D6970292D76F1FCE3D281D8C045E7A5A4DC9AD333D22C4F5DA9F240B82389D546B292B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777225718, "uuid": "93e9f312-39e1-4fca-b23c-c8e43411e244", "value": "49152:/JzN4QqHzSGgTycRiaCLbs5vMDbqgjmSxYVLD8iAEmjuMjqkAJ8kD8rvBBb34F7d:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777225718, "uuid": "de3c9183-e628-4976-a205-836fea1411b3", "value": 40900798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777225718, "uuid": "cf77b8b3-5eff-4269-a138-c8c7291d5d9e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777225718, "uuid": "d3fe1a47-1e46-44e6-bf49-df670d1072b7", "value": "COMMVA~1.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84efe66b-410b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777165315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165315, "uuid": "a02c8d64-9402-4610-8f27-6eedd7798b04", "comment": "Malware payload (Mirai)", "value": "44091ad3da44d716bc954af1f6389ca3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165315, "uuid": "7d2ac417-de58-4b62-8e3b-3aa3e7322782", "comment": "Malware payload (Mirai)", "value": "232926b70d9b637f63b7d0c42bf831e20e26dfd571762082c392039724dce495", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165315, "uuid": "d1504649-6ab3-40ac-aa5a-c78ab2c25df1", "comment": "Malware payload (Mirai)", "value": "d9ee69756d1cc5330666671924de3dc0e6673d65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165315, "uuid": "b3dc95ee-07f9-4020-8f54-9a9bc60fece1", "comment": "Malware payload (Mirai)", "value": "6c13f164b6001845fcd1f1f6d96a74aac350db8bf22195c7fd1b3dc13cf6ed3ccdf2c17e505d840d251eb4ac9ee7ee0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165315, "uuid": "04038d43-865b-41d3-b36d-d337720f64a7", "value": "T1AC34C81E6E228F7DF378C77447B34A34A7A922D627E1D684D1ACD1105F2025E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165315, "uuid": "1bf0f652-44d9-4cb5-b196-acc44744f62e", "value": "3072:8/23BTFm0it1gpuehNqMhTsrdNchqrgOIBQ5AT7/02Zx6A2v:8/2RTFni1ehNqSCckr45Tg2Zw3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777165315, "uuid": "8f3e0ac4-b72e-45a5-aa91-70ab8c7dc874", "value": 241516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777165315, "uuid": "e72fb75e-4bed-433b-9823-29f68478855e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165315, "uuid": "aba0e912-583f-4284-a652-4a084505ca60", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d6676a-41b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777236955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236955, "uuid": "d433992f-a439-415a-bdf5-2cd08ea8aae5", "comment": "Malware payload (Mirai)", "value": "40b48a629d7c1c65201d0716d41000fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236955, "uuid": "6100a8da-b92f-4745-a3cf-3bb911fb6190", "comment": "Malware payload (Mirai)", "value": "234aa5368a9d030c7c6864b1a80fef75aa9bb15c5a82750256e39d6f4e66d3d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236955, "uuid": "a7c5f3b9-20db-4ac5-b20c-1c976a4f12bd", "comment": "Malware payload (Mirai)", "value": "cfc6dd229bdb774d77ccae363d6601489d87b9cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236955, "uuid": "65bee9f9-3955-4bb3-b8c1-87ac0900c6ac", "comment": "Malware payload (Mirai)", "value": "f1639fcbcbd6a0006387f78cbf4329ec9e810500f6a5b5051ccbcd9efbaee047afc9baded697dc5bd95e44563ec9aa01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236955, "uuid": "c7f8b3a1-1740-4f80-9e52-a3cb5a4fe734", "value": "T12313F11A4739F838437108F5EEEACF85A73A9CBC75EB306918B641BCAC869516FD4443", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236955, "uuid": "2da325f7-f4a2-4fa2-8ed5-1eabae17a349", "value": "768:lGeigQ3/aV/vM0MEGdGXAKLTBSxPHkMQl3A/pUj+yhTx8tofX+hN9q3UELg1:lG0Q3u/ZM6XA8uH8A/pUjhTx84OhgLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777236955, "uuid": "75c36fd8-08bf-4b3f-b789-7248c89a376d", "value": 45440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777236955, "uuid": "f4aa1bf0-b7f6-420f-bb25-82be9a8ce836", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236955, "uuid": "5cde2c29-0da7-47c1-bd26-68261159555e", "value": "023782pler.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "079f2fa4-418d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1777220939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220939, "uuid": "e343ae52-bf5d-4749-9b4e-52e09e5f252b", "comment": "Malware payload (Gh0stRAT)", "value": "5f04b44287182084c73088adfa541011", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220939, "uuid": "16f71ec2-75b5-4830-96f0-53955dc84e47", "comment": "Malware payload (Gh0stRAT)", "value": "239bbcc92171f05b94916a1262482def42de7cfc75c33c75edf39151cd97971c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220939, "uuid": "0f9406e5-a147-4dc0-99fa-44ce3cb8a672", "comment": "Malware payload (Gh0stRAT)", "value": "5a097fa94e55db200ea3f29793f7145b240d35ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220939, "uuid": "5a1ea942-838f-4056-8b04-5fe4ba9ae974", "comment": "Malware payload (Gh0stRAT)", "value": "ad45709650ae4c47c4fe2721eb4fbf0dcaf96cab1a7fa7ef6719a6c029d17582cb9987eb7bf4fbf1ccf4c59215caafd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777220939, "uuid": "ada5cc87-b094-4b42-b4f7-37b9bbf97a9c", "value": "T12A17232A534A517FE94E0AB72170F3724C7B2E9160994EAEE1E034584FB71F11E3E6C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777220939, "uuid": "51cca104-1c9b-4234-8961-19eebc97630d", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777220939, "uuid": "f5ce6202-6b39-4419-bc11-79d651a22abd", "value": "393216:Q9/GNImjcs5qiwVJ7Fkgq/wvPlt0uaMBMhYEWpTRZmVLzPuea/YzXLlzONyMevV0:K6BwzFVq/w0xWMfW1yXPa/YbBzOs++J+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777220939, "uuid": "128ca1c1-1d15-4d85-a24d-86caa2058924", "value": 20303097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777220939, "uuid": "d88607a1-6fd9-4d87-b720-396db0b56271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777220939, "uuid": "90d1fadb-e342-4a37-b622-5b32b87c09db", "value": "kuailianx64-10822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2139f3b8-4139-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1777184905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777184905, "uuid": "1b48aca6-7c29-4a52-92f7-a3211f75aba1", "comment": "Malware payload (Vidar)", "value": "eaa3d951028bb26992491f01d8a3b65d", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777184905, "uuid": "5719bd3a-5fac-40d7-8747-2bf6f753e065", "comment": "Malware payload (Vidar)", "value": "256e988c0978ddf6d07b369a61e8c30e51eb06522e3f0fd00171d47a3073e3a3", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777184905, "uuid": "7864035d-0e84-4376-8fb9-a353a6e605d3", "comment": "Malware payload (Vidar)", "value": "af7227ddcff89a4fd6b09c419b564aacbcc64216", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777184905, "uuid": "2b1300d6-941a-49da-a3fc-23e54ee8e157", "comment": "Malware payload (Vidar)", "value": "a540b9468306caaffcc4e3bf4d53a9874c093591fa614f04fd9afd3df554ffbe58cf6d6aa06ffb38d132fcd9eb35ebe7", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777184905, "uuid": "3182306e-e9db-4852-bffe-9ea4f976b03b", "value": "T112C56B027CD410EDC09DB63289F366917B35B8180B3627D72E91BAB83E73AD11D7674A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777184905, "uuid": "2fc24eb5-632f-477d-9b26-3501f296bb39", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777184905, "uuid": "17ff7e6c-3188-4d7c-bb6e-54bbb11e2ec9", "value": "49152:66L1UM0F1rZ639oH7NjzYnPmTjyw7rK7hm38RvoDasT3My:66xZgTzYnPmT27hxvKHgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777184905, "uuid": "3366893e-b82f-45d5-a5fd-b6c19b211516", "value": 2580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777184905, "uuid": "bbf8705a-7df6-467c-8696-c3cd173d7248", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777184905, "uuid": "42d6ff85-0105-44d6-99c3-cae386975c52", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b78a55f-41c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777244380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244380, "uuid": "62ea5a8d-7e9d-40db-a4dd-bd0cd025c8bb", "comment": "Malware payload (Mirai)", "value": "acd0c5a76343ece73fd9da5c691ea2c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244380, "uuid": "849512bc-20b2-416a-8edf-6eefb829654d", "comment": "Malware payload (Mirai)", "value": "260a0c698f5394094a3ffd7c4bef947a67e1fdc0ea1ec23f4896e5af4ac58c28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244380, "uuid": "198a98bb-d5f5-474f-bc24-5c6338888fee", "comment": "Malware payload (Mirai)", "value": "086e49c1fd65062aaf22a4f6273998fbf9270013", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244380, "uuid": "c53558ac-91bc-41df-bedb-2135e47d92f0", "comment": "Malware payload (Mirai)", "value": "0526f1757b28f52f7f2ef5916a6e4356006bf9ff3aacbc3a7560bd7124e881d42b42a5bafade0f960645676cb3627c31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777244380, "uuid": "416d9cca-f454-4644-a7b2-e2ac3f7553fc", "value": "T13FE44A56F8809F62C5D1257AF65F8268331347B9C3EB720699189B383BD782F4B3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777244380, "uuid": "27e8c6a9-8ba8-435d-894d-30b6f22870b2", "value": "12288:zDykxdSpcqF1xSdgIC9IIHFdY3FpBZgpkIt0vEQvaiPd4lqZ:TdSpcy1CzIldKFfmu8Qai14lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777244380, "uuid": "1dfd5f2c-ce8e-411b-b473-89bfe99781bc", "value": 667384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777244380, "uuid": "8bcec0e1-6291-4382-87a8-9b43e1394f22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777244380, "uuid": "60de5a8e-b2cb-41d8-989a-e47546f7e3a7", "value": "agent_armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea53bfe3-41a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777233346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233346, "uuid": "1777a8e9-6c53-4b6a-a834-7920ca15717c", "comment": "Malware payload (Mirai)", "value": "5850afc9536c210446eee709b2bdbea3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233346, "uuid": "b1bb71df-fa4b-4945-bb67-6b0a1e28c07a", "comment": "Malware payload (Mirai)", "value": "27bdeead25004c556afc384f1e6e739edc085a3d1b91868b2bea51beccd1ea79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233346, "uuid": "3c99dfd9-7625-41f7-bd26-212210441362", "comment": "Malware payload (Mirai)", "value": "54b8c70c8c17f2993e077ad70a3a25bce347019d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233346, "uuid": "0add284e-8415-4692-a78f-1ddfaf79c43f", "comment": "Malware payload (Mirai)", "value": "3c076e6edbe2a7319db4f979e08be7ceb60bd2924503d22834791094d1fcab30c23c1f0ff0eb48edc55410b17c7b49d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233346, "uuid": "601bcee8-65ad-47e3-a0de-4170725dc35b", "value": "T105C3AED7F68B24A1CC6146F007C76BDE2E6361119E6BE9E76C0E663B193A0DF19063C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233346, "uuid": "b30e1d64-021a-4434-9dd5-48483e689ca8", "value": "1536:BH6XXWAZxg6cgoWZKxtHQEyhBGLaDWql0W4s2sieEg6tCwxZJehgxd/LWg:J6XXhxr4R+BGL+tJ2sd6tChhgxdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233346, "uuid": "939b30c7-55bc-4b59-87fe-a716a128a579", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233346, "uuid": "5c371e94-ee3c-46ed-a9cb-376ea1626ff3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233346, "uuid": "b54e3b81-7493-46ee-aefc-bf9730913585", "value": "luxzz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c0c90a-41c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777246872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246872, "uuid": "689efe2c-9f23-49a8-b4f9-2c04d99e99a2", "comment": "Malware payload (Mirai)", "value": "ed38e9944cb806da83add5788d3fc5a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246872, "uuid": "468240a2-7e57-402b-9dc9-d4775c2514e9", "comment": "Malware payload (Mirai)", "value": "27cebc21df5deae6e10c775daf39127c308401af510df590b22cef77f78e29a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246872, "uuid": "20c408ce-0952-4620-a3e5-f35b3c165e1b", "comment": "Malware payload (Mirai)", "value": "0be4bc7c4917032e0d645062a97819df7d864ce3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246872, "uuid": "57b89bf4-52ed-4b2e-91bd-5b1f18ce2b51", "comment": "Malware payload (Mirai)", "value": "4fa6e28342b1651ebac62d3531e2f5b508e10d7b4b8ecd93a1d160269af7acfe069a198711e7e33749b996ab45d09533", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246872, "uuid": "e7c70c1f-6589-4790-8ac0-21f1712acb81", "value": "T1E2E36D227D772E27C1CAA4BA01F34331A5F6634A3965860DBE741E9DBF1A7E0341B325", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246872, "uuid": "005d9342-f7c9-479a-91e2-d8dca9289ea8", "value": "1536:clPEwpvh+hL+C056wyeBhbOZTnq6ll1jf3L7gbwv/pIVplk5VYLQZtrAhYFS1VbW:KPhNG0yUOTnqmn3L9IVplUVOY0nsh2vC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777246872, "uuid": "4efe3571-3ee3-4b6a-b443-556a387a23f4", "value": 153729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777246872, "uuid": "2e39a835-963f-4abf-be31-3438c8430933", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246872, "uuid": "2bbc5401-a011-447f-aeaf-6c3c9beb0d8a", "value": "Yboats.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c75586-41c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777244394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244394, "uuid": "7d040dcb-be9a-4f69-a479-82938628e71c", "comment": "Malware payload (Mirai)", "value": "a88e0c8db9e9927ec1805ce3dc42811b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244394, "uuid": "48130a60-b35e-4932-9cb0-4f96a4b98a4e", "comment": "Malware payload (Mirai)", "value": "280978d1639f25d2326b9ca09049dc0567fe863f003c772c2f74e37243f935a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244394, "uuid": "a3dd035b-4ebe-49f0-835a-b4dd9649b105", "comment": "Malware payload (Mirai)", "value": "6564cfbec6da8d58c3d1ce712bf31ab85149b940", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244394, "uuid": "c8632184-8a77-4ada-abd2-14dafea4bc1a", "comment": "Malware payload (Mirai)", "value": "237b3fe596a8769936c4dbf997949cd594304ae4b01169e0499d914298642cb42f6359cabcd86137f4486da850e07f1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777244394, "uuid": "d9d7c6fc-839d-46de-b973-366ea6f9155a", "value": "T153F48E9EFE5E3C43D2DAD33E9B4E83B0A22BB150C31351A33581436C95C59DD8BB169A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777244394, "uuid": "f1059d64-6487-44fd-be4f-f8e6a55dfcee", "value": "12288:LyaecUStVvCjDdfJU7j0SNSxV6w4aWXikWS9w5C6iI1Wm7H/Vg/teYDP:LyL/OMJUUSNCAw4cBSSn1ZgVeYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777244394, "uuid": "a6af518c-0a0c-4292-91b2-17fdbd704d9a", "value": 778512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777244394, "uuid": "93949a1c-cb81-49de-a6da-dbb4982f777d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777244394, "uuid": "f3b0cbd3-c248-426c-8465-68049504eeb1", "value": "agent_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "facf75ba-4165-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777204168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777204168, "uuid": "a8808c8d-1e57-4f3f-ba1f-31479e497b66", "comment": "Malware payload", "value": "1aefa0b7877bef6a0b8f9f7920c1fb1c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777204168, "uuid": "84095392-7fea-41f9-ad56-55da9ced019a", "comment": "Malware payload", "value": "29d5ecfcd6093a26ff25e53e03ec9b9e4c247f77605838acb2e7e5a78080c07a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777204168, "uuid": "69e87830-beea-43bc-9494-070d1eb85681", "comment": "Malware payload", "value": "121a652ac069c2cf536cc6bafe50bfd76b415452", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777204168, "uuid": "ee97cfdb-d447-4f13-ad0f-8eebfc7df2c1", "comment": "Malware payload", "value": "c151e233c6526bbd772b768172fef461632bf2d0b83b3546853fd15a58980c1b8599bb99a8dacbf4d42300efcc037c14", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777204168, "uuid": "de1f29a7-a07a-49a9-8dbd-3ae2e033245c", "value": "T1EF136D6526953C25AE99883B5C7F2F0CB9A983E1304891DDBF8B3CF18C5569CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777204168, "uuid": "ec26cab8-180a-4dc3-8942-462bdbcd9a3d", "value": "768:byns9NyXsZztCQ1e9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bysHusZHco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777204168, "uuid": "0d187b31-70f7-41f3-9051-55cdc8724a26", "value": 45432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777204168, "uuid": "628c06c3-a160-49b9-b3fd-1e3009db2198", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777204168, "uuid": "09bfb453-ea27-468c-ac00-dc8879c5851c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a11250-415c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777200003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200003, "uuid": "381e4cf4-0e68-4fe4-810c-0cdc897d7f2f", "comment": "Malware payload (Mirai)", "value": "02e1ff315d77f1ff045ad31bd761520d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200003, "uuid": "804ea9e7-c4d7-4046-ad49-607b09026120", "comment": "Malware payload (Mirai)", "value": "2b43c5f67ef9646442cf034174913637eb1489e29f37f66444d710bf05240214", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200003, "uuid": "4575ece4-2d8b-4222-9adf-b55a4e7cb707", "comment": "Malware payload (Mirai)", "value": "c57164fc177a05575c8913508cdd2dd946e43573", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200003, "uuid": "69ff86b7-9ed4-499e-8b8e-a76b61d0044b", "comment": "Malware payload (Mirai)", "value": "a9f64175693a4eb60809730f2fbd8ff96b92e52b8f8a13751673d1d63b85276bf30c0c642d0aea3f34ddda39af8a45d3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200003, "uuid": "23d86b91-983a-456e-949e-03e09170fa7e", "value": "T1FE231894B9829A16CAD0437BFE0E42DD3725A398E2DE3313DD225F6137CB92B0DA7151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200003, "uuid": "36437591-8e1d-46d4-a9dc-2dedb0999211", "value": "768:mXYesyi5wPVQEkJVvOwxPFV4iRu6Jj3oSCA6gPj5+uB4Pl5Q1wL0xkbUFqBgEk9H:jZe4vrR476JdLPj5+uBalu1ObUoBEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777200003, "uuid": "1a34aa28-4b84-40c6-bc9b-bf0055d16b2a", "value": 47940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777200003, "uuid": "9dd2585d-01fd-4a03-b4e5-6ef97eb731a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200003, "uuid": "4396e543-ed73-4f3f-982b-504d4ad9c2c1", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a69553d-411a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777171552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777171552, "uuid": "6fad6eed-f166-4032-8359-628532883ddb", "comment": "Malware payload", "value": "69811574daac7b32c9f07267af715645", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777171552, "uuid": "15fb8b34-4aa1-481d-baf8-522b35fb6170", "comment": "Malware payload", "value": "2b7a00ab35ba930fe7182f9195cdf56a9058e9f81990ba8a7c0d67191509e2f8", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777171552, "uuid": "00f5f8a6-5a33-43ff-8594-0e6edbb0b85c", "comment": "Malware payload", "value": "4f74987743f137e3be0578ebfcc2c9226b4d8368", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777171552, "uuid": "80bd251f-1bae-48e1-97cd-c77e3b6cf2b2", "comment": "Malware payload", "value": "73d5b44922f01eaaaa66449730c2cd69e0d4e7c2930a60858911d2d590bf2140aca29a993171ed89ec67f21455e2c5c6", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777171552, "uuid": "8cb85976-5778-4951-8b3f-121cf466e84c", "value": "T155C012662FE2AD7088116CE008ABD34A8254B1EB20037AF0A2E80148EA086618F30CED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777171552, "uuid": "fc1350d0-922e-41be-982c-f26771e0b661", "value": "3:Z3DcUYegVKwhSncyGT5yM1egUy+BIGR3Guuncp1mUM1exkLXn4n:Z3qegV1SncyGTsYegf++GYuuncyUYeI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777171552, "uuid": "2a727785-7932-4e34-8509-4b2721410911", "value": 165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777171552, "uuid": "bd24dcf2-4b2e-4745-808d-a543b6169792", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777171552, "uuid": "625eb041-1046-48fe-adba-794bba179f1f", "value": "Fucker.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b797b063-418c-11f1-a769-42010a9c0008", "comment": "Malware payload (Vjw0rm)", "timestamp": 1777220805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220805, "uuid": "31268d9e-f067-4e29-8142-3c0ba4e5e90a", "comment": "Malware payload (Vjw0rm)", "value": "84f69faff3f36b2161949b9b6937ee8d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220805, "uuid": "1b1cd4c0-bb8a-4154-9fbc-1478e93e70c5", "comment": "Malware payload (Vjw0rm)", "value": "2b95ed4bcf2dcc6c6dae1aa4a2fa33ec943c38cf0cffc0eeb50220115bfdf7ba", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220805, "uuid": "9c4044bd-756e-4b02-b7a6-cf221b8ac646", "comment": "Malware payload (Vjw0rm)", "value": "67eeadc6e1755e01a303509dfa663e083513e0df", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220805, "uuid": "38355de3-71a6-4fad-a5e8-d00170db50f1", "comment": "Malware payload (Vjw0rm)", "value": "bfa666464ef556877d1f7162850994e25dd16cbfce1bff5dd860f14c4b44e0acd670dde4e4a1ccc6d006d43164c4b9ef", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777220805, "uuid": "567e8ff9-be25-44ce-8346-9ae47c4b5d8f", "value": "T16B132C2CBDA3011F717689E265E9C2C3553973DBB20E5BCE02B683F1065B65DE4A8C1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777220805, "uuid": "9d2540e4-63bd-4064-99a5-07be6d6ef5fb", "value": "768:s+UA4/rYgZr/Bu/pTVi9lx/nhnk75jaldaMXHnE/Wwnrft:bmXZr5u/pT09lx/nhnk75jaldacHnE/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777220805, "uuid": "636f9c17-ed81-4e6d-9d2a-60a2af34c87e", "value": 41672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777220805, "uuid": "668ed9c3-1197-4ef8-9a4a-6e29168af19f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777220805, "uuid": "889d04ff-91d0-4045-9bb5-3a2d7feafa70", "value": "msedgewebview2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326afcaf-4124-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777175914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777175914, "uuid": "3681c319-0a04-4628-bd80-7dd753973350", "comment": "Malware payload", "value": "290ff5099c666e03301107014c02c9a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777175914, "uuid": "4f952ea2-4c8b-423b-b31d-30934dbc2bc7", "comment": "Malware payload", "value": "2ca52a61c10810888b4a6275e443cd10485143a3d048074170e78df732b83142", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777175914, "uuid": "863f9014-f88c-4805-ac8c-aec6b2c8dcb9", "comment": "Malware payload", "value": "e574b5f944386776911d3a297306feaef9dce41a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777175914, "uuid": "742a10a9-1939-41f3-acec-8569a16993fe", "comment": "Malware payload", "value": "b01c82484735492d74f6ad9419ec375fe28d20665d3126a5dbb7516b056c0b15bbc9e304f5ecbf5d14138cdf3bec5808", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777175914, "uuid": "590ce1f4-6e81-43f7-9d63-90321734a5b5", "value": "T12017BE77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777175914, "uuid": "5f68e57f-e943-4cf5-b7c1-e4fca5238da8", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQS:cqYUQuVDt0TZEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777175914, "uuid": "96d8844a-2dbe-49ce-ba17-3e5312a9b2fe", "value": 19529728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777175914, "uuid": "90a37fe0-0e7c-4c92-beb9-95bf65e2e089", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777175914, "uuid": "9660da05-4d39-4704-9e4b-e39af1ca36bf", "value": "2ca52a61c10810888b4a6275e443cd10485143a3d048074170e78df732b83142", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3488c0b9-418f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777221874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221874, "uuid": "8d4322f7-61de-4195-8ce3-9311b6a467e3", "comment": "Malware payload (Mirai)", "value": "93d2df52787681b8b515ed704d8b4b09", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221874, "uuid": "96f9d000-4064-42b6-88df-1d619c9687b9", "comment": "Malware payload (Mirai)", "value": "2cd252a8a70cee02cd28f5eec2ebde32038ccae39769404c3b03fa50514adfb4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221874, "uuid": "237876ac-4e5e-41d8-88c6-0501a339e373", "comment": "Malware payload (Mirai)", "value": "6082cff2d21d45796958b6fa6162be66ed81a4b0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221874, "uuid": "d0dce812-13a0-4b0e-9f41-e43e78eae3ca", "comment": "Malware payload (Mirai)", "value": "31fea3e5de120e718fb0ca1e5afd08683dc22933675b29319cf1a0b7cd696180d09b5e887341814c2e86af4bf67d57ef", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221874, "uuid": "2d3a97ea-79d1-483b-b54c-147f0227040d", "value": "T1B9B3C9667D21AFEFE168C2300BF7AF2196D422D627915382F26CE7581E7124D1C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221874, "uuid": "8f628797-4d02-4e93-800d-cd1777810679", "value": "3072:GPySnMPulabA+5hnXKySW17dwwBF9GhLRlge:6ySMGwX5hnXf7dwwBF9GhLRlge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777221874, "uuid": "424508b2-9c0a-4782-b4bb-73f19865555e", "value": 117805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777221874, "uuid": "d63e28c0-7334-4a82-baa8-136671846f54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221874, "uuid": "4bb02c3a-33bd-445e-b288-acb6bea484d4", "value": "fuckjewishpeople.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ace0c3e-411e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777173297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173297, "uuid": "074ff87b-7ab5-4452-a21f-6c30013f0f8a", "comment": "Malware payload (Mirai)", "value": "02080e9714664ef5a74ed34dbdbbe15c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173297, "uuid": "c018dbd9-7a9b-4d2c-a6e8-1cd57dd185f8", "comment": "Malware payload (Mirai)", "value": "2d42e16b1759e6b68c0d2ad1cecd4e37aace5e1c12796ef71850b3699fb1dc8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173297, "uuid": "4beb898b-3cf0-47b5-8ac0-95f06af366f3", "comment": "Malware payload (Mirai)", "value": "10496a781dd9d7d4c4ce783464b13fb3ff869e4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173297, "uuid": "24ad2dca-bef8-4f7c-816e-7b297cc8340d", "comment": "Malware payload (Mirai)", "value": "60f8126504e84d5a86d5669b9bf9b0d5d3ea468413ac36735e11a74e4c780430b050f4f03db6a15397ec115c888ca77c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173297, "uuid": "2fddc325-eb92-4cc2-958f-2498d25b2626", "value": "T11E630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173297, "uuid": "03cf6f1d-fc6e-4a22-b080-5873d7d74b90", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlVr57uscvIGiojd70k7h:VqVMkWV8PP29Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777173297, "uuid": "a699670f-1636-48f4-93b1-b6e86622989f", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777173297, "uuid": "8a13ef1d-d705-4b79-bed8-f9d464510ac1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173297, "uuid": "bacf351a-9609-4ecb-a77f-6209b0a6cccb", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf32d16-41ab-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777233941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233941, "uuid": "0e4112c5-cea6-4090-afe8-08c27f700fa9", "comment": "Malware payload (ConnectWise)", "value": "9c4084e22698494bc90a38647bbfb250", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233941, "uuid": "d862e318-3e51-4097-9835-2f16ef7b7989", "comment": "Malware payload (ConnectWise)", "value": "2f39962fd195da0f3fbe4e77cf88f84b5a7026429c91a27a7a544b6a85b4a63f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233941, "uuid": "eb84f0c7-9fc0-49b2-9816-57db2b484134", "comment": "Malware payload (ConnectWise)", "value": "565053a2feeea324c4e2d90a0f097aea59aafa8a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233941, "uuid": "34ea8a38-7714-407e-949f-12d1e75e816e", "comment": "Malware payload (ConnectWise)", "value": "3974ed8dfb48f35fdb598a8da8b6fb4e1ed71480ef6b748eb1aea6e4a3ec631da2b417174f58c31fed17c818f34c6be2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233941, "uuid": "d67e7e7b-8aa5-4f5e-a832-2d475272a495", "value": "T167646D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233941, "uuid": "7a47e924-90cc-4be5-a2e3-a82abbf07c51", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233941, "uuid": "8dc76853-d7a7-49c6-9a27-c90e1f11895b", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9H:R1iw7gryNkSV1hy1Z1u2JLu9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233941, "uuid": "6e77b9a9-2fbe-4858-be80-91e9c95a76a1", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233941, "uuid": "838faa5d-9e04-49fb-9d1a-df0b9314cf9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233941, "uuid": "8b3975e9-0f01-4bbc-88b0-1a72440aabfc", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0934c269-410d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777165967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165967, "uuid": "94d636b3-f2d3-4e3f-8aa2-ba9559a6e8c5", "comment": "Malware payload (Mirai)", "value": "150b9b488c4d61dd12162859ba9e9791", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165967, "uuid": "d00917ac-0639-47d6-a43c-16aed8223d50", "comment": "Malware payload (Mirai)", "value": "2f4a820dfa9141b47084d365724c5b1db6fb585006f3ab8254cbfae3aa6c7ca5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165967, "uuid": "0bd71fc3-8b8d-4104-aa37-9d10a128ee2d", "comment": "Malware payload (Mirai)", "value": "e8d4683d4ac7466b08d9a758bd6078f4c1bdb8ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165967, "uuid": "b66609e8-ed2a-4109-aa95-9368cece8ec5", "comment": "Malware payload (Mirai)", "value": "39e148a4d55ddd94f03d777c01d1c4fb68d547162206d3cc8fe1732dfd58346c57f9a40cf8040b1060efa84267b0b573", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165967, "uuid": "ed2d7ca4-97b8-4d02-a002-e7dcc293cf2e", "value": "T184C43A55F8409F61C6D134B6F64D82A873070BB9D3EB72069A255B343BEB86B0F3A705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165967, "uuid": "f1c0a10a-0918-4d31-a6c1-cba2ca912ba2", "value": "12288:QZWGvzpa+3GkS0XI2ecnU9B7WqSSHiOhZdyIq8p3Fgum:2zpap2eccB7WqdCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777165967, "uuid": "39ccbd50-da2b-4f66-acc9-4f5f63d7080c", "value": 559580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777165967, "uuid": "1db8e792-ba8c-4df1-bdec-54668aca12bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165967, "uuid": "412d719f-5879-45f7-8b33-01a9fe12e073", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58eb63fa-410b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777165241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165241, "uuid": "4fc0e5d8-e9bf-4a54-81c5-547c5ee67e9d", "comment": "Malware payload (Mirai)", "value": "8bda6c69b8149dff7eb3690dba47dd6e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165241, "uuid": "bed278b9-7db8-4182-ae4f-62dccfc74e74", "comment": "Malware payload (Mirai)", "value": "2f7aec2de58561d342b73c8da344c06bd4e1e549cce6e9fd5e0862814bc2e8c7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165241, "uuid": "17e23239-a522-49ce-b529-c93aa4b44ee7", "comment": "Malware payload (Mirai)", "value": "d5217278f9e0aa1a18f8a5e99a150eee1b06388c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165241, "uuid": "f9c811d5-75bf-4cb8-9342-b5986c28b94a", "comment": "Malware payload (Mirai)", "value": "0bde606a4546f2a2efe45b081d0a7f8fc4022a99d275fbb6c24a9c29e4e5354a16af70ab5f38b7f5ad51ad2946bc8eeb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165241, "uuid": "29f532e7-a519-41ac-ba60-e66cb804a316", "value": "T14E01A5DE66E2B567C5A8CE40B0A18818A01EA38621E93E1CEEC974679C95901F429F13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165241, "uuid": "20f1c396-65d2-4f06-923e-50158322472b", "value": "24:boWBG05pELMk0aNw/rXdoJQkUthBiI3XfKh:boGGMpzaartoJQkUthBiI3XfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777165241, "uuid": "a4a8d271-3470-4eb9-aa78-c38a5bd89c6e", "value": 847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777165241, "uuid": "bc56fcb7-9411-415d-a439-390ebb96b713", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165241, "uuid": "793c98db-6ed2-452a-a04a-3109360a5848", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3a342e-417b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777213619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777213619, "uuid": "7028dba0-57c7-4b0d-92bb-fb68da6b2551", "comment": "Malware payload", "value": "15a825700e3a512657a36a3cb270dc78", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777213619, "uuid": "3d96f58e-30b5-4200-929f-150783e6b51b", "comment": "Malware payload", "value": "2ffaa635caf56eba07b1049bab35e1eff7211c35b38a40f71029581b266924b4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777213619, "uuid": "06b64f93-32ca-4843-9ad1-ce504c2178fa", "comment": "Malware payload", "value": "4f6674ab8b482a56a56c8e500f0a51f1674a1b09", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777213619, "uuid": "cfc38a7f-53cb-4feb-907f-e1381bf41ee9", "comment": "Malware payload", "value": "ee2056155f1b1441837172a646fc3f3d59ae30058d5a3a3c7a36db6510c67b4b5dde9fb9f51509d986dacbab5c7ba908", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777213619, "uuid": "7e16e284-d410-481f-817c-c7dfc8a11a56", "value": "T1C9E6AD02B3F842A9E5BFC278C5625517EBB27C491720EBDF055495A92F33BD09E39322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777213619, "uuid": "2c19c0d0-a894-4b70-83f6-e0aaffc46a82", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777213619, "uuid": "c34caf70-2a26-4563-8329-56904b388732", "value": "196608:7dvIyQs3CY9eO8OwcPFGUe64IwzlxOxoBFDuUswlYQ+:7drz7whrrIA3OxojGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777213619, "uuid": "587b434e-52b9-4bfb-afc4-f6851a7ef18c", "value": 15040367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777213619, "uuid": "db8298e2-4b65-4704-b5e4-3c2c42311c34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777213619, "uuid": "d6f9eaef-fd66-4fec-9d30-7da0db50b728", "value": "svc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33567a3-418c-11f1-a769-42010a9c0008", "comment": "Malware payload (Vjw0rm)", "timestamp": 1777220798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220798, "uuid": "5ff2dbc8-c24e-40d2-b3bc-7705ee37a439", "comment": "Malware payload (Vjw0rm)", "value": "81779a9412b48b7e550fc035aecb8094", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220798, "uuid": "3277fd4f-51bd-4599-a0a6-2a6eac1300d8", "comment": "Malware payload (Vjw0rm)", "value": "306fa13728624df5c4e8b4e3b0cbb385df4dfeb843616f012e5fda1eb86ab32b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220798, "uuid": "7b72331c-428f-4f3a-ada9-8d389205fb68", "comment": "Malware payload (Vjw0rm)", "value": "ad6f4ebbb1e1639c55d5ee87a9c1d3f7e7e297b8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220798, "uuid": "207deb25-5ce6-4dce-980d-0e34a5399bdf", "comment": "Malware payload (Vjw0rm)", "value": "d327b558414f11f89abb20fb63b8deafb130ccc97b1c3d87b2bb34583c0e1163bcfdf8909e34721fc26dd1bbea9c0510", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777220798, "uuid": "baad8f10-374e-427b-a984-979eda7af4d6", "value": "T1ACF1E859AC167A09D723B3A46E8F8C44FEBE592B5011C05D382CD1C48FB28745A6EF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777220798, "uuid": "c0bf5312-3a0f-46fc-aefb-342fd0879ada", "value": "192:tm3vmw3VYxgM0kLZYxJsLI2H4GZfXAnuNfPe:tm3uw3mxgmSJmH48nNfPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777220798, "uuid": "f7caed3f-aaac-4f65-9f1f-0deeee2aa865", "value": 8107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777220798, "uuid": "438d9389-cc1a-42fa-9b11-cf1617b04cde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777220798, "uuid": "52a0da00-a3b0-4f7e-96e0-4d9e62175514", "value": "avqqwKKThb.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dbfec4b-41ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777247364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247364, "uuid": "7db64d18-4f75-4868-a974-acc7227eb2c1", "comment": "Malware payload", "value": "f412a70416619baa4ccc8cb052eb209d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247364, "uuid": "6eed09f7-304a-4d93-b399-dfea170f96e7", "comment": "Malware payload", "value": "3164f6882b65bbf58d08919d3ea1b69f00e2757e6e4a8b76e8af1a057ae707cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247364, "uuid": "6b7b21b2-069e-4f3d-b16c-2e8db1afcb56", "comment": "Malware payload", "value": "f1892bfecf2d1dca0a1d5c8cfd1a0a53a2c2cebd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247364, "uuid": "94b45db6-e29b-483b-897e-d85359e6bb21", "comment": "Malware payload", "value": "c3a53f45c9a92041ba4c8aa4b123bfe43e12a8c02972f3eec70fadf92af769b26f0c1ea08e97ab0ca1ca27194c0d88a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247364, "uuid": "2622409e-4d99-4052-9c4b-3299216326c9", "value": "T10523F1E3CA7FA2F5CF76B03A53BD1146FEF32012634A66370DA935F9045E8049A25478", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247364, "uuid": "8695e253-89da-40c6-a918-09e666cf0bc0", "value": "768:jJ2p9XpvJr7rWlwcvqIfcsyB4TJvFDlFbADCbAreB9wS37STqO4k:V23Dr7awcvqWc7B4NvNlFb0lKB9737Sd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777247364, "uuid": "a54d956e-502a-43ce-b090-0fbbf673d479", "value": 47776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777247364, "uuid": "397d0dd2-8e89-44c4-b464-64d0818974bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247364, "uuid": "54bb16f9-d93e-44b6-a87f-72e2d1a39d85", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bcb9a93-41b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777236999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236999, "uuid": "f17f0d14-3260-4471-ba18-3e363bc3d66a", "comment": "Malware payload (Mirai)", "value": "f7f5fa357f997459d2ea41a094877d3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236999, "uuid": "f2b49aed-e5d5-4b38-b1e5-e0d72cae0896", "comment": "Malware payload (Mirai)", "value": "317e3ef0ea4a63f3c5d1709b72ae027dac1b2ee3d6d0f421fe1aa364a7d0cbf3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236999, "uuid": "d64b802d-dcf1-49cd-a28c-a53c529955c8", "comment": "Malware payload (Mirai)", "value": "cefacacffdd6047f7c2ba787dab98c0029b8fec9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236999, "uuid": "98b45e1a-c25f-43c7-ab48-b27887e6cfea", "comment": "Malware payload (Mirai)", "value": "feacff4469ea2f92a3e394d6f0a97e8417e680e5382c9d5bb1b470afb9591b9a9719ba40a19a4e69bc6671ee2b28047c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236999, "uuid": "1e3f8f89-d551-45f7-998a-64bf5ca9bb9d", "value": "T1A3044B46EA414A13C0D317B9BA9F524633239764D3EB33069928BFB43F867DE0E67605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236999, "uuid": "99629bed-594e-4392-9417-3b222050768c", "value": "3072:lN6hQS9rIXW9aDNFJw2i0hT4Ma6YDKCBcDvV0n3x68M/9QThZOj:lN0QJm9aDNFJw2iwT9guCuD90n3xVM/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777236999, "uuid": "40c07cc0-7ad8-4c50-b282-04014e79ac20", "value": 178849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777236999, "uuid": "8e71b10e-fb92-4cc0-ac40-7a9cd3fdbc4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236999, "uuid": "2da2663b-ae65-4936-80e7-0be51bbad22e", "value": "023782pler.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab40b07-41b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Ladvix)", "timestamp": 1777236917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236917, "uuid": "6069e3f5-dbac-47b4-8556-c05e85300636", "comment": "Malware payload (Ladvix)", "value": "33f1d673107d2d8e377077db8a61334a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236917, "uuid": "1d89e98c-f50c-4971-9a12-523ca5eac2fc", "comment": "Malware payload (Ladvix)", "value": "31b837f8c2966626dd9b7bdbf261bb99ae50024a31cd9e2bf8176c894a15032a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236917, "uuid": "fbbdee9a-c1a9-467a-980e-004962799535", "comment": "Malware payload (Ladvix)", "value": "fe27c1cf0a441c7562ecd214bb25f581a8eaec9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236917, "uuid": "72c5715b-deaa-43af-a392-a54a917bdd98", "comment": "Malware payload (Ladvix)", "value": "d9f4838ffb6edd51dbf25f4ff298dab27195e9e784892debd2af0d250ecdda001325b25f03467eaeb51d4701d3e52c98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236917, "uuid": "e0213c70-f337-4210-9456-bad4434f65af", "value": "T17633E14BFF19693CC056D77011AF8010FBB57880A703276F5AC4627C6DA3BA86E29F25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236917, "uuid": "63a56f32-04d8-4943-9394-ded21575b4ae", "value": "768:AFTaLRRpyz8FvQVzApIOn0mH02KNmNoYKaAvbXLdk6q8atyL47/AJiQimkxmfjjH:GTqRRpG8ZUq2baUHd2ti2a7kxmffvh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777236917, "uuid": "8c4191c2-bb77-4d54-ac01-7236f2a49cfe", "value": 51059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777236917, "uuid": "bb5f8898-bc52-42ba-aa0d-2191f14b990c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236917, "uuid": "4b9f2ed9-61f3-443f-8fcf-60d89ae5fc46", "value": "023782pler.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca2edc9-412d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777179985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179985, "uuid": "f71f00bc-f83f-4e07-955c-1e1d91e0ccbc", "comment": "Malware payload", "value": "92d7eb14a5602e15faab6bde7c524932", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179985, "uuid": "a92e5cd1-1700-4509-a130-34ce29437dfe", "comment": "Malware payload", "value": "31cb694b146efc095b93646c374a9b28fae79688a007f38dee473312fff1d3c2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179985, "uuid": "df8f6cfe-49cc-4250-8554-106af522b691", "comment": "Malware payload", "value": "8b50bd2a9cda9e265d61cc4cbdc9b5d25d6c3dbf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179985, "uuid": "6ee366fc-df8f-45c6-a9b2-8c8d3ea7c2cd", "comment": "Malware payload", "value": "64c9dfe6d1892491fff11f4782c5b76a3e3e0d750566e2e495cca9461d807c373f0dfe7c12eb9837fea523d5f3942d96", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777179985, "uuid": "118e14e9-bb83-45e3-9fa1-540c7601472c", "value": "T126D25EBCAEB3011D31B589E1A5D508C3A43D37DBB68E5F8A068583E50FA370DA4B9C5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777179985, "uuid": "920049dc-4cb9-4c7a-ac17-1a6242757786", "value": "384:eThy2V7mlbKqXecJpBpyg8F2IfSrfgKjJ6KQZfWFlC7l1SPiABhq:RJpdrfgwEJqM+iShq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777179985, "uuid": "0aef0491-6bca-4cb4-87a0-ee8c15bfba7b", "value": 29176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777179985, "uuid": "28d52e34-7d0f-4460-9483-edb7b436eb3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777179985, "uuid": "e94c3df5-84ab-48cd-b370-3c6ce14f00a7", "value": "Setup1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1abe3d5f-418d-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777220972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220972, "uuid": "53c42f63-3514-49b6-a871-5618764f7bee", "comment": "Malware payload (AsyncRAT)", "value": "33d6e875441823e698ea8b8c4739dfd4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220972, "uuid": "71a8e8af-498f-47cb-8443-008a561e9919", "comment": "Malware payload (AsyncRAT)", "value": "32e6e9765b2e1e18699fdcc2817137b22f893457e2a10ae3f66081dd58f811ce", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220972, "uuid": "caa38b4f-ac35-4329-825f-135c8c581af0", "comment": "Malware payload (AsyncRAT)", "value": "a446695785e38522c923a5340e43c236ac332616", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220972, "uuid": "9a6d9ef4-dc8e-4075-8cb2-c6899c4d8918", "comment": "Malware payload (AsyncRAT)", "value": "2e5e8bc58bfb6818fc03ce6944e7ac2fa9e0f408096c9c992989bbba7e56f48eabdad1e27af603b7ac5dfc79288257f8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777220972, "uuid": "b12d6a8f-93dd-40aa-abcc-99e9d370d049", "value": "T106835B324611BCD16B7F3EC4F1041D950CA478A34376825CFBC80DE9B9E6A54EFAA9B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777220972, "uuid": "02efcfcf-b4b3-4f7e-985d-3e64f55c87f7", "value": "1536:vqxwfqUS+R1aFu7w/0z4eIoOEroRpjqQVRcI9jNNMv4hf860/ca:CFWQI8vISiI9jNNg4N860Ea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777220972, "uuid": "59029a03-1a5a-4954-a2eb-d05e4f1973bf", "value": 83989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777220972, "uuid": "6364a66a-e3ad-4b03-a5a6-78c15b20db93", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777220972, "uuid": "f36816e6-7f31-4222-a4a7-f3573bc0457f", "value": "word.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd4df3c-4172-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777209567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209567, "uuid": "d2eadcb2-8c07-4379-914b-8f79b19b9c92", "comment": "Malware payload (Gafgyt)", "value": "de3f74a3afde33f90b9bd383e90d0598", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209567, "uuid": "b27b086f-f2ce-456d-bba2-5b2c5deb8c61", "comment": "Malware payload (Gafgyt)", "value": "349a35c3f0c2c5e6482b142b53ee42b56edaf59810a473d8ba3869f4cdefbed9", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209567, "uuid": "5673526c-b5a4-4909-80d4-2ebeb7e26876", "comment": "Malware payload (Gafgyt)", "value": "6db842b90b7e016f4bb76a785e735217d77e8ccf", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209567, "uuid": "d3f4bbbe-677c-41c0-b65f-9dbe4491340c", "comment": "Malware payload (Gafgyt)", "value": "8fecdced642c62ab8ef6a733555f1d83e30cfbd409551ebd45b12257501605ad252f986ceb45886c95437bf0df10ab5c", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209567, "uuid": "7a650645-ff08-48e8-af71-71011ffcd3f8", "value": "T1DD542916F9419B16D5C152BAFF9E825933173B78D2DF3102DD246FA4378A8AF0E3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209567, "uuid": "673d1162-a082-4ff0-a24f-136a60dbebce", "value": "6144:90bw99FptCxmz9aSdMNqfXWw/sbaF8JzW0ib7GmxNV+1K:Yw97+x1NUXubaFEHib7GQNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209567, "uuid": "01ece1d9-3f10-413c-be40-ade66a0abea7", "value": 278924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209567, "uuid": "a5e00b16-47a7-4833-97a0-1550ce62c55f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209567, "uuid": "4df66bef-5aca-43ec-be93-dd75830d1a59", "value": "redis-runcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8aa7750-411d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777173240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173240, "uuid": "8cac3077-287d-4fb1-ae6c-2bec641fc104", "comment": "Malware payload (Mirai)", "value": "96f4747f18802c995b7d7c0c72782d1a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173240, "uuid": "bdf80d64-712c-4b64-8402-d7e071ab9af2", "comment": "Malware payload (Mirai)", "value": "3547aa00679e473d575d99d156770004aa79d9718de2918eee20b64ac611806d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173240, "uuid": "b469bac7-f0fe-4aa0-8b2d-30831907559e", "comment": "Malware payload (Mirai)", "value": "da0bd4d47df9d6ad35f712f2c0c285b1b493efe8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173240, "uuid": "f169848b-59b4-4bec-afd9-a57fc3cc3774", "comment": "Malware payload (Mirai)", "value": "62c805fdc3514faa75057b4cacc1756e6202fb65eb58297fb34d5c63921117af2cf97a53e6173b2fe24a8d71cd076b13", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173240, "uuid": "29b05991-88d8-4ea1-aca2-87c76d6b68cd", "value": "T178B2D1DEA0D43009CDEE2CBD555E53324B9DA190738F9F69D7108D9C6BA8A0E748E071", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173240, "uuid": "8d99381b-d825-46fa-ba8c-89acd260179a", "value": "768:cGrQlS07dEv0UXqUhvQE+CXHfnNsrRsf5F9ZqUWvz:vQlS07FUXqIYSX/nN4RsxFDqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777173240, "uuid": "5b0df36f-abf7-4c5d-831e-1b5717898962", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777173240, "uuid": "63e46ee2-d213-42a2-a8ee-6ccc2267b396", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173240, "uuid": "fca83c05-932d-4c87-9ef9-ab03de6ee41a", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d787f552-415c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777200243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200243, "uuid": "2b14f42c-d261-44b2-b7b6-f0e4913e31ec", "comment": "Malware payload (Mirai)", "value": "b90621e352d8d1fdc8210e18c5f905e1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200243, "uuid": "e443d1c9-2f7b-4be4-8cf0-13257252beba", "comment": "Malware payload (Mirai)", "value": "35a35ab7164f8b0c2a41db0f72fd23b34c91e5a10699e86db44c502691ccad61", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200243, "uuid": "ac75ddd1-486a-47c9-b228-4123792708d9", "comment": "Malware payload (Mirai)", "value": "59226b2c554fe1f639241879505c487f724fec22", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200243, "uuid": "ffbaf913-4f6b-4edc-9f13-7b3ee7706819", "comment": "Malware payload (Mirai)", "value": "14c054a8a5e8bf5d9e515f20c44470670c55e5d45987e262143e4755ddc7a9fd0b8ec697721e547d2c751847afe6b423", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200243, "uuid": "e2663b57-1a9c-43ea-b9b7-c1d7b9b55fee", "value": "T188039E53C93A2D94C63985B4F8219B7E2B53E949A5936FD6D826C274C003F9CFC2D2B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200243, "uuid": "dc799889-3957-40c4-b956-00c5c54f1a84", "value": "768:iTUc2eBs3+EuYG6TKjj53iGH/AEd9AKblZ3ay3VJ5egoS6VnYUvC5YMy3:4D3BsOEw5FLdQS2rCje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777200243, "uuid": "6e4d819c-77ca-4e3f-bb50-ebaceaf324c8", "value": 39908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777200243, "uuid": "0b3ea203-3c20-472b-bb7f-bbe5e83e4ebd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200243, "uuid": "8de35e87-5632-4211-b9af-86600164d7e4", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a1687d5-410b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777165324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165324, "uuid": "c9a81af8-e87e-4846-9081-399f7374f6ad", "comment": "Malware payload (Mirai)", "value": "1200acb0ebbc6b509f6530b8ad11bd01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165324, "uuid": "d618d180-999a-4ed2-978b-a446f6918fc8", "comment": "Malware payload (Mirai)", "value": "36b0721ae6299ce26f8555c92bae8ecdd0da9adc3189ca6e37932b1dd64a57ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165324, "uuid": "4e4bb7a9-4b78-40e8-9d47-8c082921ef64", "comment": "Malware payload (Mirai)", "value": "f8e484d3568cbf8fcca5f58e391ee8997781a68c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165324, "uuid": "3927f402-3e15-44e6-9d8e-25df2ed7351a", "comment": "Malware payload (Mirai)", "value": "a283d4dae7b9f4323201659b172aabbae0c188952757f8af353a27def896776bc49fecf3fc3fd879d827944228d233e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165324, "uuid": "809c54d2-0a21-4b6f-bedd-29eebd033c8b", "value": "T18EF30845BC819B10D9D636BEFF4E028A33575B68E3FE72029D205B2137CAA1B0F76552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165324, "uuid": "63397b03-3efe-44a2-9ca7-f627f3cac13c", "value": "3072:26Cw6Z+aOvQClgxE/YSGmEjmk6vhaAZcWHfFDg/uH+a+XQ:yxZGFv/Y/m6mBvhaAZcWHfFDYRa1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777165324, "uuid": "214ec6ed-93d6-429d-a3c0-0e1c1ddf8a94", "value": 162964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777165324, "uuid": "e6742185-f836-4ea7-884e-1536f7da4169", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165324, "uuid": "84c3e8c6-8f4c-4226-82c8-2ba24a616d55", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ba8e80-41cb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777247855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247855, "uuid": "5797e001-3ba1-44f7-bae6-56a75121b6f6", "comment": "Malware payload (Mirai)", "value": "33d31098c663b2f2a757aec049f61f7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247855, "uuid": "248c4505-1c35-4668-a213-bbff4e963098", "comment": "Malware payload (Mirai)", "value": "378cc36e46b6aa98c6ff65e2de5cc64b03ec1af15aac3ce61faa86ef425b986a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247855, "uuid": "d45d1ade-4f56-4ed7-a4ff-8399ad9b842d", "comment": "Malware payload (Mirai)", "value": "091f2b3de5bc6685c306872dd7a9979ae063673f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247855, "uuid": "1698251c-51ae-488f-aaeb-57c3f495cfb9", "comment": "Malware payload (Mirai)", "value": "13c6ab0910a4f102aecafa7a85f158b28fea7bec2b0185b4cc8e7f26fc46426b2c1071646b1fedf6887e250c01b17b3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247855, "uuid": "d5b10de9-d4e2-47f3-b069-4b9091adbe11", "value": "T197B30945F8445B17C6C666B7FF8E438D7B2A1758E3EE720399256F30378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247855, "uuid": "1739f90d-1f6b-4524-9561-0927e898b608", "value": "1536:57jnPq8azP4V8YOTIBRvyNOzIuSIwYeFWd/lk68wywlQ3Ym3Tb/V1oEakCxE:1zPqF41OUBljSIxecUtCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777247855, "uuid": "9db99424-20f9-4094-8192-51ac51f81f44", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777247855, "uuid": "b35b80cd-2f80-4840-92de-451fa8625a7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247855, "uuid": "d22d3001-ca35-47cb-928c-a5a0d18826c6", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ac8932-4103-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777161800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777161800, "uuid": "d8b1dc1f-97c8-465d-aeca-d0e588b80f43", "comment": "Malware payload (RustyStealer)", "value": "c933634e14fd63263480a201c16900c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777161800, "uuid": "3f1a80a9-74fd-4691-9970-3da60872de67", "comment": "Malware payload (RustyStealer)", "value": "384d494911d5e63e2deb58bedd63d4cefd10b71558937f32af75e6aa5202b098", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777161800, "uuid": "cf2ed02a-560d-4e6b-aa3b-38b07abc183d", "comment": "Malware payload (RustyStealer)", "value": "6e27373df38eb3c0c660640d43c9491cc23a8767", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777161800, "uuid": "adab859f-d847-4669-b168-95f732f20750", "comment": "Malware payload (RustyStealer)", "value": "726f6a6efb517198467832a6f53855eaf975a11a050169532535e9d936316964f5519e86797f34603dd2f741be9c21fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777161800, "uuid": "79b17fbf-0043-4a70-902b-b14f1f570561", "value": "T13F6794C6E152FF86E2294E95FB037C3986E0CF286A653E6C4010F795E6CB342951FB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777161800, "uuid": "5ca949e2-4ff4-4a65-b81e-3d889de24f9b", "value": "2ad55b85893b21130335b19570d40858", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777161800, "uuid": "cf9b598d-fb60-4094-9b32-cab54832b7e4", "value": "393216:bBkxl398nS9Ydl6Qd+Av6bHxB5k9E2zCGPuX1+5N1eUNM8aSEorhxxB:9Iltk1GQd3Sb9kVGGsI1dM8dj9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777161800, "uuid": "e4856c6d-d20d-4df1-975e-10b65b918946", "value": 30414176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777161800, "uuid": "96e8c0fb-eaa3-42d3-b2f6-457010fe0ddc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777161800, "uuid": "59eeaf71-b5ff-45d1-9b90-62427c8eb44f", "value": "S8D70IPCZNAA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67bd4257-4121-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777174715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777174715, "uuid": "c75510f2-b42f-4da1-934d-63e542012c35", "comment": "Malware payload", "value": "bfd1a71b5a69915f702a6044eabbd2fb", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777174715, "uuid": "67c3534b-6e1c-48eb-b6c7-67f64cc7d5f5", "comment": "Malware payload", "value": "3870703844201ac0636b63d2cc1e0462ce2ded4dbfe69aecd333b5912b339c21", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777174715, "uuid": "9d845616-f914-4303-940b-878b54509c20", "comment": "Malware payload", "value": "5040fe618abe83f9a3a0ff3bcb7dcc5715a6371d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777174715, "uuid": "68b559af-858b-4905-8da5-791eff387e57", "comment": "Malware payload", "value": "1fa95fb71f1c83fdcd8bd9e6a5f742b2224b2e1c4d98e0ccb6d9c94e8bf4bb233f82d868e264f6a30a3e982bd433804e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777174715, "uuid": "8698a78c-186c-4c81-a2c6-9b6811ab981d", "value": "T14901FE10DE6CC299503557B52973A48EF7AA1513A303ACD8B89AD0B52F70B689CB1A37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777174715, "uuid": "1056bea0-7586-4d87-8618-792fb4c51ec8", "value": "12:VteghMees4cmcYzrbUkx7qZ5HhcVKxMFDu9t8aVuaVeCqRSUz3naHSuDR7wRi:/egxMT/bUW78Hhc+rKBCqZnnuN4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777174715, "uuid": "73cd54e4-fa91-4eff-bb0b-435ead25980b", "value": 753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777174715, "uuid": "5884f2a7-97d6-46bc-847f-7b1129d0f108", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777174715, "uuid": "bcc1de6e-daf0-41c9-af39-f4a36dce7073", "value": "VBS3.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1e98f2-41ad-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777235065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235065, "uuid": "d580e4db-0ddb-40ce-ba3d-27a2bdd7cc35", "comment": "Malware payload (ConnectWise)", "value": "abd774c26eb0ab2d535d318f5e3974ab", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235065, "uuid": "202dba78-e6be-47cf-8f96-0921acfa2bc6", "comment": "Malware payload (ConnectWise)", "value": "3a07b5a8e85cfaf7f691de5e4c18332e479047beb46e2fc165cde64f3f56f8f9", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235065, "uuid": "078e733a-c034-432c-b3c6-065764faafeb", "comment": "Malware payload (ConnectWise)", "value": "dc7ef9ae858ff3d7aa7115c864c1d3858eca13ee", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235065, "uuid": "89acb75d-ca24-4e2b-bf29-c0f5637af3d1", "comment": "Malware payload (ConnectWise)", "value": "80e561845b558ff6b1a4041b474a0e1e91e704a84927415cb95dfcd18ca4899fbd58bac9c0ecb4d2902242ce75cbf58a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235065, "uuid": "3a15d610-2fa8-4dbe-8886-aa65c1438462", "value": "T1E146E102B3D695B6D0BF0678D87A46696734BC049312DBFF5394BD692E32BC04E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235065, "uuid": "558ba6a1-d786-49a0-a4ba-8ec904b8a0d6", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235065, "uuid": "97d6251e-8f3a-4af0-aebf-00cb97970ba3", "value": "98304:KzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:KhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777235065, "uuid": "c6f56d33-6cc5-4727-b5a0-c8d1d8b0995c", "value": 5687328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777235065, "uuid": "9c0a4bfe-61dc-4d9b-afef-da9146f54d2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235065, "uuid": "6cb5f3d2-ec06-4bea-a4c7-83dc7050279e", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1d07cb-4171-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777209189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209189, "uuid": "d4667848-1e68-4b2c-a1a5-9a448401b8dd", "comment": "Malware payload (Mirai)", "value": "c67b23e649b7554d236c5fa4fdc6548b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209189, "uuid": "b7f1fc3d-398c-40e1-b8e1-d4fb7b3ead6f", "comment": "Malware payload (Mirai)", "value": "3a0bcb4b4749853aa2a4bbaaed52a1875511affc0cbfd058e90a0d08b64d0d80", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209189, "uuid": "c33c34da-a1b0-4350-9fe3-a7ef064f8311", "comment": "Malware payload (Mirai)", "value": "8b0d4b63987c2420f4d712c697a240d317cfa328", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209189, "uuid": "4c30929e-48d8-4d46-a350-6fb48ca3d759", "comment": "Malware payload (Mirai)", "value": "f5e0cb2b3dd8fee2ed5608b5bf12fd930ecda1db19ed33a4e48906d684f8337c84094f05efb44747688f44c8c37e77db", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209189, "uuid": "8a65f559-a817-4207-bfe0-fd24715a5b34", "value": "T14B14C70A3A228FEFF56D877147F34A30976976D627E29684E26CD5101F103CD681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209189, "uuid": "e428e5cc-1139-4e40-9b73-175ac52b9379", "value": "6144:4Z6eQCbeoufx4Jdf2dp06GtCqjYW8nY1j20WI:bely4Jdfap06GtCqjYW8nY1j20WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209189, "uuid": "b31d69bb-c90e-4fce-8a5f-986aabfd882c", "value": 202077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209189, "uuid": "85ad6666-7a6d-420d-a2ae-44de3923490c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209189, "uuid": "4ffd7ba0-30db-45ce-806d-16f0dcb76311", "value": "iran.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2a0104-41b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777236949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236949, "uuid": "0eda7956-718f-49f1-8fbf-416b98bc8f4c", "comment": "Malware payload (Mirai)", "value": "aa2c233e5131018aa3abca95b824be4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236949, "uuid": "3607075c-479e-47f6-86cb-0337b4d55575", "comment": "Malware payload (Mirai)", "value": "3a23de82b7714256e06f5fd797b417ab10be8e2c1582fda9bb1558a117437b80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236949, "uuid": "0fc8f020-ace1-4658-914d-6011fdaca80e", "comment": "Malware payload (Mirai)", "value": "734757f512602c0685291455b9c0ba25bb6d9a00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236949, "uuid": "5593e5fa-369c-413a-95dc-c6a63cebb682", "comment": "Malware payload (Mirai)", "value": "66c8c9692fd48cd4fe1b614a9167211a356e94207c43a4b5f5ec976a5e8f63222aacf85ba26ce3aa4f4e15ca76f3fc5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236949, "uuid": "3bfa38bb-340b-4c25-83c6-f08d693a9857", "value": "T1CF13F1FE5AE2299AFC6C18BB51BC37B05E4C36C523475BC1D752AC09133196A289D0FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236949, "uuid": "b077d7e5-16be-4dca-9f41-3af7197a3b23", "value": "768:duWmKgbchPqQbpyrv195rBIoDe9/q8qlCIPpW+1AdXNDDhY5kWh:dRmKgAEQbpmf0q8qkIRoNDDhSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777236949, "uuid": "adc8fe0c-146a-4359-9e89-fb1b943839ea", "value": 45212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777236949, "uuid": "51c172f5-cda0-4d40-a13e-a30e4ead5918", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236949, "uuid": "ea999ed8-9295-4cbb-afa1-66ff03d5cf3c", "value": "023782pler.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba796ec-417e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777214799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214799, "uuid": "82476a8c-4339-4560-9569-58ca8626fbf0", "comment": "Malware payload (Mirai)", "value": "815aff00eb8937d56170eb9146553ec7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214799, "uuid": "a2f7c973-d445-4cb2-a82b-8183a73e1a40", "comment": "Malware payload (Mirai)", "value": "3a4aae20b8b08ceb8f074ebaa9946ea647ee2028172fb020e096073a0e697155", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214799, "uuid": "4b8efd50-0c8b-4da2-90c5-252764b8d2b0", "comment": "Malware payload (Mirai)", "value": "c12546dc5bb363a3645c3e5f895b209a3a6971b3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214799, "uuid": "41d516ad-af1d-4f2c-9f8f-2b09ccb3ca9d", "comment": "Malware payload (Mirai)", "value": "867c766547e20dee9bd145b7a3e81cb3eb3588813e49a85effb9dc93ef6995c14627d788768152e82510ed976a044ad7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777214799, "uuid": "98ca9c49-79bc-4525-b0a8-b692ef29cc64", "value": "T1C3D333397E21BF6EE77C82300BF76A74D75626C636A19241E26CD7085FB025C188F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777214799, "uuid": "555e5289-365b-452a-8b14-20b4c82e6339", "value": "1536:xRjblr5t7K2aaCyXH0+Q3eu9uAufmA9E2RowXQ0dSb+DQJxT00YmZOcoi7RoDrHI:dr54mtWqLAV5cJCTDxGaNu3Di5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777214799, "uuid": "eafa926a-b3ce-4ee1-b915-cffec6107ce8", "value": 137928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777214799, "uuid": "66404226-0fab-4eac-9176-c1d75126fb5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777214799, "uuid": "8b6ea3ff-0172-46a1-af02-96e10b2c16cb", "value": "xdf.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23998bf-4154-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777196744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777196744, "uuid": "e73a960b-e2d5-40d7-9e02-6d2ed58dbaf6", "comment": "Malware payload (Mirai)", "value": "d8b72c71a27a9864da9c3dac8e704605", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777196744, "uuid": "42eb7bcc-1ff7-42bf-b771-d8458463e287", "comment": "Malware payload (Mirai)", "value": "3ade73c820f24864b0e9fa86d49d2cb0c22d5d520c1b0397651d705fbae9887f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777196744, "uuid": "05493790-c88e-40b6-975b-b99d8d23e1e0", "comment": "Malware payload (Mirai)", "value": "9359e6f027cbae61fb10a34f5ea867fbd14ba0eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777196744, "uuid": "b482b06f-1679-416f-930d-7f6457db31d3", "comment": "Malware payload (Mirai)", "value": "da83509fa5e4bd5c36a60a79f7208b53e06efd99ea0d8134fd79e450b7c0396ccd78d3d3a741428892d2ebd2bcecfe28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777196744, "uuid": "538a7932-2b6f-4c96-86df-8533034d329b", "value": "T15983495375C080FCC98AC134979FB236D863F47E1239F24A27D4EE167D9DE502E6AA81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777196744, "uuid": "dfe156eb-89a5-4eae-b624-39cecc76ba72", "value": "1536:X18tu0qO4TMOYC1k0uMgMUHliHqCE314JlsqHIfjBYOgUIzrr:XGtO3TMOnkRhJMHqD14Jlsg4jBYOur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777196744, "uuid": "aa0f9172-3e45-4ea6-8f34-23972d43a34b", "value": 87232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777196744, "uuid": "f6088433-106a-4f00-ad0d-31762c248b61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777196744, "uuid": "d2b3d384-e240-4f8f-aac6-044dc520b01b", "value": "3ade73c820f24864b0e9fa86d49d2cb0c22d5d520c1b0397651d705fbae9887f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2011113-4186-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777218192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777218192, "uuid": "ec7c45e8-d016-4495-9d72-4205614244d8", "comment": "Malware payload", "value": "f9bd41f080388ff8affc882d0b55ac22", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777218192, "uuid": "68101e04-093f-411e-a5bb-41bbd379d3ba", "comment": "Malware payload", "value": "3b2aee87e7394d0dcd5e96ecccf1c2bad7380a2d14534cb19cd4a4d54d359b0a", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777218192, "uuid": "c703b298-b898-482e-bb45-b038ba318322", "comment": "Malware payload", "value": "cad39a6e93c75539c0893b951cfef5ba8deb2226", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777218192, "uuid": "c0f05e98-b679-46a1-bc91-f8fb6ab65fc8", "comment": "Malware payload", "value": "b39ff68f92766e1b5823f3188c5e85727a077ff9a6d46642623b5b0daa29199de9b22018294ee1de30466298d7ae0ccc", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777218192, "uuid": "5cbf1383-effb-4668-8b03-fb85e10b9166", "value": "T17102B6213406A864C3B37F3A85EBB274FAA711BF62261144B4EC91D5BFB0D64D335E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777218192, "uuid": "fba837f7-f309-4e8c-857a-0fe9bcb775d0", "value": "192:gN36Snx6Ezc7damkWzl+fTIjr5eInHtP/zITImgpzn:Cx6EOlR/9Fn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777218192, "uuid": "63ae1fca-c27f-4a76-b8d5-88ec54a917f1", "value": 8892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777218192, "uuid": "92b348dd-eeb4-4bb6-a4e2-d1b79af73678", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777218192, "uuid": "66d82867-3c79-4f17-8bb8-f6260668ae94", "value": "t60CyMYX.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d937cddb-4163-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1777203252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777203252, "uuid": "165dcf54-fa20-47c2-9437-327a91ea04c9", "comment": "Malware payload (Amadey)", "value": "8cd556280f0c682210bd44be4555f0f6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777203252, "uuid": "e449f1d0-d707-41bc-a429-53bfd46baf98", "comment": "Malware payload (Amadey)", "value": "3bdcb32460e5a613c35b14205e4a98ad50a03a1d7d17f4c30f2935c6f6d5db69", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777203252, "uuid": "b5f8069d-219f-4e19-9bf3-b6125de5bd3c", "comment": "Malware payload (Amadey)", "value": "144ae1d63ab76a897b00b3c636733672673444bc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777203252, "uuid": "973a5eba-7222-4350-9fbc-fd1a17bf0d36", "comment": "Malware payload (Amadey)", "value": "ea240f86a22b20f11701dc6522b0f9d075a54c529d8dc8a7bbd97f8284a774b3d2a71547bbd0c96f7387ba8118019fd9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777203252, "uuid": "6d178247-f0c6-400a-bccb-9d0d576d7e96", "value": "T150557C0BA26141BCD4BBE1789A175A47F775704603709AEB07E446A63F13FE1AEBE310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777203252, "uuid": "a29695d0-28fe-47bd-98ad-548f489fd832", "value": "3f175edea93fa7a76a78004d12de2235", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777203252, "uuid": "86aba8fc-7628-4c26-8f25-fe23aa253c9e", "value": "24576:HrR0NaOy0mK9yCksn6JCc2YkxfUyamitsDw+mLRYhOnW:HkHmiyCkhh2Bamituw+Uy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777203252, "uuid": "8c488259-1ff2-4ef8-957b-55acbf27decd", "value": 1282048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777203252, "uuid": "a0ef4dee-5239-45f9-85eb-87d1e13d0503", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777203252, "uuid": "d66945e5-01a8-4d53-8821-fc5f89ea9905", "value": "cred64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b974049a-415c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777200192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200192, "uuid": "cf9f01a4-9b59-4fc2-b500-6a56d6b702af", "comment": "Malware payload (Mirai)", "value": "c6dd5eb61041ebddf2238a1f2061845a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200192, "uuid": "04e7b4a2-5c06-4b73-8715-093acde01ed5", "comment": "Malware payload (Mirai)", "value": "3bf68c02f337c6cad9c677c2c116763fdb985f1ff207e99b47a4bb240e3b6b0b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200192, "uuid": "f8aad939-7456-4bec-9f9a-88531f040d0e", "comment": "Malware payload (Mirai)", "value": "af76a19ad187094cb3cdfb2ca46c31173f8c7df1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200192, "uuid": "f8925142-a374-4a15-a40a-671a685ac195", "comment": "Malware payload (Mirai)", "value": "76b2cf7707b073631473ed8b93aca8ceb5a921079d08220e59cc08a96e05cb760aae2be9209f0c89715d56cfa64a5845", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200192, "uuid": "b5ec893b-3fcd-443e-9e0d-7b45b36a2a74", "value": "T167133A92B400AD7DF85EE73EC093090AF131A79551831A3763A3FD776C322A85D76E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200192, "uuid": "1fa0f61e-b79b-476e-b540-173df179ec61", "value": "768:0xqFTD4t0MoBjFAWEw0Cmk+3o+6WluD811JtTRHGtHwl5bsW71:COaWVOWLHV06WkD811bRHGtwlXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777200192, "uuid": "c3ea7f8f-de6c-4203-8e82-df0c9ae94f0e", "value": 45516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777200192, "uuid": "71607c2b-d1a9-4dbd-a8e1-f7858de9ce60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200192, "uuid": "2606ee22-4a43-430f-b2dd-ecf737cfa2e3", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3647c5-415c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777200007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200007, "uuid": "088903cf-7c83-4fa5-a0e5-f6571b800f9b", "comment": "Malware payload (Mirai)", "value": "9c20cabcb716957e9d8d797a17f2397d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200007, "uuid": "0d950a0b-8599-4027-968c-c3c945c82132", "comment": "Malware payload (Mirai)", "value": "3cb6ec46149f927f69c503048c0d7871942407eb5609b3093331d6ac9bc9f546", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200007, "uuid": "5f9ffd47-964b-44e1-acb4-3da880772f3b", "comment": "Malware payload (Mirai)", "value": "274628e9531302566da1bd8bfae1861fa1ab88e4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200007, "uuid": "19724a4f-e3fb-4bfa-96c1-4c6f8a4fe409", "comment": "Malware payload (Mirai)", "value": "880c155bfeaf25a73959b070b8e4f6b94937d8f26ef2ec00ad9b1ed0f728088f4f354af5e6e8a26a6b2c1c11741e65e2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200007, "uuid": "3ba62df1-ffa1-4c15-9e90-fe6d69318e44", "value": "T1F443F89AF9C28A15C5D412BFFE0E118D3313676CE3DE72139D205B246BCA56B0A7B816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200007, "uuid": "ec3974e6-3b00-40cf-9b1d-b854d0e87807", "value": "1536:bUnzbXpccgjHZwzsfU4gDkzoI+iYtnRK1rL:WXOcO50ietnRK1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777200007, "uuid": "76dab92a-0254-4da2-af3a-05a6aea91eb0", "value": 58744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777200007, "uuid": "e8ce0880-68bc-4ca4-acaf-828fc7063244", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200007, "uuid": "43d9a3c0-a891-467b-a278-c25588ca458a", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b514e82e-415c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777200185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200185, "uuid": "ed9fd090-a859-43e2-a26d-d994751cace0", "comment": "Malware payload (Mirai)", "value": "c0fac1f3e9329e7d9a0399b871e82670", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200185, "uuid": "367ba55c-0546-4cb6-bae9-c445d7499525", "comment": "Malware payload (Mirai)", "value": "3cd3b2d154d601f8726e888ed88f975ff7fe6cef8beb7c93521d8c95ab664707", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200185, "uuid": "c8ab71ac-d4d4-4f63-8905-ce18a393da9a", "comment": "Malware payload (Mirai)", "value": "b8dc929e6873ed03e5cea4db4706b7929bfbb7db", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200185, "uuid": "36c205e7-17c7-4327-a36e-a5ed3347db3a", "comment": "Malware payload (Mirai)", "value": "b72b707ce8b1b1fea874172d57b0df9c5c9b6df5cf5fcc827586a887988de78d91c65f3406f5af5973b4d29eab58ee8b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200185, "uuid": "ec7d25f0-7716-4e4c-8396-97f627d709b3", "value": "T14D233A49C703C1F0D8861570507BAB7AAE7AAC325570ED5BEB983A26BC32B11950B36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200185, "uuid": "36416dbf-8898-4dfd-ac0c-3db468594415", "value": "768:sXK15wniDa6PO5+m0h5phjprJzm3W/NqNd1UJwlAscucuN7iKlkH1GsPK9K:sXK1KIfPk+m0rpom/i9cu5CGsiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777200185, "uuid": "c11c2c18-d998-446a-9d9c-e7760312ceca", "value": 45728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777200185, "uuid": "49d900ed-e3d3-4000-afb7-cbb49e8c25bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200185, "uuid": "783180f5-e9d6-40c7-a165-1a7231f18d1b", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e08be1-418f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777222143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222143, "uuid": "7bfa5795-9796-4dc0-a4dc-ebf0197db61e", "comment": "Malware payload (ConnectWise)", "value": "e815435f6e0d27f77abb6b12f85805b2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222143, "uuid": "50dd4af5-3fbb-4aa0-9651-8e428c609a73", "comment": "Malware payload (ConnectWise)", "value": "3cf24175600b16ef9b348f85af27d261fd8fbc6e1e3091d89701d2e95d7140e0", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222143, "uuid": "2773428e-a0f1-42d5-a098-4a127014fb35", "comment": "Malware payload (ConnectWise)", "value": "d42f0091fc7118e356bebaee81cd212a0ec6b87d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222143, "uuid": "dc47f5ee-d14b-4431-be2b-69a3353e804a", "comment": "Malware payload (ConnectWise)", "value": "674bef1a8388a5c408298a6907e4ecf9610aa534eafdebdb70f914f92923f936c67dd5db066e6ed30faffa9a825c13ef", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222143, "uuid": "2ba6e451-9c43-47e2-9bb2-6272e0c583a4", "value": "T11D647C11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222143, "uuid": "b6a4db00-4090-4d97-9856-e18c2f809157", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222143, "uuid": "4d274c69-8ab3-4575-bd10-09084aa42261", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9Tr:h1iw7gryNkSV1hy1Z1u2JLu9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777222143, "uuid": "81b043e7-5e78-4f7c-997c-bb0f047914aa", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777222143, "uuid": "4ce67d72-22e1-444e-8873-d944dfbb2119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222143, "uuid": "32fd252d-66be-4c2a-b8f4-6f93ea7fe704", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6aa29cb-41ad-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777235058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235058, "uuid": "be394ba2-5256-450a-b5b6-8278bc3d0586", "comment": "Malware payload (ConnectWise)", "value": "0adf3688c103724bb114fcd217ef4173", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235058, "uuid": "767520db-b771-4d3f-bac8-e7041539a38d", "comment": "Malware payload (ConnectWise)", "value": "3d7bc87d1357c2cea56103de8c2c10f7a6932cbc05aa701e7eb7232061a6d568", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235058, "uuid": "c4f32cbd-594e-4c14-a397-1a881a1da2a3", "comment": "Malware payload (ConnectWise)", "value": "e473d7290ae166dff69809392a9b26222f3f88cc", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235058, "uuid": "2cf4f074-0b03-4be6-b8b1-7242ad054dfe", "comment": "Malware payload (ConnectWise)", "value": "39837399392d6f529d823213a8fa64e6f18ab029e00a4bf654f00f9ddd393009828254706361cc0e91426272830c4393", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235058, "uuid": "217fff55-dd31-4409-8cbb-1e48e456c789", "value": "T141646C11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235058, "uuid": "9fcd45f0-fe10-4354-a36c-610f63c1037b", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235058, "uuid": "401d2569-cf68-4c97-b1c5-0c632a6e8990", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:R1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777235058, "uuid": "0e8c7942-2a10-4fbd-9d13-fae22988eba1", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777235058, "uuid": "bd02027f-ea0d-4b3d-a8e3-60c0fcfd1e77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235058, "uuid": "c7dc58e3-da51-4a4a-8bd2-64459a6b3eab", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990f00f0-41c7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777246094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246094, "uuid": "a6c9358a-cca9-481c-9582-d8fb88f41dfb", "comment": "Malware payload", "value": "b59c180b427ae7788daa21f6c9d6d3a9", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX12.file", "colour": "#DCEA0E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246094, "uuid": "73a62bc2-c76e-4332-981a-30cfe67d15ff", "comment": "Malware payload", "value": "3d7fe9c7beac714eefbf0fe806c715aada299d92a2e09b48a5636f032f3c70fe", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX12.file", "colour": "#DCEA0E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246094, "uuid": "c3e66673-96cd-4c66-9a09-6b8357a865c4", "comment": "Malware payload", "value": "5ce535e1c7e70ffa229db5d841d21aa697e99af7", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX12.file", "colour": "#DCEA0E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246094, "uuid": "849fb26b-7f1e-43f3-9a12-50d881933a18", "comment": "Malware payload", "value": "3c150b21703d73e75e86934f1a65d542deb70be53900f1731e7c80c504c08533a6449ccf27deb24f924355b5bee6ace6", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX12.file", "colour": "#DCEA0E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246094, "uuid": "09eee80e-640e-4052-961c-12979e5c8c08", "value": "T15E773320A644CAD8EB4F4138B8642704A35CFF57B36595E647F63F90EE763742EA1B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246094, "uuid": "6eceb0bc-696b-41e8-8350-809f28753bbc", "value": "ad510aa4318530074af11ba8249f6938", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246094, "uuid": "0ca7c3d8-5a0a-4f9b-a0a0-eff2691f9b30", "value": "393216:0XuOWVpS6c6NIjkBOM0H6wnE/COMIeSr1WaLOHKOE0JWRNIf54bAifVoduelXwR0:0+FHc+IlJ6JMMr7L0y+O9mMoXwOQ94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777246094, "uuid": "4fe14444-7ad7-491e-9a2c-cb8c4c1dd8e7", "value": 34602336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777246094, "uuid": "d8e6782d-61ed-4c93-8ace-2aa4f3b66580", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246094, "uuid": "95373a31-7d6b-4076-8f3d-018123f2b2ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931199c1-4169-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777205711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777205711, "uuid": "d4c72d5e-dd81-4964-8cb4-9becf7541e5f", "comment": "Malware payload", "value": "569514fa00eaa85fa3a9699d0941bc34", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777205711, "uuid": "ea43c8cc-90bc-4024-9466-8921d2b7b632", "comment": "Malware payload", "value": "3e6db6b42264d6b17935cdd4cb065f96dc18fd686db886b44ea09a4a915e9548", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777205711, "uuid": "9a076717-360b-41e6-abce-96a840755c22", "comment": "Malware payload", "value": "1f2db2973b82250468aad3ed420b9b58e8c79540", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777205711, "uuid": "93e80c66-25e3-4f47-8bac-62481d5f0c8a", "comment": "Malware payload", "value": "141d4be09fe55307a4ecb9a2d6385e36d449b71da244f3b83dde392b8d787adb7f4c8dcafb539d411cd60634a7bd4091", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777205711, "uuid": "0a098ca7-4595-44fd-97c6-13ac07d889c3", "value": "T1F9973390D4A08587F43FD13E8B3AF49584FADE98D27AD9BBC9145B7684F3BE185CA001", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777205711, "uuid": "ca961561-75c7-4c62-b78e-024e23749199", "value": "786432:pRJI1+gc131nCmPp7ZkeP56GEhBf5wvQq0camSRGhlCmK2zF:pRJI74Em1iePJCxeIFcamtfK2zF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777205711, "uuid": "aef8915f-55b2-483d-8ed0-a65c7fbcd55a", "value": 41677248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777205711, "uuid": "67a1bea8-4c15-4fb5-a383-6e1a1e329397", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777205711, "uuid": "5087a585-c7ad-4507-ab0c-2ccd66865610", "value": "setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2ab92a-41a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777231877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777231877, "uuid": "d1400f13-912a-4a8d-9bc2-ffe18740203c", "comment": "Malware payload", "value": "d7d54b026921126e26862072d5a95255", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777231877, "uuid": "56db743a-7460-41e9-9fe6-5f6158f227ae", "comment": "Malware payload", "value": "3f08e9e569954f74cc7ca941a14c078fadaa4001b15e9f19fc4fa1809f3d7fc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777231877, "uuid": "ba7d8ca1-1112-4381-a72c-0497e7e4722e", "comment": "Malware payload", "value": "0d2f2913747aa0a0e701c5bba7c99b0cc3719ca5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777231877, "uuid": "59988b8d-597d-40a5-b191-b233e0b2d84c", "comment": "Malware payload", "value": "972a9230f8f39edc04c15a062ea049b173005745c1ccb29962fd4f021912912f11a8b550a00f3741fb9f48e90dac6eb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777231877, "uuid": "04b6937c-7b74-4def-aa5c-2197ebdf9d60", "value": "T1AA34D615F7E724ACF1B3C2B89E93537298B9FC14A130F96E626151513E16B20AF3CB16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777231877, "uuid": "924cecda-5ad7-4320-bb7c-9d9980219319", "value": "438c98563de76aadbd086c63918f5c3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777231877, "uuid": "1ec33b19-6bdf-4932-bd94-0c4fc95e9376", "value": "3072:ienvsxfIlOcs6Oi5llxp5RIR4QUnHXmUlELC9FkwxB5ckpxBm0rCrMgjjreH9:iSsxfIlgvK3VCAD9MMkw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777231877, "uuid": "84c65c95-9806-49b1-af36-2eca5bfc0a13", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777231877, "uuid": "63ecf6e0-54b3-4d33-ba07-af5e79874acf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777231877, "uuid": "efa5a31b-833a-4f2b-bdc1-6b63ec7cacf0", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.44966.27449.13377", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e36c4068-410c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777165903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165903, "uuid": "a537cefa-bd0f-479f-82cb-314dae724683", "comment": "Malware payload", "value": "8cfc6b74aa2f2e3b1ceb63f61cb954e1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165903, "uuid": "8c384846-9f0d-45dd-baac-66f898550684", "comment": "Malware payload", "value": "3f244febab240b53fefc3e128baf01c5477e3bd50192f6530c225c501ad756d7", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165903, "uuid": "ace61b9e-f7c3-437c-9321-8e8b62230d70", "comment": "Malware payload", "value": "65d0c177d8f0139ae6d0bc3cf3edd7753b0a82d6", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165903, "uuid": "60ab1101-6d6f-4302-9948-aa687f2b65d9", "comment": "Malware payload", "value": "5fa6f925ca7cf971fbde73d6aa8d9caea9af92cf8f8b401b1e67607066978c312159146486007519806171eb744c2c70", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165903, "uuid": "6fba4fb4-1bbb-40e1-9f8f-96b9b994fed7", "value": "T13C512819DBFA1B39F3B3DA3956315A259D777C41E93C8F2D0180024C0866A05EDA4F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165903, "uuid": "0f2a607e-0dd1-42ec-b972-509f20034b09", "value": "48:8bxrNdOVmgesJ9zwdLY/m+eeMfQbYD00ki50KP+2EZkU6yRC3pDAJCa+Z:8b6JKJZeMuC00kiGSBEZkUxRCdAI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777165903, "uuid": "61dbfa7e-d070-4b1b-8a51-3ede9a4904ad", "value": 2779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777165903, "uuid": "437e0ea7-23d8-4a3f-85ad-ada04fcdde81", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165903, "uuid": "7bd6a017-e50f-4ba2-a229-872f94a63f1a", "value": "Microsoft Edge.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ffd179-416f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777208293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777208293, "uuid": "47d3a014-093f-4f61-a551-4e6290d20ba2", "comment": "Malware payload", "value": "18634196c146953599c39dc029ad49e4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777208293, "uuid": "2dfb2e86-db10-4415-90ff-31898db5321d", "comment": "Malware payload", "value": "400e4c5362feb1d4f9c071b2ba089e1015e4b351886a7e1e354cb5f2e31ade51", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777208293, "uuid": "92b865d3-4b94-470d-9d73-6c17e9dace97", "comment": "Malware payload", "value": "3b5e486661f902057edec16b0427798efbdf3410", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777208293, "uuid": "27ff22a9-8102-4b06-9cc4-e36a562aa3d7", "comment": "Malware payload", "value": "d5aa82e9d0c40bc61426a64e6b774d3f768a33f1bc201746292499702623dda20af3c2de5ca81955791f9fcb2ec1e797", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777208293, "uuid": "ff71bbcd-7cca-42e2-b164-43395441a5ce", "value": "T122E09B8B42DA133B4B6D9947F324DB2D30452823989DB71D668DD711B74A4097343FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777208293, "uuid": "b2f94322-8de8-4037-ad41-8d7489c47516", "value": "12:ZCkcNz60E4k8gQemLnI+yLd+JM+0RwbFUG:ZCkIC8gQemLI+c+6+qlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777208293, "uuid": "d1a80849-1c62-4fee-acbf-5cb8a728ffd2", "value": 397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777208293, "uuid": "b1da6952-cde1-4d1c-a7e0-6f460724b9eb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777208293, "uuid": "da692abf-63cf-43c8-9859-68c6e80f32b5", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c1a02a6-41a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777232543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232543, "uuid": "9fd4ac62-e3f2-4177-b14c-183ba11aa713", "comment": "Malware payload (Mirai)", "value": "744b6172d5045caae5e7f99c913964f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232543, "uuid": "14062670-070c-4ad8-960e-f5f4080f205e", "comment": "Malware payload (Mirai)", "value": "40c16d982a694ac26066288cc8680d572e4f77212e1310f91b45d351a18f634d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232543, "uuid": "54e3a50a-d2b0-4e3e-993c-a3ce26d351f9", "comment": "Malware payload (Mirai)", "value": "2948caa1bee013544aaca21d70a757f9aa34aa2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232543, "uuid": "e16d14bb-4cbe-4754-b536-22b3db2fdace", "comment": "Malware payload (Mirai)", "value": "3b1d6de73711c443f01c661d9727cae662e6ef4926d2751a156a13e264b15358141ef85e52888001f3bfeedf599106e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232543, "uuid": "cc96ab5c-b855-4983-997b-647f303eb2ed", "value": "T1ADE3FA48F9515729C3E373FAFB8D468E32231FD8E3EA30219E305B6123C5B961A75925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232543, "uuid": "85ad54ab-b886-41e2-8344-0b40d90622c5", "value": "3072:JvPnEIgBijahpijCx1sRgtOL2dvhK1on7:JvffjahpijCjsqOKdvhKmn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777232543, "uuid": "b461c62e-9d3a-4fca-b21c-d9d779d1b790", "value": 148760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777232543, "uuid": "db2bb59a-d1fc-49e4-bf2d-84729dbfda5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232543, "uuid": "651e882e-962e-4653-a231-039b212a569b", "value": "shabak.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb9b3a5-41ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777247312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247312, "uuid": "b49e9e23-a26e-44f8-b1bf-d8722644f311", "comment": "Malware payload (Mirai)", "value": "7189d644a64b4e6115d99fa80e87b07f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247312, "uuid": "7c9e7695-bada-4919-9924-426a3103eaed", "comment": "Malware payload (Mirai)", "value": "41e379e23d292321f0de83e47e83026532af25f6848f1c979e482e81ce11bafb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247312, "uuid": "d10a8e3e-881c-4e96-bbd9-9be975e6738e", "comment": "Malware payload (Mirai)", "value": "aaafebf829f10010a2e95910f5c5b76bba10c9ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247312, "uuid": "f6ff3cb2-bfbf-423d-b29f-85b8704d7b3f", "comment": "Malware payload (Mirai)", "value": "6f7d411de28c1e08548c39b86028e0249bebf75db9888a7d65f0d09f1e8a497c6858b5b9c09dea3f226d31339e208f04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247312, "uuid": "9d8b0a38-d6bc-497d-9b5e-5063e6f661cb", "value": "T1CF259D2AB2B3B2BDD007C03447DBCAB15532F0355A322D7B22C4DB353E9ADA51759B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247312, "uuid": "c48f823f-7b0d-4ce0-88ac-36e9fa463b30", "value": "12288:PqD7qxT/NgEMi8yMHAd3HkHNpSCPo4/+MQEaU9+qRMnNHPayEq5ZvfHXrtmqfzeY:e76/Ngz7yhnjuxRMnNL5Zv5Bfze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777247312, "uuid": "aeb6db90-0f55-484b-8813-47a8d37d12c5", "value": 986976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777247312, "uuid": "1e4ad3b0-3c29-4084-bb39-efc4048afe6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247312, "uuid": "67903f3e-d3db-4bd8-8f58-8428a8ba9f5f", "value": "SecuriteInfo.com.Heur.12123.13291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5851fdcd-41c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777246845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246845, "uuid": "d6bffddc-d388-4b9f-8790-a78a272f7df0", "comment": "Malware payload (Mirai)", "value": "01cd3f5b7473a8e303c90b2912cecaa3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246845, "uuid": "01bc7085-88b3-4f1e-be28-cc8c87feb264", "comment": "Malware payload (Mirai)", "value": "42d402ca82cbf3891159ae4796fbd0e00894b108db4f2f0d0e0ece200b8e68a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246845, "uuid": "17d3b8ab-7b7b-499a-bcc9-f4de37cce691", "comment": "Malware payload (Mirai)", "value": "a8127dc05940e6ed8823a6a2489d8c52f754f175", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246845, "uuid": "bc562462-fd50-42b6-83f1-7391ce2fe635", "comment": "Malware payload (Mirai)", "value": "e070ab364ca64b209672e94447859ab541fb605d1cb0bce0aba90d4df052e6c6a78b551bb266d5bced2ee7af9f045b8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246845, "uuid": "6a95cb08-d673-43cc-a187-5c9b5c3d8d20", "value": "T13304F806BF714FF7DC9FCE3706EA0705145CA81A27A52F72B634D868B64B28E25D3960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246845, "uuid": "db810018-34f2-4de8-9794-bef51e9ba5db", "value": "3072:yAXoIg1RLwNcdHNL0eJeeFBacacTnRS/nh+a:1oF1RKSNMcTYnh+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777246845, "uuid": "1d4107a1-3564-4eff-9df4-dc70c0ef0542", "value": 184516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777246845, "uuid": "3d0a0921-2de1-4d05-a933-72dca015a6e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246845, "uuid": "50a480f7-82e7-4ed8-99da-2cfa7a0177cb", "value": "Yboats.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8374e14d-4182-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777216423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777216423, "uuid": "c4804224-cc5e-4547-a815-4113c08bf9a3", "comment": "Malware payload", "value": "ab93b49d84d62306ebb1b923b482ae27", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777216423, "uuid": "c83ffb47-bf1f-4754-89f5-eeb141487ae1", "comment": "Malware payload", "value": "44727551f5b1365e1f208801cd02d00d380cf38a1d69a3c85006402122e3b268", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777216423, "uuid": "78f9404d-1635-4baa-b08a-32ae2911802d", "comment": "Malware payload", "value": "0996abbc5f30d2b2a051ba0fcd793f5ffa147492", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777216423, "uuid": "09780150-38e0-4701-8b29-13c33f4504fd", "comment": "Malware payload", "value": "95216abebb07da8603d9289176d2cdaaea556cb528e2fd5ac27456990b239c4ea7953e3b43809de8d3db5de11baa9f0d", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777216423, "uuid": "68b0d1dd-b507-4d15-bd34-000c426a2217", "value": "T16834BDA205ED606EBFD80E34A27A80E452ED94066DB45B1E9C01FCC5736B77D29F708E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777216423, "uuid": "1b6acad4-a245-4673-a362-d660fa7c7baa", "value": "6144:kHxktl5lNXlEMsBkUK1pownvPo1zO2IV5+CAaB2:iktl/NXlQBkUK1DvgdO/12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777216423, "uuid": "20c7a9d3-054c-4965-a737-d2c61fcedde9", "value": 245102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777216423, "uuid": "13748aa8-dc48-4544-bcdb-5c5cf07d0b4c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777216423, "uuid": "24428708-293f-4c3b-bbbd-8ddd24a502b4", "value": "INV609937(SHL43)(RPF Distrbution).docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e60e2b7-41b1-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1777236493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236493, "uuid": "2e1d93fc-4fc2-405c-b860-d13a462dcaeb", "comment": "Malware payload (RatonRAT)", "value": "6b51960d1bae61d8ed68d109d1258d00", "object_relation": "md5", "Tag": [ { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236493, "uuid": "91f273d4-d0c9-49c7-9361-11e3dead9ec1", "comment": "Malware payload (RatonRAT)", "value": "4568061036e5b3f3a46a7365edf2fe58613a83e4a310e459ad68a3b774b9e72d", "object_relation": "sha256", "Tag": [ { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236493, "uuid": "b0618511-a563-4eed-96d6-5879357bc40b", "comment": "Malware payload (RatonRAT)", "value": "bd771f352220da9bce8b7b9fbec39ffe64a5528f", "object_relation": "sha1", "Tag": [ { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236493, "uuid": "3d501ad6-32bc-4c46-bcb5-3b2d7acb722c", "comment": "Malware payload (RatonRAT)", "value": "9da30da718226d9fbfe9fe2c9e0bd74b69e33bae41d19089ef6f089ffb3071d45af61085b3cd5d03eae70714b84be0b9", "object_relation": "sha3-384", "Tag": [ { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236493, "uuid": "076d0281-ceaf-43d4-9a09-ca4f8521710f", "value": "T138E5F2309E0169CD27B529F2A0E9A9186C7017F3CF187D1A4C44ECF79EFA9DC9AB6414", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236493, "uuid": "f2f0dd11-3d8f-408f-ac7b-015454959ff6", "value": "24576:HXKJ5pPwQ2ObQY58GN0B/Plli9JcaT8DrA4NISTNyCS/kgf7syCAIqWPD0Wxcdnm:3e59sFbEI5DR85ZFqe5CR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777236493, "uuid": "838820cc-c532-491a-b5cc-d4373582e5f8", "value": 3223398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777236493, "uuid": "50d09feb-b378-459f-9038-49b183a03f7c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236493, "uuid": "edfaa141-90f4-49af-b4d4-43e44deb0602", "value": "ivyvbs.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb16bbd1-415c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777200303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200303, "uuid": "ff489791-bc8e-44b0-9971-565b158045ec", "comment": "Malware payload (Mirai)", "value": "3c77eefa2b6406df2c40c45074df4bc7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200303, "uuid": "9c8d1e2f-d706-4e2d-86b9-ea8a1db6b9c1", "comment": "Malware payload (Mirai)", "value": "460812e89bbe0740f0eb7db2e387a5380210de3d6fd038037a7eb7c927e5e515", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200303, "uuid": "c17ea369-cd36-4e7c-a926-4a5ce55e368f", "comment": "Malware payload (Mirai)", "value": "ad067df4229357647087f4a3c743a8869fab1b5d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200303, "uuid": "94469860-b78e-45a7-891e-6a8297e0584c", "comment": "Malware payload (Mirai)", "value": "f16da489f12ce144952acc4fc86960d89be3510e42cb6fb1bde6d25fb3e6875c3f132a2c4c192ec7ead329e50d9d8b77", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200303, "uuid": "3b377753-6e35-448b-8331-d73685283485", "value": "T1912329035491C0FDC955C230AB3FA636C922F47E123AB59D73E0BE226E4AE311F5A589", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200303, "uuid": "01728645-9961-4f5f-90b4-34527f640efc", "value": "768:FkrR8ysZAY+OGZZRw4xSwPtKOo7vHjKRDACGyjltp4B6gC:6d8y2+OO5yDDckCGyp4B6gC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777200303, "uuid": "d336b752-e51d-48a4-be4a-5ff18f6af69b", "value": 46400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777200303, "uuid": "d7eb6469-26c6-4854-8744-5bf89a903291", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200303, "uuid": "397a5bad-9602-4d88-918e-cd2bf3d807aa", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9acff6-4172-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777209564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209564, "uuid": "202115d8-d8c9-49d0-99ef-14d96510e124", "comment": "Malware payload (Gafgyt)", "value": "17d81b9bd49ce66ae7749a71ecc42961", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209564, "uuid": "16108d45-0344-4e69-9d1b-0b55309502a1", "comment": "Malware payload (Gafgyt)", "value": "464d59cf6960fd511104014644658d51366cec254665db3c3491422c9ddb5a56", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209564, "uuid": "8d5a2a65-6adf-438b-aa52-ed7f3e38a2cf", "comment": "Malware payload (Gafgyt)", "value": "a14ece6604419024418637e6bbce5a863cd391d7", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209564, "uuid": "dc40bb2b-fb87-4e86-a44c-00a2ece3774f", "comment": "Malware payload (Gafgyt)", "value": "9d5838d9a2d19e860266478a232c631d0f2e244d7b3619e777476e3d48452825736ba2184972b02dea3ee118eb7e3033", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209564, "uuid": "649466dd-1b92-44cb-b873-b94a07affadd", "value": "T1B99312245C6737BAE0C68C3811DB0FB9506A7C625A7BC306ED546E75A4B439A332EF90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209564, "uuid": "3f3da4dd-69ac-428f-a111-304f38acd31b", "value": "1536:3df8pfkj0ObczWI5KqbsGZtJpLu6oBN249+kt6U/9uFcZb1ILT00kf3VEst/SmAX:tf8dknbxI8qbpdu1Bp/90UZIXA583H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209564, "uuid": "ecfde658-04a9-4409-901d-4ae95bd7ae22", "value": 94272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209564, "uuid": "647aaa64-cacb-44ea-adb9-eb9fe109455c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209564, "uuid": "31f1df5b-ecab-45bd-b14d-93bfd9925d7d", "value": "redis-proxyd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d505cd-41cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777247866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247866, "uuid": "a5e4a83f-2c55-4698-afba-ebe971a5b551", "comment": "Malware payload", "value": "a7c18974bfcb47b2113721d734ed1946", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247866, "uuid": "a28666c4-ee51-4d48-b4b5-a2e89fa52858", "comment": "Malware payload", "value": "46f5bb5a40a2e136b6b111b650795d3560f0ff670717da1103d71f0be73e9a49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247866, "uuid": "2a930e7c-9363-4f11-af07-74c226823b81", "comment": "Malware payload", "value": "33f907611e8e23cd673b69ea775ea12e9aa6d1d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247866, "uuid": "9270b027-1446-49fd-9432-46eac0bbeb87", "comment": "Malware payload", "value": "3401b395dbf92097da67e2df4be5247dd42a9cb97367a13aa0ec3ad5e79cf3a87403d7e0aad73a19ed04d5311e338c07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247866, "uuid": "3264830e-0e55-4efa-9291-c13f14e240f3", "value": "T184C30956F8819B11D5D151BAFF0E124E77131B3CE2DE7312AD24AB307B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247866, "uuid": "703499b2-aafa-4dce-8071-08aed28a9d13", "value": "3072:fWD7YhjFMX+maR8TcDeRqQV3tNQYciYTG1r:fWD76aX9aKTcRQVnoiYq1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777247866, "uuid": "f1d439bf-543d-4bf9-8d79-12ccbc456fce", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777247866, "uuid": "b3119d9d-b9e9-459a-af4b-82f05da1ce1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247866, "uuid": "81bfb5cd-1cce-44b3-b140-449d0ea6e8a7", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d4561d4-418a-11f1-a769-42010a9c0008", "comment": "Malware payload (Vjw0rm)", "timestamp": 1777219687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777219687, "uuid": "46880c50-01ee-4f1e-aa9d-d1b30fa05062", "comment": "Malware payload (Vjw0rm)", "value": "a259cc63d396473035cf033e43a3f838", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777219687, "uuid": "e5398967-e4ea-410c-8a12-afb037a90ae8", "comment": "Malware payload (Vjw0rm)", "value": "4786bf502fa08954dab2d2c38ac252d98c49952ed0ccdf64b078a7db9db15901", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777219687, "uuid": "21927990-5a68-461c-9918-4fa9cc5b7a07", "comment": "Malware payload (Vjw0rm)", "value": "3abb62c8f1081176896033cf6d20cfaeec42d916", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777219687, "uuid": "bd36e62a-1b18-4b46-96f1-12844cceb7e8", "comment": "Malware payload (Vjw0rm)", "value": "6d5c12ac7c69bfdba84e28c926304faa08b12384e33754fdda51603509bb35d7a2de752b9f8b237af06ad80b914c290a", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777219687, "uuid": "287d538b-ccc0-45c2-b2fa-70a1d89670d1", "value": "T1E852A017F94B893945F2EDD07BA3209AE8B064A31934645677E886DC6F3852473C8FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777219687, "uuid": "4ec07413-a248-4d12-8de2-12b24c40bd67", "value": "384:NjqODW1VD6unuJFQSJg9X7rCXrZXV6GqVWbi07jeKSBDhujM7ZEw:NMb6unILarWlwVW2XHBozw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777219687, "uuid": "61f55445-e6f5-40b0-82c2-162a6fb579bd", "value": 14192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777219687, "uuid": "e54bf6d4-180d-432d-afa2-a0ee01ca13f5", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777219687, "uuid": "eb5d07d6-72ad-4ebe-935a-524ec5afb736", "value": "ComprovantePIX20.01.2026.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a341202-41a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777232540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232540, "uuid": "53552ea4-8c42-4cfd-979e-8836728df369", "comment": "Malware payload (Mirai)", "value": "a23c953da60a5339f95009c5cb8eacd4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232540, "uuid": "adca38fb-516d-46ac-b0ed-721956ad6b63", "comment": "Malware payload (Mirai)", "value": "47a9dc8fddd23df56816974a0f86cde7d834a662284fadae21db47c537296889", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232540, "uuid": "8e23ff53-5830-42ba-af0c-07d71d735318", "comment": "Malware payload (Mirai)", "value": "2332bedaeb9872b677f709e6107b058c4b92e1b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232540, "uuid": "c5f8b9a7-e32b-4a8c-bdc4-9156b145de1b", "comment": "Malware payload (Mirai)", "value": "f6b82bde2d7924febe6d507f31281dadd3b66a2ba96671f8913b609196edaecf4452d2d7343a19322aa0ff594d4ed0e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232540, "uuid": "a583a754-d0cb-4017-b81d-ed77932b2bf7", "value": "T173A33B9AF703D6B3C84305B1119BEE6F4D31BAB95835DD49E3747EA0BB228C0B901B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232540, "uuid": "45b86d12-9a76-4b30-bbb3-f9a1c7a43f19", "value": "1536:9kTHaq9Mp+ajZMjjNNlZPknO6WjOLgZvUXJ3GeLIE+uc7kQRk:9kra0uvujNNony6LB53VL+usR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777232540, "uuid": "529ed8e0-8367-43b1-99d1-c8e465ea2842", "value": 99896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777232540, "uuid": "e0412012-9306-42e0-b0d1-a4e73b89cfa9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232540, "uuid": "e0f6c65e-0264-4a88-bf6d-3510029da315", "value": "shabak.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97389fa4-4172-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777209584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209584, "uuid": "456ea6b9-5653-4030-84b1-5d34ca8e28ff", "comment": "Malware payload (Gafgyt)", "value": "ac82c4156244b0928748a914d2536e6a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209584, "uuid": "98568986-0021-4b77-bc7a-d703a62193ab", "comment": "Malware payload (Gafgyt)", "value": "481b9c78612476a3f55e0983c4d9325376e3263deb3fddff6b050b5a8275bcdb", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209584, "uuid": "b873493d-676b-4642-a824-59cd7a14b353", "comment": "Malware payload (Gafgyt)", "value": "0691444a96b3716933c3c2198f6e940680dab0e3", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209584, "uuid": "1a4a9fd7-2462-4e0e-8abb-454a83dae76e", "comment": "Malware payload (Gafgyt)", "value": "8d166812025ad0bb3e8fd69685a0ebef8e8a40b2ecf3359d4285c9997e104246179d39b6f5449cf2f04d5d58d45d8819", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209584, "uuid": "441e850c-6a8b-476d-a09f-b2e97de86dd4", "value": "T168543B83F900CE7EFC0B937649974915B130FB7608420A76A217BDAB9E3A1D61573F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209584, "uuid": "74882081-1f70-49f3-81e9-2d3bbe3cc641", "value": "6144:vQnhao3iSwGofdFVI7UrC3E2dzqasyySBMzVYzB0nsCLhQNZD:eafi31zHB+eZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209584, "uuid": "f70755ea-e550-44a1-ad8d-9f602f81cdfc", "value": 280720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209584, "uuid": "f67b14b4-968e-453e-9b14-337fe9c46197", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209584, "uuid": "6f85fbb7-d7d2-4660-921c-a1d210e6f134", "value": "redis-scand", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef1ade05-417e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777214885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214885, "uuid": "bd41fdd8-1814-409d-82e6-d3327697a491", "comment": "Malware payload (Mirai)", "value": "51016a5c26be92b9854f8a966d69f737", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214885, "uuid": "bbdca4b2-cadd-4dd1-811e-39f011981405", "comment": "Malware payload (Mirai)", "value": "497707c309049508e9bbcb11b67dfcb9f2801e1204c2d98c91f5c0079ddd9be4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214885, "uuid": "3f58214d-a1d2-49cc-a5f4-7f0ee57ae0fb", "comment": "Malware payload (Mirai)", "value": "cc1bc9aace8cb926f74d6e797ed285651e4c6a40", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214885, "uuid": "f0e598cd-6a68-4523-ad0c-2e4829a2f268", "comment": "Malware payload (Mirai)", "value": "df84158b2f329aff36aa8a409937041040c24efe610ff7b17bd6782337e803a28b434b5ef1124c6fec5ef8712e3f57a0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777214885, "uuid": "1126a127-2108-4f0a-aabc-1a3649c16641", "value": "T148733A46AA41D677E10320F111A6CF521171FB3F2422E94FEBA47C72EB29281E72277D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777214885, "uuid": "037a222e-c01b-4dfc-938d-05ba48140782", "value": "1536:/fJ+0WtS4ZRCOsylUqGF9rov+/AJvxuy9tpmin:/fJ+0WtS4ZRCt6UHF9EWMvxvpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777214885, "uuid": "871c8f2f-6b43-411f-9fcb-8a7a9915eaaa", "value": 73916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777214885, "uuid": "a07c4eff-7c40-4d3f-8fac-e60132fcc589", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777214885, "uuid": "18fd2165-b925-48e8-bcac-c110f26c1c87", "value": "xdf.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ec4f0a-4171-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777209157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209157, "uuid": "6acefd8a-3198-4c61-8a57-5372ad6393a2", "comment": "Malware payload (Mirai)", "value": "968b6f80c89551a930168f666bcedc21", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209157, "uuid": "e3e2639f-c48a-4d59-abca-7d52af367380", "comment": "Malware payload (Mirai)", "value": "4a7e7c9e993b6f599d61304e0c2f17ed735b31661f926f5becd86811d02ed0b4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209157, "uuid": "f3db6e3f-5a06-48be-bb43-c27b1caf97ad", "comment": "Malware payload (Mirai)", "value": "87dc7b571fb1ef8e3b5a470cd6e62152e3c7733e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209157, "uuid": "03a8f0b5-b898-443c-9e92-c0b47ea9978a", "comment": "Malware payload (Mirai)", "value": "928a2fb931287d4b2f32f8913f106cd24a968acf116510d80249b34b854a14f248b6a62969780887f950934ffb3667f0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209157, "uuid": "58ea2412-616d-4d1f-9c67-20870423e59e", "value": "T1FE930749FD406B10D8D635FAFF4F024973934B6CE3FA7201AA245B2523CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209157, "uuid": "2aac3800-966f-4690-b38d-e57dd0c6a8ac", "value": "1536:wqnZy8D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1Yvn:68NUv5nTacgzafVAwe4BNRIbT2gXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209157, "uuid": "f05945e0-cc32-4106-9268-f1c10a9a3630", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209157, "uuid": "af55b969-3da8-406e-8323-d4dc21fd236c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209157, "uuid": "0daf2561-f506-48a1-8536-c1719053d6d7", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb8716ca-4131-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777181728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777181728, "uuid": "2cfca8a4-c080-4b2d-9c32-cfc5aaa47564", "comment": "Malware payload", "value": "519e3cf95972a398bec9c5be8c4bcfb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777181728, "uuid": "a6852dc9-698f-4932-b6ee-337072d92f72", "comment": "Malware payload", "value": "4b11fb9a06da137e0054207a0e5acba04ecbe5dcba0a5e5350faddd8127f0c0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777181728, "uuid": "e0ae215d-0007-4531-9f7b-d25ef8f35d1f", "comment": "Malware payload", "value": "205877cdfbd7825c3aa1476954f28e555cb8ec5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777181728, "uuid": "43507a51-de59-4e71-9d2f-d4a9325be4be", "comment": "Malware payload", "value": "83c1923c9164d5c485ef011afa8fa0e30be45fb1e6cef358c39661415a119fe7d8917338cdfe3dc5f04a154d75cf22d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777181728, "uuid": "ae17230a-032a-409d-b7ce-464575c01f69", "value": "T1645423918C1354E08B6F16B448EF3A102459DE9B89E43C43B1AB07B2E27D51F2567DAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777181728, "uuid": "57b49aa7-675b-48dd-b0e1-0b21c84c80b5", "value": "6144:3xkJpbwJgC8VH3TeJ7yoEfSHqYEFwG68r+HrmBCRjl1U1g5vs1PX+FY:hkJhXH347yoESKpFwB5RJ1n5iPX+FY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777181728, "uuid": "9aa856ac-0cb7-4f2e-b2dc-775db19245ea", "value": 292904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777181728, "uuid": "fac3da69-5633-479d-a513-c6e3d8e80ebd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777181728, "uuid": "0cc3aa7a-1dd4-4922-b89a-94547613e942", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e16e75-41b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777237011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237011, "uuid": "64e14a2b-766c-496c-8730-f44c539f907b", "comment": "Malware payload (Mirai)", "value": "bc1851e95f51d8b6c62190737a303b3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237011, "uuid": "aba1e1aa-a38e-4cbf-b8fa-261c5af2b728", "comment": "Malware payload (Mirai)", "value": "4be118ffca9ab94b46de85a00b487b2cc3f6b33d13100a08b5c8f41149675ccc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237011, "uuid": "01a31c09-7725-4b04-b89a-ce6d88fb2659", "comment": "Malware payload (Mirai)", "value": "69f4f3342a2fcec3d32484d470cc1c2b0e125870", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237011, "uuid": "2de0d613-803c-42e9-a39c-67dfdb81fd19", "comment": "Malware payload (Mirai)", "value": "77c4d64bee3a5149607d73dd36bb3325d856e25e5aea01d48d3185b2ca55b2559b6e02da8c1c043d9a802cd1735fefe2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237011, "uuid": "53edbea5-5687-4382-9eb7-44a942c62133", "value": "T1DC9329C5FE8BC1F6D81B883050A2F73FDA32D8A94071975DDF5A9E35DA33581A212389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237011, "uuid": "cc63c93f-632d-4166-9cba-bdd2b9be638f", "value": "1536:LeILjvCk0W/wgInu1y+HpGwzh5IRWSqL4BylSq7vC0vMW8:Lef1uwfu1y8pfzl1L4Bycq2W8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777237011, "uuid": "b8e14b58-c1fa-4d6d-b27f-f8941f3a3ecc", "value": 91412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777237011, "uuid": "d0681856-eaaa-49a3-986d-dd75d70a345e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237011, "uuid": "1c381af7-96ec-43c2-bfbc-b32f347d1893", "value": "023782pler.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f65eaad-412d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777179962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179962, "uuid": "76671cc3-299e-4e8f-b3a5-c4076a313833", "comment": "Malware payload", "value": "ab31a01d511c3f6e0f7221b574f8653a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179962, "uuid": "68f43574-829e-4bf3-83c8-825ed7dcd780", "comment": "Malware payload", "value": "4d6f380b6a3ec0d310b3836ef1ab779c5a187386cd13a6389e8b69031e86642a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179962, "uuid": "af05916a-e7c0-48a8-84f7-b72c70d48620", "comment": "Malware payload", "value": "387d5042850b7d8f6705a710dad88ed65b83f752", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179962, "uuid": "35c9a282-7a7f-47f1-bbc4-e471c871bef2", "comment": "Malware payload", "value": "103f333eb89917e6ffd405ed11ff2ff4c088a9767b5dc368ad8759d7acc536591c95702a14b20dcf9f7c57dabd76d4df", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777179962, "uuid": "56c7cd18-0052-4d30-8f13-1144ceb4e6a2", "value": "T1BFC284BCBEE3012D3165A99265D44283D83E37DB750D7F8F088A83E54B53A0DE969C1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777179962, "uuid": "52df9428-6413-485b-aef1-6a64a33efa5c", "value": "384:BtU/sgmx3QQoG4a7fQF0Gy/B1/QD0Udg13NPTBL0t2S4sH0ZrKMuIRWODAKEd5cx:575BgKWwR5SUheSWQVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777179962, "uuid": "aa8cb510-5c65-4501-91bd-b29f852439f7", "value": 27536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777179962, "uuid": "98859139-f093-4537-8e42-fc5334aef872", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777179962, "uuid": "0fdaf905-be02-4b92-b2ec-0cae0b0da96d", "value": "msedgewebview2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511dd366-41c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777246833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246833, "uuid": "862445bc-c775-42e1-9d19-b56741cd0e67", "comment": "Malware payload (Mirai)", "value": "2003a86c2e6c7df3568f64f8e08078ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246833, "uuid": "451fa4a1-867c-4609-a387-453458f980f4", "comment": "Malware payload (Mirai)", "value": "4d992bc8bee14aa48c50724f42ac2197348557daa8e637e0f378d9502b5d5e5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246833, "uuid": "ed440c88-ac50-441a-8170-52fb205ca334", "comment": "Malware payload (Mirai)", "value": "c9c7cfa3ad66a8494dfbae5c2a7a33f4ac6680cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246833, "uuid": "b22d30e9-d750-4184-bb3b-68babee0d487", "comment": "Malware payload (Mirai)", "value": "b70cd147b26219aa770fcf6858ae5069e1fb71ca2621f6db398133192c305a839f936d8dada4c71f5a8612690f317734", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246833, "uuid": "0ecd9e48-c197-488c-8f67-683beeccb782", "value": "T181043B466C92CE13C5C127BABA5F415D33326768D3DB73028E246F782B8769E0E3B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246833, "uuid": "46f1f0b1-8f3e-42b3-8d3e-f512206e57d9", "value": "3072:RUKrZJEix7eXZAiEXGZbEDqnNO8C1Sa44p5a7hHDOjS86Ud78lWFld:RHZJEixtX0Ap1Sahp5JG86URGWFld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777246833, "uuid": "a0c81367-d200-460f-ae8c-642340430d7d", "value": 177035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777246833, "uuid": "64dac2d9-8693-456d-bfb1-cb023666176f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246833, "uuid": "82263a05-c602-4e39-a91b-5020c140e516", "value": "Yboats.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba1c6543-41cb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777247868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247868, "uuid": "71e92908-1654-42df-ad82-dd395f6f718e", "comment": "Malware payload (Mirai)", "value": "275caf3c67dd9bd22ad51d491e21d975", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247868, "uuid": "c50dac0a-045e-47a2-99fa-149f2369a0ef", "comment": "Malware payload (Mirai)", "value": "4dfc4b56da42b47dafaefd6e3c15272cf64918d6ee666957f126cb652e7b2312", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247868, "uuid": "122c66a9-c4d0-4d20-82cc-94b40e625a4c", "comment": "Malware payload (Mirai)", "value": "27ac84c457e951a4d2891f62a041aeccafbf9b16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247868, "uuid": "93413953-974e-4913-8e56-d5a644f12e63", "comment": "Malware payload (Mirai)", "value": "0e299aeced4f753599e7030c74169b1e118d46bb5481ec0a6998f784274f2144202580eba87786436a59890b71069e7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247868, "uuid": "4f60683b-687e-4b56-817e-920c9860b63f", "value": "T136333C4DF783E0F0DD4B0571115BF77E96349E025124DE7EEB98BE62AE32A027117618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247868, "uuid": "91bc885a-7d73-40dc-b18f-2d0a6bfbca74", "value": "768:9wheNR1eCZWUJ2S7pRflrFWwqTlFNB5azjYvzNeVMU2331ANA0B7RhuqDV98QN+s:9wOt37pOzwLMU431ANA0BLBCUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777247868, "uuid": "e0b2c732-e469-4d71-80cf-32524689dc62", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777247868, "uuid": "fc54403a-4950-41ec-af0f-427622fd53f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247868, "uuid": "50cdbadd-3ff0-4e8d-9cb0-54bc2b720bcb", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b734d639-4171-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777209208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209208, "uuid": "e88eabf7-aa6d-415e-a8a7-72c42e264db4", "comment": "Malware payload (Mirai)", "value": "15ebadc0c04ec3fddc021e17494a3f35", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209208, "uuid": "363fcda4-df3f-4e46-be03-550bf27f1315", "comment": "Malware payload (Mirai)", "value": "4ed35d1aff577d32fec860d41171d16f234b991e46f42fd880d683eeca1f6cf7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209208, "uuid": "1ec141b3-41ff-41bc-8deb-dbb101717f61", "comment": "Malware payload (Mirai)", "value": "aa10b2b2088ef86da855b70e5522f6bf92a3bcef", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209208, "uuid": "ac083bd3-1463-43e7-a7f8-cd0972373459", "comment": "Malware payload (Mirai)", "value": "fc7d540ea998dbc0682ad7b4f59cf58e15b9e6eece1cac4e6e259751560d04f754848d9149adbff34fdf526bef686ef1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209208, "uuid": "4084089c-c672-4b78-b2d4-79d4569033e1", "value": "T1A9C32A05B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209208, "uuid": "706769cd-90a2-4f6c-b9a7-57f75ea56a30", "value": "1536:6cB72AZ4ex10JrZqQ7UrZb6wI0vAnjiLVRuzae8Dhq6N2te5f3dBJ:6+B4exMF7oZKJnCNYaPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209208, "uuid": "1ce169ae-31e9-447c-af6e-668de563f61f", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209208, "uuid": "c65890b4-b11f-493b-8202-082943134c34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209208, "uuid": "10a01658-fe6f-4e8a-9b53-94f73851494f", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8658fb-41b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777237003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237003, "uuid": "66d40957-fc8a-4825-a946-eef9f052e53a", "comment": "Malware payload (Mirai)", "value": "33b83a167613e04dabb694477550c923", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237003, "uuid": "3c30ee10-269f-43e4-8719-e174e60f912c", "comment": "Malware payload (Mirai)", "value": "4fc1e2c22ce60c7afe44c1f256162ed9e7a5fa98949ea59d4dfccf8ecca742b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237003, "uuid": "8aa6b9e5-a599-4cf5-9e02-79366b110434", "comment": "Malware payload (Mirai)", "value": "a3349b722538896a55afc47e26ccae1f0ae72da4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237003, "uuid": "ace540fe-faf6-4c39-911b-4cb79a2b8e58", "comment": "Malware payload (Mirai)", "value": "f85199cb493a81d3b81c41ef2792c98f0d5017a07233bd03d2b26a865a0de6cc64043de0249e16cae3ed8916eaae32d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237003, "uuid": "7465773b-da43-4f04-8702-27bec69bb69c", "value": "T198431981FCD28A6AC6D0537AAA6E358E3361B3E4E2CB3207DD184F1533856CB5D66B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237003, "uuid": "e5ff36fb-a0e6-4454-b9ab-87b830afb989", "value": "768:lyh86kdIJpjGqnQ6HsR5z+qQf4smJh+L5QuIp9DKuHO9brBlbJDXzoMdFiTy9Mnn:qkGdGqQ6iUf4sdQuIp5GbFlbpXeTy9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777237003, "uuid": "2176178b-faa3-4dbe-9d57-a1e15972d9e1", "value": 58812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777237003, "uuid": "205a8d74-2793-43da-ba9a-fea587696da7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237003, "uuid": "0532bfdd-cf18-4542-afb1-a3ab27a21fbd", "value": "023782pler.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282fec6f-41c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777246334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246334, "uuid": "329af540-6eaf-456c-b19b-7952bad542f2", "comment": "Malware payload (Mirai)", "value": "b2593eff771b2e3eab3aaf0a6abb91c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246334, "uuid": "421f789d-89f4-4f62-b43f-264b1f1e1c30", "comment": "Malware payload (Mirai)", "value": "5004b1461ffb2d478a7dd842e404f3aff5b713b85ee4cee8f77a7b303cb05969", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246334, "uuid": "a266130b-104b-441c-9a00-6a2cbc23c32e", "comment": "Malware payload (Mirai)", "value": "4eab04ecb407251a280f1b6433f96460b22fafdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246334, "uuid": "edd9dfd7-0756-425d-ae69-894bdd3181ca", "comment": "Malware payload (Mirai)", "value": "b72b9e5cd9a39826b958d167b573e3f56ed6c48e4aaf632d7944d81b69e8559ea84e8cbd89a0a66e0d7d94c1ee51c2fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246334, "uuid": "9f49ff43-6a39-422c-9dcd-911a02692775", "value": "T1BDE44A56F880DF62C5D1257AFA5F8268331347B9C3DB720689189B383BD782F4B3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246334, "uuid": "2bf5f625-39b4-473f-acd9-a0eeb3d531a9", "value": "12288:MN6tMu4S/TVTRojsQMhKUIskDahNpvlxgpkItQekopmaiPd4lqZ:MNo4S/T9m2osmazpNe62mai14lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777246334, "uuid": "1bf5b649-b69c-4fed-bb2b-60ba97f3f09a", "value": 667540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777246334, "uuid": "793f37bb-1a3e-414c-a4dc-4a26e4936336", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246334, "uuid": "9922469d-6420-4820-b1c7-0e3ff80e5b8c", "value": "agent_armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3ebc8b-410b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777165252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165252, "uuid": "149b2b58-2c17-41ae-825b-e4335e822a86", "comment": "Malware payload (Mirai)", "value": "18ee9fc78645260db4f746c8a10616b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165252, "uuid": "0acbb583-af08-4490-a489-6eff13dea2b5", "comment": "Malware payload (Mirai)", "value": "50a94147155c4cecdb814a1beada914aa2b0aa070e635658b1cf08608cd87a3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165252, "uuid": "63377159-df24-4c00-adae-230c13b5d00d", "comment": "Malware payload (Mirai)", "value": "21c4a2bf10a768fa1fd9f347caeffd793ac25151", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165252, "uuid": "6e0e6ba5-2b07-4e05-a9e0-4ea205128898", "comment": "Malware payload (Mirai)", "value": "14ab3c6ab75739a0ba7f5f0a82c8bc9e8253dd51d1992aeba55c867923ee5ddc5edb8cf0146067d571e6a0ead6a50c87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165252, "uuid": "0a1df63d-ae76-420e-9834-bdfbbd08b539", "value": "T1727302BED65ADD09C8BCD73C05F76E275AC862F64356A2F08760F805949708FF4982CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165252, "uuid": "fd7028de-b04d-4338-a2ec-2e17d0a32417", "value": "1536:nkwuRmVi+RluYSSCuu0Rf0CzB/oylk7Ch+y1Ev1gLGGsNO:HuRWi+Rlh+uutCd/oyq+h+yiv1gmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777165252, "uuid": "133861b7-42e9-4045-a212-e21649b98091", "value": 79204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777165252, "uuid": "5886b9d1-2563-4ea8-833b-19bbac1a383f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165252, "uuid": "659435f1-751c-4047-bf77-c1704ced686d", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b4b8e0-4172-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777209560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209560, "uuid": "5494a2c9-345e-45de-b117-1872f17f3339", "comment": "Malware payload (Gafgyt)", "value": "85cede4284367e5816e19774553fa18d", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209560, "uuid": "3d4666e6-519b-4389-8a9c-571ad018ba7d", "comment": "Malware payload (Gafgyt)", "value": "50cb2b1370a65b5295d6c7ab1f0dc12a4febcf0a55ab16609dd2febb6f58713f", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209560, "uuid": "a271d7a8-818c-4828-9825-cdedbb6e8f52", "comment": "Malware payload (Gafgyt)", "value": "09bd621d1462b2a6e58d335e85caa8d0d26b4614", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209560, "uuid": "647d7770-4c9f-4945-8be2-e7ef94a4243a", "comment": "Malware payload (Gafgyt)", "value": "c75777d3278a455ed176c47a18580840f298c0afeb336ec9cbced141d557b345215aa7eb6cde23a09e41fa242d2df932", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209560, "uuid": "76fb797d-3f99-4a5c-a647-63bc68d9b155", "value": "T12CA3121BE6545E69C97039FDF0B9375CA86C50DD9BF862DFEB624BA410DA08200C6B38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209560, "uuid": "029774b3-1514-4ad3-8731-5cfabcb06c23", "value": "3072:EzbqrIGlpY/u4QKIkHudZTvc2WCWDbqUVo+gTe:EzbGlYvQWHStLID+UVo+ye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209560, "uuid": "23f918f8-1c9d-4c78-9026-f929370ca6b6", "value": 104476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209560, "uuid": "7fd00264-80f9-408d-abdd-478a0047a326", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209560, "uuid": "cc629464-8a40-4164-a8f8-d96636cbd897", "value": "redis-daemon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dca5475-411e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777173302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173302, "uuid": "66d70e7e-c4ce-4bce-8475-98e114d02b91", "comment": "Malware payload (Mirai)", "value": "201a24bea53894e63804c4b2ca6b07b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173302, "uuid": "78b7f1b4-5804-4a05-a3fb-2136149528c9", "comment": "Malware payload (Mirai)", "value": "51a5da3ff8e7a94bda75ecc326a77f39286327ca5d31519798f5319f8337b4c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173302, "uuid": "181dfcdc-4796-493e-9bb8-2278286051ba", "comment": "Malware payload (Mirai)", "value": "f7252e6bb2cadc375ebd41e3966c482f0d31dda2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173302, "uuid": "85f310d0-c444-46c7-ad97-6429d1cf39ce", "comment": "Malware payload (Mirai)", "value": "d5154ac72d6c1d0ed5cf009d29a6f903daad5dcdf3b6642eef515dba46e0f705a92490d3a19b9bda9e3e4055610c40e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173302, "uuid": "8df5c680-a27f-45c7-bb9f-0f6bf35218e1", "value": "T159C35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173302, "uuid": "0e320b80-154a-4a90-bb3d-e45772ea851a", "value": "3072:cowpuQyNSG2lRa1styK9flTQPHo6rScVM/9OAvjik:cowpuQyNSG2Xa1styKdlTuI6rSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777173302, "uuid": "12b05fe1-6a41-4a64-8c7a-7478afad6333", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777173302, "uuid": "9eab9446-3fa4-4df5-a198-1a5764b093a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173302, "uuid": "2a9c8efe-4f6b-4844-9a36-b60f3965ba96", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2170fd9-411d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777173229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173229, "uuid": "2814891b-d7f5-4dbd-aa1e-5a44b47d50d5", "comment": "Malware payload (Mirai)", "value": "6f0186c08c71fa87d1269024d571d1ee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173229, "uuid": "2e0a0629-79bd-4aff-b803-19ca59c0aec0", "comment": "Malware payload (Mirai)", "value": "51ded53ada4aa9512fbd980e2e8f963a747e36c0e882dacb0919ee42c47f13c1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173229, "uuid": "0a2197a6-927f-4950-ab5f-3a7be3ccf40c", "comment": "Malware payload (Mirai)", "value": "ca9a796f0d7202d168cc48251729223ca5411e0f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173229, "uuid": "6afdc66f-bd90-4584-98c6-c6dae391a1e4", "comment": "Malware payload (Mirai)", "value": "9378f038f7b77caf19231567998f1d86093d6f67b02d79a9af7eac0e6df644f024a1898b2f2c75759699bbb4d88a8418", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173229, "uuid": "3c630fae-13a6-4656-8ba2-cc95532f623b", "value": "T17523F2304227DEACCE7024BCDA9C8783B0E19977F2ABB612512546BC3E915475B7EB07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173229, "uuid": "1c792012-9435-4241-800d-6f23863940be", "value": "768:a/TYCoIxdEzIvb+ufzLRXCHrbJZpR5K03NG3c9q3UELbUXfi6nVMQHI4vcGpvR:aECFUdwRSnJZv0eOLRQZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777173229, "uuid": "c21d7a99-c74a-4f4a-96e3-a4d226f1a31b", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777173229, "uuid": "8957f6db-4b4d-4cf0-ac07-8d11c311e001", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173229, "uuid": "fadea14b-d59a-48e2-8217-1d7c715c7d11", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7830b844-4171-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777209102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209102, "uuid": "1e54cda7-584c-492c-8260-cb55a1fee5a1", "comment": "Malware payload (Mirai)", "value": "0a15df5d380bf47811a64f12ce4cdc6a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209102, "uuid": "b2af6d49-19c1-4787-b722-aa37f1a9ca8f", "comment": "Malware payload (Mirai)", "value": "52cb6742782f36629fc8c2cc58692b9f290a2339b670bf7b35b5794fb1183506", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209102, "uuid": "fc0115c3-2ccf-4638-86ac-af86d88cc6ba", "comment": "Malware payload (Mirai)", "value": "23c741e5e3b0b523cf4571f512034aca41688ba5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209102, "uuid": "6de568e4-de42-4d0b-a63a-6256282fe017", "comment": "Malware payload (Mirai)", "value": "7091bc05054f70b94bd2ede02ca8166d080128a841644e0ea933d5cc8d7fa5c677dd1f734592899d31112914b500ea21", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209102, "uuid": "5e6bc987-d7ab-4a80-bab6-db0bc9947108", "value": "T11BB30945F8445B17C6C666B7FF8E438D7B2A1758E3EE720399256F30378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209102, "uuid": "9330aa35-7107-4a77-a3fd-f51e83985a8e", "value": "1536:p7jnPq8azP4V8YOTIBRvyNOzIuSIwYeFWd/lk68wywlQ3Ym3Tb/V1oEakCxH:lzPqF41OUBljSIxecUtCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209102, "uuid": "856ad6ae-e9a4-4c9a-ad4a-76a0c67a5ed9", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209102, "uuid": "f6f4c2a8-20fb-41ed-9098-6c78f65a25bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209102, "uuid": "aa13961f-463e-4483-af5c-d5a7c8ce385b", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91cc1044-4171-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777209145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209145, "uuid": "46bf867e-9b27-4341-96d1-419694be9c80", "comment": "Malware payload (Mirai)", "value": "cb3d18fd54751159a4d6f611e4861c9a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209145, "uuid": "e86b4f41-bb13-423a-ae9f-7bd4cbf83f35", "comment": "Malware payload (Mirai)", "value": "5308a3b6b0cbb5d254545ebcd0d359ffb706f46246f962c579123451f27fbdc9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209145, "uuid": "f64b063f-ea5f-4750-aaa3-2316730af226", "comment": "Malware payload (Mirai)", "value": "5157567b50cfa81759bb3a5955c861457138afe2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209145, "uuid": "a68c8504-28fc-41ef-9277-ddfa223f81bc", "comment": "Malware payload (Mirai)", "value": "e31d29260b4af41101c38c3233fd18c8875d65c45ebeaeacc38c0acaab43739a21b2cf92a4af3befc1fa171533a6cf70", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209145, "uuid": "e235701c-7afa-40f1-95f7-8d5557ef54f8", "value": "T163D3F8C7F900D9FAFC0AE7374853080AB230BBA545925A372257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209145, "uuid": "dbd964a9-b09a-41f0-a7c8-9af9ef309d9d", "value": "3072:qNbul4MGHJLqHy5Fut5K/cwpifdDounVoQV1jbiGLD3rQ4J:HHy5ct8/cyiWuVosLDhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209145, "uuid": "497799fd-392a-4133-80a0-050a5354a57d", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209145, "uuid": "8098168e-1dcd-4cf3-aef1-abd9678aa829", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209145, "uuid": "eeab70eb-4440-49e1-8dc9-4daad7febcb5", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef534ab6-411d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777173225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173225, "uuid": "e8e663e1-39c7-47fa-b05c-13f09fe477e6", "comment": "Malware payload (Mirai)", "value": "b02c01acb19a26c0ee4091eb305cb31f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173225, "uuid": "51d58c8b-35bc-415b-9899-7b2aec868612", "comment": "Malware payload (Mirai)", "value": "531204cf8746ed75e686809a32ae7968a66d5eb26753fab233a28f334f0d35b2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173225, "uuid": "9e575954-6444-465b-a8d7-3f2e089e431f", "comment": "Malware payload (Mirai)", "value": "e1fb56011f248ea560c6af17e55018e01596488b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173225, "uuid": "9f49091a-868d-4583-9170-cde9fc83f4da", "comment": "Malware payload (Mirai)", "value": "a974cad16bafe9bf529b95bd183acb0d3e1ca331415fe705ccbf9f32bde9c4eb79571f911b8efe8bdccac35f82ba10ce", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173225, "uuid": "c9cf5fc7-b613-4022-b590-c0e2210f70de", "value": "T164C2E171FE51FA32C8102D77D57E8DCB4AC64F7CA1FB78732A610C202AC59C65691693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173225, "uuid": "fb1c43c0-e6dd-40d6-973e-68a37a23e351", "value": "768:JMKyhegCCMqfDHSYpq/B/TuA0yldOT/k6q/F9q3UELug:OKy4qfDHhw/Tu6Oz8gLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777173225, "uuid": "b0078ebb-02bd-44b9-9cd6-1009e46c061d", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777173225, "uuid": "f6158090-d03a-4cd3-9e7d-a029dd568550", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173225, "uuid": "7d838556-1086-435c-b880-02cb1da53b85", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d0b18b-41aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777233412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233412, "uuid": "f314cda0-ba0d-4f22-aa28-a8fca79ab245", "comment": "Malware payload (Mirai)", "value": "3f7a418556414ed4d080400174ee375b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233412, "uuid": "e20570f4-93f2-464f-bae7-5555f4eb1ec3", "comment": "Malware payload (Mirai)", "value": "537e97a2c256e5ef7eeba26a40518079d3db1ab3a99251f7d4b89295627f4737", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233412, "uuid": "35914df8-cd7d-4caf-8526-244507ec19b7", "comment": "Malware payload (Mirai)", "value": "1772bbdc90f3e2e6db023b164f9953eb4c84a40d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233412, "uuid": "8a551938-64e5-4727-8271-4a9754c23d13", "comment": "Malware payload (Mirai)", "value": "7bc56d267f39382349c7779bd5ba8dd6993522d000ab43d6e0bb587d50e1d9ca6316433cdacf8d67e883a278c2d5a0ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233412, "uuid": "9741424c-88a8-41cd-b5cb-f40691c1ddfd", "value": "T123431780FCD2996EC6D4137AA73E358E33A1B3E4D1CA3613CD585B25338A68F5D66B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233412, "uuid": "3b0c2f13-5597-4aa2-be86-54cc0a6a06dc", "value": "768:ncyi0+MnuAHIf/StW3GvQoyjEFMoRBN5cDqS8kTIM4cL/KIoNRit5ZMfgTBN1TWD:n3nzHI36AGYDEFMWchcMLL/Kqt5Z79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233412, "uuid": "996c36cd-6fdb-4b5c-a129-71cd3e5a2438", "value": 55884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233412, "uuid": "c8d31b6c-6c44-4df7-b8c4-7b075f3d27a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233412, "uuid": "f00fa0b5-a2d9-4d4c-a9b6-6b7ea7750ff4", "value": "luxzz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffdb4710-411d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777173252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173252, "uuid": "cf706fba-a3bf-49c3-9151-8492c355d4de", "comment": "Malware payload (Mirai)", "value": "f4e299d1b180979228826f4f33af0d57", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173252, "uuid": "2ac6c383-07e3-4c92-b8d4-a3a002b98bad", "comment": "Malware payload (Mirai)", "value": "5448763c8ac93e6b807ac41778796a45a56ff872c65e37ac1f12590f5a14afd0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173252, "uuid": "c26068fd-a284-47fd-a69b-df108b868a33", "comment": "Malware payload (Mirai)", "value": "82f6c1bf77aa959be25061df2fde3fcd0ef44363", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173252, "uuid": "4a71e8a6-7a1f-4563-9e4f-794e854b284c", "comment": "Malware payload (Mirai)", "value": "556cc5fa09c8200561114658f8c1f8aef71e9a6e875f9bb88d9de955b2589ad0c9045699af861f67b7122e56debd200f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173252, "uuid": "0a129e50-e265-4932-b50c-cffdd7a61fca", "value": "T17B336C36E029DED0C6560134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173252, "uuid": "481323d3-cb49-4c83-9636-e8d128dcdfb6", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9dm3CZQoV/bnmCozw:Oa4U7G7SvT6ftBQm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777173252, "uuid": "d8a34ef1-d71b-477c-b194-71735033876b", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777173252, "uuid": "2031ec35-f33f-48a0-853f-21cadae6521f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173252, "uuid": "d269c860-a4d3-4247-a060-78f2907cb3ee", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ce807f-4193-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777223785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777223785, "uuid": "7291f445-0b02-4328-a1e8-ea0ffce262e9", "comment": "Malware payload", "value": "58cbccb0691b950bead732f9e2a563c1", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777223785, "uuid": "fc0842e1-0dac-4368-988c-ae4f31380371", "comment": "Malware payload", "value": "54b9dd7abfafb0f4c6c909d163890dba6f8c546ee582c1163547b73c679bbd0b", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777223785, "uuid": "e9c43908-98f7-4462-8b25-45353cfd77e1", "comment": "Malware payload", "value": "b1f6e1bff77e72b6313d88926f0c86c292a3cc40", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777223785, "uuid": "9b60c595-f719-4acb-8278-0b03b6287543", "comment": "Malware payload", "value": "45d18f955a97c648d3371fc53457d1e7e30a874da85706231302de8de947036a08200cb9fc94608a763566125eb03bea", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777223785, "uuid": "04e17708-5ca9-4f9f-baf6-a7934289396e", "value": "T19DE42387AAAAB9740A4C5238783BFDD91F48CF82C564D896F3E005E3057B715449FCEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777223785, "uuid": "840d4346-0ea7-4d53-b7e6-e8c182b640cf", "value": "12288:80dqrCvzvb7UXyCVU5Fp/LvIO5LkbfqB/j/Evhfaw+MzsaDxJ2W1En2iCw4FS:Xq2myCm1H5GhhKW1rB9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777223785, "uuid": "30171282-4f60-4347-baa6-962a1a2445ec", "value": 695837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777223785, "uuid": "c3509a88-f9f4-4519-a1b0-e6da5a353ed1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777223785, "uuid": "f463956d-b774-4d48-a1b1-543f765959f4", "value": "ps_j1qbUrLFeZrh_1776251937903.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79722e1c-41b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777237022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237022, "uuid": "45e4f9f5-6ea7-4d31-92ba-aae044ea4cb0", "comment": "Malware payload (Mirai)", "value": "052960e48b91993763296d2b47a06e25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237022, "uuid": "fab60f23-d31a-4608-ba69-b9a5c11b1faa", "comment": "Malware payload (Mirai)", "value": "54db07e41463aeb517be15b5e59aa730d361a8368e01af0067ae222527ecad0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237022, "uuid": "13347088-dab8-4e69-b30e-4a27a1baf2af", "comment": "Malware payload (Mirai)", "value": "dfd3311c67bd6f116d87a00a27bcccfcfae217ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237022, "uuid": "9df8438d-7a02-4f22-983e-eda92c6bfa26", "comment": "Malware payload (Mirai)", "value": "090b587dec80e74bc48e0bab9d746c4dd614c4819a662907d31343a33ed3b5d62494b322cfaf3868386055d3611859ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237022, "uuid": "7bba8dd9-160d-4a73-a78e-fb0bea151454", "value": "T152A32B4AFC815A21C5D512BEFA1E318E33135778E2EE32139E145F21738A6AB0E7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237022, "uuid": "53a0df20-94f9-4679-82f2-e189b9bf4047", "value": "1536:wAn4GGQP6neA5tieGcBiWRqwZo5N9s9U4XGbaOIeNgXMDeiRMPWm0AJzc7e05IY4:0GazRasW4XGbaOnMPWm0YQi0iLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777237022, "uuid": "645b5d68-5386-49da-a231-1d836e2848fe", "value": 103900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777237022, "uuid": "0519492a-0c42-4b44-9d2f-d68f75b908ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237022, "uuid": "c05153af-0dc7-48b5-8cf3-d219372b3fc5", "value": "023782pler.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fa9e78-4167-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777204668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777204668, "uuid": "f4f581c2-3423-477d-b4e4-d8ce6e6d0a2b", "comment": "Malware payload", "value": "9ee89fae5f956c3078dce8529be7b610", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777204668, "uuid": "02656650-de9b-45d8-ae7b-4add80bcc673", "comment": "Malware payload", "value": "554f7aebeb463df7ddabaed0c0bba59fb5cbf02322323f609eb994da2387e24c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777204668, "uuid": "4df4c3b2-b6f4-4b4a-90cb-0eaa3f70e580", "comment": "Malware payload", "value": "13295efbd64517094cb665c2303d0be2307296ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777204668, "uuid": "3e690ce1-0d03-4cde-9c89-4613a522a01e", "comment": "Malware payload", "value": "966c436690c582433b8136336e5b97946cda746efa5e47710c553ac388448a7c49c4b27d93d0fdd0f36f1d31901ab8c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777204668, "uuid": "b35011f3-1e5e-4659-8c68-a5a54375b1a7", "value": "T12A269D75A2D900E4E0A7C03CCE929A17F67278151370E6EB5AD08F661F27BF15A7B321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777204668, "uuid": "07831865-8b31-4d83-9e32-a747d630931c", "value": "c0a715e427bbfe686c32dc8d5340b76d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777204668, "uuid": "4898716a-2699-4f0b-8131-bc7ee0dbc9ff", "value": "98304:ngdluHYu+jplx0is5bOvxY8oCzaFLD4SBX:ngdluFFbOvxY8oCzaFLDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777204668, "uuid": "59099b92-fb5c-4425-9291-17d701136bc8", "value": 4506624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777204668, "uuid": "117d0794-a188-456a-8ada-675023aa66ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777204668, "uuid": "b9cffbe7-4bb6-4f7c-a808-21a071b32112", "value": "xhgrabber.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ff0aed-418f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777221928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221928, "uuid": "ee8662aa-2a45-47ae-bab2-44a36450aa96", "comment": "Malware payload", "value": "f9c87df191a351b879db438f2c344ec6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221928, "uuid": "07826653-3bcf-40db-af85-4564afb9e20a", "comment": "Malware payload", "value": "55c3f6e8e3b321c66f56d2696c12a6d815e6dd12e695a04c31e1d67f5f9ccf2b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221928, "uuid": "1b4a4a59-8a1b-466a-a776-4fe352eef19a", "comment": "Malware payload", "value": "dd254f29258f6348322a3fee9548cd56fafb0f0f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221928, "uuid": "a2339da0-3f44-4796-84cc-42e2fc346cfb", "comment": "Malware payload", "value": "4b3788cf17c759e4688cbd8b0f87d6ecc2097afe49fc4bf907bd1ce5506342550100102ba7e8a8af9ddc5f4313c7d7f9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221928, "uuid": "02ac6d00-749e-47e6-964d-d244d1540742", "value": "T15E54955065C13995CE87A2FD0D1D9D75CE040D3FEE5EB58938AD1DEF06CA8EAA221BC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221928, "uuid": "2c34f770-324c-45b4-a9eb-ae72783e4dc8", "value": "192:h0v9w5rLN0oeciZ5llF0hMKjfwvjKjlvc0Kjg0emoGlsWYvSPW2KgBmsu2q7a0JB:DIcl7xO1YuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777221928, "uuid": "a9b8b9cc-b40e-42b6-b568-1a1226fbc419", "value": 290720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777221928, "uuid": "b54197a8-4a35-47f9-aaa8-0086f6ce26c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221928, "uuid": "04d0cd45-b4f4-44e4-a845-9fa28b371c7b", "value": "audiodg.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7759ae05-41b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777237018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237018, "uuid": "86a6e7ef-c97c-41f3-b734-1b71270b2cf9", "comment": "Malware payload (Mirai)", "value": "791da572a865c1c9150ae3120f56a4c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237018, "uuid": "3df1e9d5-88c0-4314-8ba2-4c9646a4a537", "comment": "Malware payload (Mirai)", "value": "56cca6e8830a51e003130b41183a313ceb7ae9f3574ef3f32f8cfc9168607a51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237018, "uuid": "529afb69-a09a-480e-916c-38d678671e49", "comment": "Malware payload (Mirai)", "value": "8b6454dc5d102e02b4fc941d869d8b2c47fda7cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237018, "uuid": "793c2e9b-655b-43b9-9de0-e70af1b06990", "comment": "Malware payload (Mirai)", "value": "ef8f69f95f59dff4c6a4aaf1f54bf60136386a05cc786bc2d7b4e6738f7b698b665e3feef65cbc981d201f68bf4d3626", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237018, "uuid": "90a8e761-9e33-44fe-b429-e1b39864521c", "value": "T18CC3D709BB610EFBE8AFCD370AF9170125CD592A21A97F757630D818B24B28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237018, "uuid": "f1482f0a-4360-4f99-899c-6ba4daf02e27", "value": "1536:pc6aLsgPDV5dtdbwTNcEUPt6YRZlgMMMExsFefF1gH9jZW9GTd1fzNZqfMw:q6u3dtdbeNcEUMfbgdjbp0Mw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777237018, "uuid": "88ca734d-4350-4600-85bb-18761b84cddd", "value": 122076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777237018, "uuid": "4b07968e-3046-45d1-b84e-7055cd8715d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237018, "uuid": "088d2e30-f955-4630-a003-2b904a7be8e6", "value": "023782pler.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4210b0-4170-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777208681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777208681, "uuid": "8b589a31-a210-4952-8dd0-9f5e9d37e165", "comment": "Malware payload", "value": "52d875709005c10a1159de5100c0c0ad", "object_relation": "md5", "Tag": [ { "name": "doenerium", "colour": "#0B5182", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777208681, "uuid": "9cfa634c-dd3d-4103-bf0b-35076d541336", "comment": "Malware payload", "value": "571df440a0caa9ea30023b1e7e21a2661263018dadaba6438eb82e8e5173967e", "object_relation": "sha256", "Tag": [ { "name": "doenerium", "colour": "#0B5182", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777208681, "uuid": "258518ac-bbf9-4762-964d-d65d9d9affc6", "comment": "Malware payload", "value": "c9c7678cbd0459e89d0881d83c66549974a6fdb5", "object_relation": "sha1", "Tag": [ { "name": "doenerium", "colour": "#0B5182", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777208681, "uuid": "958e1071-9592-42a3-9999-a8229dc90263", "comment": "Malware payload", "value": "69d11da921fc5d34243e38ece802f6f5774ba893ed7b5050fd1e3f90ac314da1fb465462ab5298516994f6438e988998", "object_relation": "sha3-384", "Tag": [ { "name": "doenerium", "colour": "#0B5182", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777208681, "uuid": "c701be86-b363-4230-8c78-cde4539f5e13", "value": "T18DF7CF1663E112AAD577D138C79B6603EB73B40713308BEB329C43652F63AE45E7A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777208681, "uuid": "3cd14e9b-d4d0-4cca-beb3-4134e1b9e68b", "value": "9eba512b03d8cac8a6c4424e25e9f06e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777208681, "uuid": "ede76c5d-74ec-40ef-b269-51504961a086", "value": "786432:gdBeI7LfOCDsno80dguj3/oyngPV1WyVWPvjJ5ryqxKEPI1xzf:kBeI7yCDsW/oR1CbbR1IzL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777208681, "uuid": "06054bd3-b000-4a39-a4f6-534a8293d7ad", "value": 71803842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777208681, "uuid": "f92fe050-c576-4357-8540-6649ebbf7fee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777208681, "uuid": "90223b2e-8a51-40d2-9f69-98516c4871a7", "value": "annen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7a9005-4154-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777196736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777196736, "uuid": "db33a840-45ca-4c6b-a93c-d858d0d11eb6", "comment": "Malware payload", "value": "9940d1beeebd4380658e90eae1493c6d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777196736, "uuid": "dc20c516-a8f7-4520-9804-8087a0124d08", "comment": "Malware payload", "value": "576b18a514944308df563a838cd7ceef6a3dd4fec974878b4d827bf6bbd37b30", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777196736, "uuid": "9db7b2b6-0204-4eee-8838-5a1c38e0071a", "comment": "Malware payload", "value": "c07456ee15d2c9a2d5cfe8c17d9b9f2dfc9970cd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777196736, "uuid": "7afe1387-9fc4-4250-9201-50921b93ddd7", "comment": "Malware payload", "value": "0e9ed5441895c61fb5b77ae833e220823303b702814936812a9b17e93d390ba17d5ce83e7a49ddd25fa3bb5ef7c70abc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777196736, "uuid": "4c90d42b-65e6-484a-abcd-006e64a68b59", "value": "T1BC417EF6FAB09C327829887DB85C60B698C70A7B08147A57E0D75C14363DE4AF115F35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777196736, "uuid": "af7d80ed-93ea-45fa-a85f-108233d26dcc", "value": "24:SPH6P7VzMnpsh6Ti26Jdw0omnOWiJUdddTgs6JBdvEc:Sf6P5gnisTi26JdNjdTx6JHvEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777196736, "uuid": "f1894f46-9047-4369-9941-8189315abd03", "value": 1925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777196736, "uuid": "d55eeb70-d928-409e-83e2-45e0a05cc730", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777196736, "uuid": "9e5a71dc-ab44-4253-b2ff-b6f1968ef5a0", "value": "576b18a514944308df563a838cd7ceef6a3dd4fec974878b4d827bf6bbd37b30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64c2cfb-418c-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1777220884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220884, "uuid": "71cbbf54-0b33-4ce5-94c9-7d6a9b7d1d63", "comment": "Malware payload (QuasarRAT)", "value": "ca2ce0c9bae82bc56982e214022be835", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220884, "uuid": "a5b50594-5408-495c-b090-e49be6ab0dcd", "comment": "Malware payload (QuasarRAT)", "value": "59b1dad8d2dbbd30536fab62c00589ee861edc365a0cb93c400b97150e4abf75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220884, "uuid": "9e918769-0287-41b7-903c-3f54f65e0834", "comment": "Malware payload (QuasarRAT)", "value": "5b412994ce596a7ce4db668fac7d00653e1417df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220884, "uuid": "de255885-8024-4e4a-bee2-44cf875057d2", "comment": "Malware payload (QuasarRAT)", "value": "5be039ea5a9eff06143fb58915d0b64e10fc53bb838569c5e52068321df2cd776b330af3b81db4e0c6065a0236de1165", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777220884, "uuid": "f4708c79-bab5-4507-8cb0-f01da0ccdabf", "value": "T177873392E32335EEC65BC1388636B5727D31F40C4235BF66E2A0A6723852F36E1BD615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777220884, "uuid": "5d6b3a97-2cbd-4fff-bc07-2a3997855793", "value": "4e09edf4d2c143776135d0d82a980620", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777220884, "uuid": "d2c86cfa-f328-4695-bff5-6265ea3aee9d", "value": "786432:8d8HS2ImjexmMSqVYzo59lqyFQqYXEMTFKB+gXJOM:XuKexlSoYz09lqyFQDKrsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777220884, "uuid": "c7e104f6-a9bc-46e5-82bf-f2fc6ee809d1", "value": 38102880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777220884, "uuid": "457ad943-f865-489f-8260-0ebc4333e5cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777220884, "uuid": "3a094bcb-3b39-4cfc-a758-f2c42707c1b1", "value": "Kuailian_vpn_setup_pic_x64.7.2.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d95c81-410b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777165236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165236, "uuid": "cffbe89e-7e29-4072-8089-555253bdc186", "comment": "Malware payload (Mirai)", "value": "7345ea30059499218fe5dd7faf12b1d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165236, "uuid": "16ff7089-02c3-49cb-a803-9d697ca369a6", "comment": "Malware payload (Mirai)", "value": "5b00f137391c7194b031b29ea8176e4131de58af3db713368d74635667667555", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165236, "uuid": "a710e2ea-3078-4250-9e05-d64c394d6093", "comment": "Malware payload (Mirai)", "value": "a27b93ca8ea8aa188c4368d231c2aa961024c9f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165236, "uuid": "7f264658-84a7-4abd-9277-b0c7a196cbda", "comment": "Malware payload (Mirai)", "value": "7d34e697dab77c75f5eb1baf8394d8a7f401e4e8646d1fabf6d1bd4d020f99aa7e54e2bb42dc1a310bbb8a19da82cf01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165236, "uuid": "b7ba2a3b-e110-4d7a-956e-5b53bd113394", "value": "T19363F1059A3E6B60DDA1AF31721B440437AFB3B9D567E2A9374083BC3F3C24676E1649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165236, "uuid": "c26ca942-33c2-4565-8e70-e2f860f3e384", "value": "1536:lizwndWTroYDAl3VAwdjM6CWPyGe3jlSjCluQMALyw5OcD1:lYwndkroYQ3VAaML9GQhSjCAQ3w+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777165236, "uuid": "c3e03a21-8de0-4675-9393-37751c1f67f8", "value": 68832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777165236, "uuid": "13ee5331-b701-44a9-a20d-e20ad1cd1401", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165236, "uuid": "47e30a97-9d0c-479e-847a-8fe44bce54a8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9ab26d-4103-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777162058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777162058, "uuid": "e48ba53b-22ba-44f9-b9fd-0960352fd88d", "comment": "Malware payload", "value": "24b240c7640425c870f15dab2ba74018", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777162058, "uuid": "082ffb1c-7c34-4315-b809-1000e324036f", "comment": "Malware payload", "value": "5b271b8311c8aa26b4a25efe0afd72e2b3e918b877371051dc2125ef71d574b3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777162058, "uuid": "41baa508-0bb9-42dc-8082-53dcb8b5ff09", "comment": "Malware payload", "value": "6d383df1dc17767497ca3578f39824c53285ef57", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777162058, "uuid": "4c39dd85-747e-4e64-82f5-fc7839fff277", "comment": "Malware payload", "value": "fa6b410fdc6c21bfad8ac9d9855b1f09ba00d2efe920d7b8c7178cffd930ba3573755b93384d8535a2ddcd04da84bf54", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777162058, "uuid": "cf06d10e-3be0-442c-8f41-2d6d503c3626", "value": "T1C9137D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777162058, "uuid": "21457756-85b4-4224-94ef-b6f07d2dd902", "value": "768:b7XRWNGxV/9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bVlxWco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777162058, "uuid": "70de06ca-54cb-4b42-8db7-cb59b03d6f60", "value": 45514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777162058, "uuid": "4b9d1d8c-383d-4076-9ffc-df05e5bb0aae", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777162058, "uuid": "3e69e977-4784-4a41-b9ca-e9649d962d92", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985f4913-4171-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777209156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209156, "uuid": "62e389ac-d187-46ff-855c-44dc1918faea", "comment": "Malware payload (Mirai)", "value": "11d753231c3e06ba7f32459334f940e3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209156, "uuid": "c05d0622-0889-48c7-a02a-f917ae4890fa", "comment": "Malware payload (Mirai)", "value": "5b878a5eebe22b55706fbb268fcd5325a6061b8d3873ece8d59c47f0e2f894a1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209156, "uuid": "da34de60-6681-45df-acf4-ffdc54e614d0", "comment": "Malware payload (Mirai)", "value": "734f02a4534fe781d68b98cb5f5c1b8fb6d2e3fc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209156, "uuid": "a6e8d421-5588-479c-bd09-661b691f8c94", "comment": "Malware payload (Mirai)", "value": "a92b173b32c3b8ba07fba8ac482a67d7c7f1835fa24526191b6a89bbbd1195bcb75ce877ed1ffd9494db399a8d745043", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209156, "uuid": "6d2dcfd0-b585-4b06-9cc2-20319a06fd8b", "value": "T188333C4DF783E0F0DD4B0531115BF77E96349E025124DE7EEB98BE62AE32A027117618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209156, "uuid": "83592d6b-c46f-40f8-a0f3-55a2943aec2b", "value": "768:VwheNR1eCZWUJ2S7pRflrFWwqTlFNB5azjYvzNeVMU2331ANA0B7RhuqDV981N+s:VwOt37pOzwLMU431ANA0BLBCJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209156, "uuid": "908044f1-3cf5-4ea7-94af-a325f838195f", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209156, "uuid": "088bbcc7-3b57-4515-a5b6-608f8dfc4342", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209156, "uuid": "a5d5b6c6-4ca7-4c5d-872a-543142c26cee", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95975826-4172-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777209581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209581, "uuid": "f2c34a5e-8d10-4959-9520-e1898da341a8", "comment": "Malware payload (Gafgyt)", "value": "f40781c9cb0aeda8cbb43fd16bb42498", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209581, "uuid": "dddcf5c5-e09c-4bb6-b251-b99f08e8ac7d", "comment": "Malware payload (Gafgyt)", "value": "5bd97bf65e5c6c34efdb38f3ea2617370b663125e89979d93b581b7ed7c593dc", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209581, "uuid": "3a8bde24-4511-4d16-ac5d-d5a4effaca39", "comment": "Malware payload (Gafgyt)", "value": "5c83da9a425bc2d89c0b589eed4c8dbbe5d9509c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209581, "uuid": "b5dd6e03-cf49-4b6b-bda9-d2b1205ea684", "comment": "Malware payload (Gafgyt)", "value": "e1b8d17ead52cd1a18cd42b2b3dbe080f25562b23795f969085539ad19850b6d2f38afd71eb4482f7357450a45d57567", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209581, "uuid": "d9957a7a-c218-412f-ae2d-86ed21982ba4", "value": "T1D1A3121F69640F79CEB039F9A0B277AC682DD4DD4DE473DFEAA21BA411EB08100C5728", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209581, "uuid": "ab66973f-54fc-47ed-988f-3220756edce7", "value": "3072:NzbqrIGlpY/u4QKIkHudZTvc2WCWNl9ggG6:NzbGlYvQWHStLID9ggG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209581, "uuid": "4c11db2e-ae01-4b33-a380-2e825da47bbe", "value": 104532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209581, "uuid": "b8689506-2cf2-4693-9bc5-0bd6812d08f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209581, "uuid": "629bbadf-373d-4c5a-9825-d0dc2bef1cac", "value": "redis-daemon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae89373-41c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777246849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246849, "uuid": "4191d27e-0985-4dc9-93f9-5ee7b291cb66", "comment": "Malware payload (Mirai)", "value": "2d40cd777ca042a420ac9cccccdc5ad0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246849, "uuid": "5bd1421b-b960-4625-a612-370f0ff81df1", "comment": "Malware payload (Mirai)", "value": "5d82fb8996c47c7f4a06b1e8996e44696ba405a9d3c86c46b9319fa23d7d5061", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246849, "uuid": "e0555ffe-7722-4a16-958b-0b0614375cf6", "comment": "Malware payload (Mirai)", "value": "a5cb3e00d249ba5967fcb3c64cda16aa205eb9d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246849, "uuid": "df501e1d-f37f-4792-a857-51040337afc6", "comment": "Malware payload (Mirai)", "value": "4a5ee6fa6d43bbf828fc42ca2d2501c0c0119b98febaaf734eadaf4a61c553af5b72509f47aaeed076f882a55431c87c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246849, "uuid": "ccbc03ff-db0f-4a46-ba8e-c863f61ca981", "value": "T1E604C50E3E219F7EF3AD867507F78E305658379626E29284E16CE9111E603CD741FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246849, "uuid": "046071cf-706c-45db-90ff-613458a036f9", "value": "3072:eVUoXCpzJNUUtc18k2ZeQOvC8nw23UICsEh/VbCA6bGk5KEa:ezCpzJymeU8nw2Esm/dJkMEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777246849, "uuid": "0ebce4f6-141c-43ca-84c6-9b2e51e9e80a", "value": 181620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777246849, "uuid": "ac573614-2c2d-4fa9-9106-a941b503bf6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246849, "uuid": "72fec7e5-5858-46ca-bc09-f5ab43ed39c6", "value": "Yboats.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0d5577-41ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777247306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247306, "uuid": "fc67fe8d-8671-4487-8028-09aad18507f9", "comment": "Malware payload (Mirai)", "value": "54fe52c140640109eab9379e2acb3f0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247306, "uuid": "5c1f47f8-980b-4e14-8a5e-9325455c06c4", "comment": "Malware payload (Mirai)", "value": "5fe3093a65753eed77cbe8412bc0fca8a641fa1b54e9a40781df4a287630dc4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247306, "uuid": "0cd6a980-1e2e-4e10-a0c6-dd5285ebe11d", "comment": "Malware payload (Mirai)", "value": "be89ac8d29941545b13a7d90ce3d7131779a7f04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247306, "uuid": "acb887fc-fba0-40fa-934c-8d01666d6559", "comment": "Malware payload (Mirai)", "value": "240302a26e1af8e1f7805ad7bc2aea67d0c10393a6fa3f50e57d5773d425319289eace52ad5bec2e852c9ff35dab18aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247306, "uuid": "4c1f95e0-2abc-468a-a7fe-751a8db98dbc", "value": "T1A9F48E9EFE5E3C43D2DBD33D9B4A83B1A22BB150C31351A33541436C94C6ADD8BB169A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247306, "uuid": "ed9e9a35-6469-47ae-ac56-f4ad035bd3ff", "value": "12288:Ym3JTcUKHVvELP65sS6BhuUgZZKu6cG4i1jkgw5C6iUGi58g/teYDP:Ymx/cPsSeuUosu67Vkjr8gVeYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777247306, "uuid": "1cc9b638-61be-45ec-be93-97045d240648", "value": 778512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777247306, "uuid": "1fbf18e7-5e1d-438f-8163-cd2d3970851a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247306, "uuid": "e1a1bbb7-7c5c-40bb-b59c-f179a2def7cf", "value": "SecuriteInfo.com.Heur.18428.4981", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b472b2a2-41b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777237121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237121, "uuid": "102538d5-3666-44b7-9132-bfa4304b8160", "comment": "Malware payload", "value": "de9546b3ab4c8736a66aa9541ae62c4b", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237121, "uuid": "66b3b170-8198-4402-ae59-46e6023d50d9", "comment": "Malware payload", "value": "6128325a4fe32866304f16d41d991bd22c19c49f7441293a9494999e91b8809c", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237121, "uuid": "4b778f12-b289-4add-9d7b-560e826cb7b2", "comment": "Malware payload", "value": "2ccc1a688700066028c5826f6e49b6648ae4e870", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237121, "uuid": "95450b41-1bf3-41e4-b77f-e040f6510baa", "comment": "Malware payload", "value": "b2c4d10c26083ce267ed4607b4ef316c4d72a289062223e04dff4cf1f9107ca45aca29940073831c86e5440c296161b7", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237121, "uuid": "0c8f1b8c-471c-4583-bf27-a9b0360d4a2e", "value": "T1FE47337D0BE5A236E764926174E8AB1CF1F0D0222B5ED041EADC71285ED63E13E723B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237121, "uuid": "19b42f86-7fe9-4fa6-af43-587744080e1e", "value": "393216:e7eNazQvg0CGBXY4Vu+6Vk3za5zW4Y4wQjCD7Bd1/pSr8kQNrkgxrGtpU4wST6A0:eCvv74Gza5zjYf5DF4r8JkGJ4wSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777237121, "uuid": "48dee1ab-c145-47ad-be26-811ee7b30e09", "value": 24885390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777237121, "uuid": "741142bf-d9e7-4503-a58a-60f2585a5c93", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237121, "uuid": "55460a8b-65aa-4444-8287-9fe35a6c2c98", "value": "Silent V4.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a288b3d7-41a9-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777233225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233225, "uuid": "d93aa8b5-4a79-40d7-9463-4202f3a4d885", "comment": "Malware payload (ConnectWise)", "value": "175de09271a2a1c3277982c71eee2988", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233225, "uuid": "c948b482-6d80-4bf9-bce7-7ae04d1b60c0", "comment": "Malware payload (ConnectWise)", "value": "625c9b35948e7755c6bfdbfbf7d2f4d0fe701f6a7a3e1bd008e1068c618206cd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233225, "uuid": "878d0689-6cd3-4f4a-88cd-acb1c330fa55", "comment": "Malware payload (ConnectWise)", "value": "6b7d64ebc5650bf63e2f911fb352544d09665fec", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233225, "uuid": "cc84fb7a-fd7b-472e-b283-10a5b3e68a3e", "comment": "Malware payload (ConnectWise)", "value": "19ef891a17a316d45f424d2f87108e4631cfda772c6bca77593a06d26541a3b14c7dd994073c8103c1360676d3f0c974", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233225, "uuid": "49ce35d7-50d3-4ad4-ad90-f696d160b12e", "value": "T15E46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233225, "uuid": "c8893c9e-ebc6-40f7-8c78-cefbdeb3f6e8", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233225, "uuid": "0abaa997-5203-4f21-8bc6-ef05feb020ce", "value": "98304:YzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:YhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233225, "uuid": "5ba6ebc7-1847-48cc-bd1f-bee3e77884ad", "value": 5643248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233225, "uuid": "4dff974c-f3b5-47f3-adb3-ea3bbf9f9f71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233225, "uuid": "0e554944-c55b-4efd-b641-5c1ddb6e56e8", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556a8ebe-41b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777236961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236961, "uuid": "11a92ca5-2224-4628-88b7-fb60ea6d8fb7", "comment": "Malware payload (Mirai)", "value": "019e9e27057a53404e1c7a8f8e4fbb8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236961, "uuid": "8fb49f0e-e6ac-4b7a-995b-de8b6336c153", "comment": "Malware payload (Mirai)", "value": "628630ab3e3669c0f67b8252c94211ca90a34fe14993a077f6931a7af47187b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236961, "uuid": "50f28de4-045b-45cf-94f1-4268104b314e", "comment": "Malware payload (Mirai)", "value": "a267ce6533bcf9c5d5bb64cb10c076f8c9ad4c0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236961, "uuid": "b9bbee3e-0d8d-48dc-b22a-8737c65fde8c", "comment": "Malware payload (Mirai)", "value": "ac814729513d17510b53a6bcbf13b7f21e5ce90b2b75360ae60c00c63d3887bcf1defa9f4c69c2e283862214e6442d69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236961, "uuid": "f0f3a996-d337-4b0d-8db2-72d1aabdb153", "value": "T1D413F17CDC2389B6D8E0A276D802CC1D725687DD92FD362815045BF88A84B0AFEF8592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236961, "uuid": "555c732e-1920-4073-b3e7-8f708a7208df", "value": "768:iyhMzp/f1t/To76Jy5HIApab8rWlP/uXevHrxs3Uoz8:lhMtDTtcoqwEWlPGX44z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777236961, "uuid": "f200cd40-d317-4337-8ad3-53a1b6680f61", "value": 42296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777236961, "uuid": "eabb79b5-77de-4433-a09c-239369ad79bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236961, "uuid": "fda5d167-8366-471b-b900-fea084a8161d", "value": "023782pler.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd5faf0-41ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777247391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247391, "uuid": "9b9bd797-80e6-4692-b613-4e336408c4e8", "comment": "Malware payload", "value": "2ec464a10e179813e2bfb39457cf514f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247391, "uuid": "9196a03f-42dd-49d5-bae6-f19bad6f8dc4", "comment": "Malware payload", "value": "62b9b71c620081465c92cb955a3909e7e4f91b545f8740d3fd4f4c62a2f6f927", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247391, "uuid": "719f2257-e86f-45a7-b856-7f9d564687e7", "comment": "Malware payload", "value": "bb8b4fed34d4eb9c67838c6e6fa43c4d8fd05b38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247391, "uuid": "288e0344-f5f3-441c-ad88-2203c1bf9566", "comment": "Malware payload", "value": "42b1ff6de23d9a266e89ad8fe4c4c556218b65914195b0c8b1a978c51455bd6837290fe63eb840590d97f99640dc7329", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247391, "uuid": "20723677-100f-4595-a0e2-957c5f887007", "value": "T124C35C1775D180FDC8DAC1B49FEAE226EA33B4295138B21E27C86A671F4DE205F5D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247391, "uuid": "a7d8e83f-2c25-4f55-b98b-54ff33480cbb", "value": "1536:UnAFmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK3k:UAFmSmviqS1Bs0+Nd6lAqktNMxSNbmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777247391, "uuid": "684630f6-a4e5-437e-9a1f-f440e6cfbfe4", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777247391, "uuid": "9962ed2b-8b81-4bcf-bd15-78c192cbc7a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247391, "uuid": "f242d8bc-723e-4e3f-a6bd-8907d099fc20", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d73672-4194-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777223976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777223976, "uuid": "c33de577-0217-4495-b38a-26e6ab0949c3", "comment": "Malware payload (ConnectWise)", "value": "613b9913c9f52dcdb9ab27ca8a00019e", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777223976, "uuid": "301e9a7e-a4c9-4edd-857c-72642f8f8351", "comment": "Malware payload (ConnectWise)", "value": "643f274d35e21b931a9eba16a248446bc7861d82f5be550e42bac039ba666061", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777223976, "uuid": "cfcb737d-a6ac-4ce1-bc5f-1b70ae3e63ac", "comment": "Malware payload (ConnectWise)", "value": "0bcec60e98e5dd7cbae8e68168943e27e509db6c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777223976, "uuid": "28858fcb-1dda-4925-b0f7-b270e91c94bd", "comment": "Malware payload (ConnectWise)", "value": "cc56bf99d07fee6f91ebb454ec52df35ac930a12d1c1d933bda4d8d3d5bc1b9c6c42ed966f647577e60e360f4eb44a00", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777223976, "uuid": "f6ff9818-56e1-4e07-a7ff-d7152b22ae44", "value": "T1FC646C11B9C48432C673383107B8E2B28DBDB8301D655B9F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777223976, "uuid": "28634e12-b695-4456-b4e1-fac3b3503ed8", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777223976, "uuid": "7c13aa68-354d-4ac6-bd3d-9ccc54c2fa6a", "value": "6144:lmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti98:Q1iw7gryNkSV1hy1Z1u2JLI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777223976, "uuid": "f7828bd1-f1a9-4145-b1ed-b8cfdd1fc1a4", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777223976, "uuid": "70733ef3-dab3-46cc-a1ce-3a5a1f678f08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777223976, "uuid": "ba322b2c-dec1-42a2-b560-e23f10527366", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e61670-41a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777233365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233365, "uuid": "7a4dbfb3-8c7b-4889-8e37-59954e278575", "comment": "Malware payload (Mirai)", "value": "86ba24948cd997ce49a53ec818eb2602", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233365, "uuid": "3f796a93-02d4-49a9-afde-06b0cbe0be7b", "comment": "Malware payload (Mirai)", "value": "65f33ffb54e154496663f04b9f5dd408d3a11d51e0147834e5c751ea826e6a99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233365, "uuid": "d04864a2-6920-4451-afac-d0a05c9b5782", "comment": "Malware payload (Mirai)", "value": "6826a04ece4217dd2ca12d6b5ad12352ea287885", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233365, "uuid": "77a1f0be-1465-421c-ae48-e10d91eac0c8", "comment": "Malware payload (Mirai)", "value": "d6d71ade2aa46ec4243d7ec3f1ceb67159f7584ff0379e12be2b9963d634b9782f1c5841fc7d37264f473cb160f217b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233365, "uuid": "1b929ffa-928e-4cc4-926f-b12e870ec571", "value": "T19D739E23C87618ACD25842B8B070FE3A53B3E51056572FF7069ACA7A9447EDCF9453B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233365, "uuid": "20619015-47c2-4509-b0e0-750b0573f835", "value": "1536:0/Zd1XEc589PJ9E++KrpgE7YgJMiCYKkN3sk3:0hd10L9UIrbhJMiS68k3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233365, "uuid": "62036162-59c5-4f76-8cb1-c33336a4e3f5", "value": 80408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233365, "uuid": "d995b2b8-45a6-4928-a5d3-fc1815fb1735", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233365, "uuid": "9d1f106d-c102-4c89-bf08-89ccc8e3a1ad", "value": "luxzz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1fe9c2b-417b-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777213602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777213602, "uuid": "ea42b3a1-884f-450f-9edc-b33b89f0c403", "comment": "Malware payload (ConnectWise)", "value": "17b8207ad565ff236aa395a6e2f8e1d1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777213602, "uuid": "2e116588-18b3-4fe3-a621-605e12c6a0e3", "comment": "Malware payload (ConnectWise)", "value": "66796e1f3c863ee033bc02772a0304181cb295c551ba20eeb9d009d443db73a5", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777213602, "uuid": "0b7f6965-1629-4fcd-9dd5-d5c5efeebc5b", "comment": "Malware payload (ConnectWise)", "value": "120a303bf7603b9575144906f8954d3f74d67e2b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777213602, "uuid": "93fe6d09-74dd-40c4-a7c3-bdc6009e7fc7", "comment": "Malware payload (ConnectWise)", "value": "7e0e3f5937011ea0305a9a8de6badd156e94e0370af8fe47f9260e2c7c0d2e757ced7901d7af9965d696492cd4a236bd", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777213602, "uuid": "52cba796-95f1-4a8d-8dd4-29d5d27ff184", "value": "T18D646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777213602, "uuid": "48fea5ef-a9ee-4c28-ae6f-308ba7426b6b", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777213602, "uuid": "402a8254-0b13-4244-984c-43f80ea95c09", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9n:51iw7gryNkSV1hy1Z1u2JLu9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777213602, "uuid": "23471b99-7dfc-4d63-95d1-068ca1c32129", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777213602, "uuid": "4f0b7d61-2506-42a9-94b0-c63ab56d8b52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777213602, "uuid": "6daedd57-dabb-45be-be02-409490bbd658", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afe98ff-415d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777200544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200544, "uuid": "62b51e40-44a7-45ba-b16a-73d0a6f86756", "comment": "Malware payload", "value": "30d9f91f4f30eaa1cc8dc164403ea050", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200544, "uuid": "41ceb966-0222-4d24-aa4a-5cc25aa3f62c", "comment": "Malware payload", "value": "67898262e98e58d9027a84b6716b3061f653a6c32a4f24e0c33c1a5d12fd5622", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200544, "uuid": "3c1f8123-2d0e-4aea-a14b-befeef413d16", "comment": "Malware payload", "value": "b04b2f0eee3fa139d06d197aa527098ab08cb038", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200544, "uuid": "3b2056cb-e502-49a6-b8e3-7e681ca027f5", "comment": "Malware payload", "value": "64d236d69901a5f59212a1d216072e202b29b989900f58b7fb55942fe77ce2171d98a3f8a4b9ba4a00b33f5efdc34494", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200544, "uuid": "1b62fefe-b5d5-49aa-a71e-05339fdef228", "value": "T1C86102D2B570DCB53889A83CDA96A61076E32513447AB590F4CEBA143FA561DE330F3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200544, "uuid": "c8427037-8008-4285-b689-22bc4cb1a786", "value": "48:T4yWCA0f/cspsle6RqSriUtIn0ffcKT9Bh3biNy8WEPj/TXYmQ/+C/:kyWCA0f/DOiUa0L8WKbr+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777200544, "uuid": "491acae8-3f36-4fc9-9943-cf8d22231692", "value": 3324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777200544, "uuid": "1296182a-bd2f-484d-b7e2-e1126d789a6d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200544, "uuid": "fa8f4f7c-7d8d-4cc3-a7a9-812d76cc5230", "value": "sysupdate.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53d6457-417e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777214869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214869, "uuid": "5cedd5b9-3c33-4155-acc6-7f80e39df5d7", "comment": "Malware payload (Mirai)", "value": "0360b3dff2d9c9581a81640db9f19a90", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214869, "uuid": "4c46dcca-89da-449d-853f-593acab4cfcc", "comment": "Malware payload (Mirai)", "value": "679bf650aef649684cfefd5324b1b1f83771b2fd41eb2761e4b395fc27f8f402", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214869, "uuid": "2719acc6-af7d-4602-85ee-fa1666fc2a78", "comment": "Malware payload (Mirai)", "value": "96d7a6a6e60bab7afc375962a55f13f9bf34179a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214869, "uuid": "cd5dd68b-f94e-402b-8938-e8d889fe1720", "comment": "Malware payload (Mirai)", "value": "fb3d8236e6ce79d595831e21b4b5122a73d54111ab5915d428034a78a03740d14d3490e7191880efe3d7bef4ff069906", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777214869, "uuid": "36b053e1-bccc-430c-a8bd-eddfaedde272", "value": "T17493C784FE59971AC3D272FBF74D02CD7B3A1FA9A7A6311699315E9033C4EA0653E120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777214869, "uuid": "c92c060f-3306-461a-9cae-57a26a46114f", "value": "1536:LQ/6en2XaG3vj+SigaogdHRZmUNZB/jsrleiR6Fj3n6+9f6U+Vuh7/BxIvbsJO9v:s/6e2L37+SigaogdHyUNgoiYNpV6s/UP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777214869, "uuid": "19fe1c86-ba8f-4349-b0ea-dbdabb7b41b2", "value": 90728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777214869, "uuid": "0294f67a-6c87-4252-8e7c-dece39857100", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777214869, "uuid": "60fe3ded-58e0-49c1-bef2-aff35483de1c", "value": "xdf.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525f0427-41af-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777235668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235668, "uuid": "2cb3232d-c2ae-4dc4-995d-743795a30832", "comment": "Malware payload (ConnectWise)", "value": "133688b3332fe3e67aed547d41113942", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235668, "uuid": "055d496b-cbc3-4c27-bf46-afbc0af4757c", "comment": "Malware payload (ConnectWise)", "value": "68ea7bd8c6b6bcc3ec5c7bcd4654681f39fb887e0c41b4fa1e2fa122ac3d8e14", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235668, "uuid": "b3415177-51ab-4bf7-938e-7a0e1e1d55a1", "comment": "Malware payload (ConnectWise)", "value": "fcd0405b2718812958a611de43e1d6aea0297f67", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235668, "uuid": "f15ab338-3d93-4461-8776-3fae10f41e44", "comment": "Malware payload (ConnectWise)", "value": "b2629c290873bbe7ce2c87ab46e40cf1545ac1da3d7bb88d88deb10b0454ecd4e15b39f67b8accc5bb0a57d519bdf096", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235668, "uuid": "5cabb368-3ba7-435d-8111-0583938d696c", "value": "T13F647D11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235668, "uuid": "4d655db7-bd50-4eea-bc06-7fcd648fe915", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235668, "uuid": "284fabf6-412a-452f-82b0-95fe636dc57a", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:R1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777235668, "uuid": "29b9f008-29bf-41f4-9e42-52c28b778b17", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777235668, "uuid": "6a2728d9-d42d-493c-bcd8-2f586a0b8fae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235668, "uuid": "57b26327-5eb7-464e-951b-f030a5217d0d", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db9dc416-4134-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777183070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777183070, "uuid": "b3cd6263-1c01-48e1-9162-9c264644d297", "comment": "Malware payload", "value": "7e1ec54425c897d1311fb5d514ea287e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777183070, "uuid": "c6a06ae2-3588-4677-a522-85217438074b", "comment": "Malware payload", "value": "69121989616fb67fd8a2ee33e4ad7820c558a074943b0f6ac9006f8a216bb797", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777183070, "uuid": "9fff3890-0683-42ef-a487-b75edc05c457", "comment": "Malware payload", "value": "0c0ec18c02d67341125a32e5df410b985af067a1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777183070, "uuid": "ff2132b6-5d4a-45a9-8caf-d747c13bd08e", "comment": "Malware payload", "value": "48e8b0d97d436e78e200920f2e283fdd7692645c150fef55b2f09e493e69c3789c56c59474901b5a7a3d09e0e6f9b987", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777183070, "uuid": "b61760d3-9017-4dfa-8acb-a80cae7b2bbb", "value": "T1D6B2E0F1F8ECA436369D453ABB9CA805A9CF7C2F4DAB7D2014575938411CB1EA019B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777183070, "uuid": "0e03eb42-405e-4a33-963f-820c56723b79", "value": "384:ZVc3s1oisjsKG6qkSgjkjV/A4UAcGE3JNRhQuW5Q:SshUMkSgjkjVdUAcd3JN3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777183070, "uuid": "d6ac7a69-e44d-45ac-9a0a-d30bfc03b2fc", "value": 24175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777183070, "uuid": "706af5dd-61e5-45e9-b5d7-6026fde77f27", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777183070, "uuid": "741faaf9-7c92-4cb8-854e-9c8e54513d58", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcfef81e-4139-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777185220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777185220, "uuid": "7f4d0fd5-31d7-4006-a926-71f0c9de528d", "comment": "Malware payload (Mirai)", "value": "e5a08764f647e5ce9e954b2d5b2cfdca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777185220, "uuid": "693150de-cde9-48cc-b0fa-b3afcb68da7d", "comment": "Malware payload (Mirai)", "value": "6a163fa66f95517993859e1c8cdff8b1770fc0bfa3df7548f2bb7df66e481d68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777185220, "uuid": "0b2120d5-692b-40eb-a0fb-24d4bdace8fc", "comment": "Malware payload (Mirai)", "value": "37127ca3949c23206fdb027fb59416d650a3ae96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777185220, "uuid": "696d1933-85f7-484e-8c75-3e7e3adafc38", "comment": "Malware payload (Mirai)", "value": "449fc1f6e7624e81834de7ccb23a17db7991a66d10dfa30a84884bd34afda88d8baf6b1611e7381d3dc1faef26cc407d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777185220, "uuid": "741ae6ee-3bae-46ba-b424-f9fa53f228ae", "value": "T180C44A59A8419791D1D02BBBFF1D934873131B38E2EFB1069D196F246BABC1B0FBA501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777185220, "uuid": "bfa0c4cd-bf4a-4969-b314-6c459635bd88", "value": "12288:4oIcfrlx96xp1mOoHCJ8v6TElKXRvdMDrvMiTJ7RH8wqaVTBlkBxi8lET1m4R2B:bIuGxpJoHCiCdMD1J784Ts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777185220, "uuid": "ecda7b0f-13f7-4445-a2e4-8fa252062716", "value": 572688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777185220, "uuid": "354eb814-e837-4b7b-8a57-9fd29672bee4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777185220, "uuid": "52513e1d-80f6-42ac-8363-086e4f490ccf", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e3c0f4-411e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777173293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173293, "uuid": "6847432d-30df-4996-ba77-cb8b5e55ab1c", "comment": "Malware payload (Mirai)", "value": "d241eb8806ec03fbe187417964629460", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173293, "uuid": "f2cfaefb-0520-446e-a3b8-e96b9e004e7a", "comment": "Malware payload (Mirai)", "value": "6a1ce24ec7f4253f03db939032cbea1c8d569b4b40aa83177d1f5f2407572163", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173293, "uuid": "8f87e673-bf01-44b9-8742-379b9dcad36a", "comment": "Malware payload (Mirai)", "value": "18470fac0a11c19b99bed15d8bdcda165e6e3c43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173293, "uuid": "48c8bd0c-ff49-4c6a-a670-ada4643fd6d6", "comment": "Malware payload (Mirai)", "value": "97b9e3d93ab6bb12fb66126a9488fbd4574c37986a5073edc045315ff12cbc60fb589904950c00aa5a745882533466da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173293, "uuid": "914fb119-0ec0-46e7-969d-9e87a043d72e", "value": "T145230891BC819A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173293, "uuid": "17b40cc1-d690-48ce-a125-823c4bf3ccc7", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THC:5DmKF7Gxyk8cqoHAmWurAufs95C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777173293, "uuid": "4d854ec7-e56b-40b5-b4c9-bdbda231c99b", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777173293, "uuid": "dee8b332-fb7a-4a9f-aa57-64e8a8ba9b49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173293, "uuid": "d581ae2c-8100-45eb-a0b9-7a95807a71bb", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f00a0bf-41aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777233407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233407, "uuid": "8f244ca3-8d58-4024-ad92-a988e32ab5bf", "comment": "Malware payload (Mirai)", "value": "4ba930bd81eefc27d4fdef0d4a24644d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233407, "uuid": "d25d820e-b986-44aa-a2eb-48f60a7b4c8f", "comment": "Malware payload (Mirai)", "value": "6b04202cf734482b7bec3a7ce7077f8f373fc7586fa8315b67c99058cc9ba40d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233407, "uuid": "f222bd41-af92-4219-bdf2-0bf5aad4d2e1", "comment": "Malware payload (Mirai)", "value": "46105cb2aa3fd69f0671e375a73110f68fea133d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233407, "uuid": "22286185-f01e-4a6f-82ba-1bc0fab0d7ac", "comment": "Malware payload (Mirai)", "value": "7a6c399fe6eb49ba768aa476412a30b80d6de76e875e87db2e2727774b01b07ed53c5005deac149a12c52b89efaa76a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233407, "uuid": "bfc810bf-5426-4395-8735-056109e63302", "value": "T17B8329C1FA8BC0F1D91B89304067F63FCB31E9695061D75DEF9A9E36DA33581A212389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233407, "uuid": "0358b7e0-e60b-44d0-817a-1dbe85695b95", "value": "1536:iXDwDhVtcU4xiUWaqH3FgfKueEMWximKjfTsv4gz9F7vl:kDWKzQLH3FoFjwmKjfTc4gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233407, "uuid": "a590bcb7-3687-46e5-8db0-e6e232626e25", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233407, "uuid": "65bc8dce-7dbc-4201-8cf7-f5e8c628c54e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233407, "uuid": "f30a9a0e-f083-4286-8239-202c47cf980f", "value": "luxzz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6feb28-415e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777201160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777201160, "uuid": "1f3a3718-9fec-41f8-afbe-e41b6f9904f7", "comment": "Malware payload", "value": "564ec0c1e6d22c5f934e154f095ee868", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777201160, "uuid": "99aa8945-2969-42c4-ac0c-651f7842bf35", "comment": "Malware payload", "value": "6b5906b06c03afe176f1b2b5f0b84a2a5b329d58e1c86c4e9e8120c902d7c064", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777201160, "uuid": "76596abf-7f88-4225-a6ee-06fb0a7169e8", "comment": "Malware payload", "value": "968dd70455796d4ac97fac2ba559ecd86a1ddaf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777201160, "uuid": "0eaadd6b-abad-4d86-83b2-e9ff72da6e5d", "comment": "Malware payload", "value": "78e97289fe4bb02ff5db18cd83dc650ab9c227780daaa35fc76c4f87ccbfb5d3bda5ef5a1399207fd1132d120b1bbb7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777201160, "uuid": "2cdfa247-e81e-4469-a9f0-d5d8691bbde2", "value": "T1A7958E1BD84DED36EAC9F07C8D8D05E6F127755A13A4C0097927810EF6D39E24BA9FA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777201160, "uuid": "92c52354-4097-49f4-838a-b98c8a6b6982", "value": "24576:ROqszhFMUVIH06iygneU4WhswhfBa0Ehk7l64eYjKxTMcckoYqGIce0Dq:RO9lIU6i35Ci5qkJnUGBYqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777201160, "uuid": "b3f4d5c7-ac3c-40e9-9fa5-0aa8cf7a677a", "value": 1963512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777201160, "uuid": "4b49be28-da17-47ac-9df1-27af9b4777b6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777201160, "uuid": "8d436ae2-0bb1-44d3-89d5-d474c1e60ddc", "value": "earnify-client-aarch64-linux-android", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "754679bd-414d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777193636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777193636, "uuid": "65b4d43a-eec5-4007-ade9-7cedf25cd78b", "comment": "Malware payload", "value": "d7f8ee53ef3915bdd24c62691220e3f5", "object_relation": "md5", "Tag": [ { "name": "doenerium", "colour": "#0B5182", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777193636, "uuid": "6f562751-364f-4c77-aed1-93e8222e7754", "comment": "Malware payload", "value": "6b8a56d843c4fb64dd47877a52fc559fac6ce7df08259cca66c8d534cb8e4458", "object_relation": "sha256", "Tag": [ { "name": "doenerium", "colour": "#0B5182", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777193636, "uuid": "2caa2cf4-0467-4071-a7cb-a8cf916c5634", "comment": "Malware payload", "value": "5a6c4bb7c5dec33cd04f4229c681119c5589dd52", "object_relation": "sha1", "Tag": [ { "name": "doenerium", "colour": "#0B5182", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777193636, "uuid": "6857128d-523c-41a9-97a2-03126b07d8b1", "comment": "Malware payload", "value": "a8a03420c5b5a3ad74255863865cf5fbd99b7700e7f30f919c4cce8d69c370261b2612861617073e2eb221d6a23522c5", "object_relation": "sha3-384", "Tag": [ { "name": "doenerium", "colour": "#0B5182", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777193636, "uuid": "b97b0247-6fe8-49ab-8549-3c8ae948bc57", "value": "T18AF7CF1663E112AAD577D138C79B6603EB73B40713308BEB329C43652F63AE45E7A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777193636, "uuid": "b2d4d1a3-d120-415e-835f-27b50b1450c0", "value": "9eba512b03d8cac8a6c4424e25e9f06e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777193636, "uuid": "895472ef-23f4-4fd1-a60b-9876b385dd45", "value": "786432:gdBeI7LfOCDsno80dguj3/oyngPV1PywoxPv/J5ryqxKEPI1ki:kBeI7yCDsW/oRwtXbR1IT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777193636, "uuid": "a5dbced8-871a-4792-8e8b-c861985f7201", "value": 71803888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777193636, "uuid": "f3410fda-f453-4886-b7b9-444a85d7c87c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777193636, "uuid": "9dff48bf-c7a2-46fd-b9c4-fb83f6574dc7", "value": "annen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e3ebad-41bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777240698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777240698, "uuid": "c8e977ab-08ab-4ba5-9394-07ab9c2e0b54", "comment": "Malware payload", "value": "7f2f87430340fcd440f9244ca81516d6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777240698, "uuid": "d02e8749-3392-49a1-a339-0947c6a2392c", "comment": "Malware payload", "value": "6c3504d357f983b78526bfc54743a143e10a5ee781427a3e052b911aa459bb27", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777240698, "uuid": "2ddfb850-1f92-4571-9fee-a81bcdfc74e8", "comment": "Malware payload", "value": "5397b4837b4c8ced9f762cbe27eb50b56e42498e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777240698, "uuid": "c6a8bceb-ca31-4e37-a041-fa099e00c2c9", "comment": "Malware payload", "value": "24d1c7849ad6c80064cc00cce257a02c9b403250aaa83773e5bbf5933d7f9576f7ea69cf0c50bf644a8d04207a2415d1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777240698, "uuid": "c129fd98-4af1-4f3a-8460-d62ea872e1d5", "value": "T1C6136D6566913C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777240698, "uuid": "307c911f-ee52-48ee-b115-4c622971321c", "value": "768:bNXRWNGxVe9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:b3lxpco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777240698, "uuid": "847a7faf-515e-42a5-b6fa-181ed055bdcf", "value": 45432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777240698, "uuid": "c9ebe78a-02e9-455b-a68a-3da6c3fb9a24", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777240698, "uuid": "cc500278-ce8a-442b-8578-415263b76087", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873faf35-41af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777235756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235756, "uuid": "50836523-3efb-44bb-988c-3c70149ae5ae", "comment": "Malware payload", "value": "eed81eff3edca5856c91a8d06f805754", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235756, "uuid": "5f24848b-9086-4de7-9ce5-fea6f58046f1", "comment": "Malware payload", "value": "6d38b36349590b4397c151647df5fac0e19c84fa79b0d1977db4aedc480d1097", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235756, "uuid": "732722f3-97d4-41ee-ac84-915bd4037295", "comment": "Malware payload", "value": "7b45d4234d0082f7dcd74bc2768abccccaffe6fd", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235756, "uuid": "f2e68a66-fc0c-4d3b-9b7e-47d8515aa26e", "comment": "Malware payload", "value": "579152184e9ba9ac495c650b2120d0ca7322df5ddca2b146463cb26a97427e4c90f44c823d2aab9e915069e677bb631e", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235756, "uuid": "1165787d-ee18-4b54-a648-69b5d46433e0", "value": "T1F956F101B3D695B6D1BF1638D87A52696774BC048316CBBF5394BD392E32BC08E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235756, "uuid": "66f272be-1a43-42d1-9333-0093576e88f8", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235756, "uuid": "12fde532-3f28-4126-b166-d0ca7a9735e8", "value": "98304:izIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl0naOKW:ihfefPtHxcp9ym3nltDUJV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777235756, "uuid": "c08eeed1-4282-496e-89fd-e9b2dcb45e74", "value": 5935480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777235756, "uuid": "14293cd8-485a-4542-a1ac-64bd5395b1e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235756, "uuid": "1b0c1533-80cb-400c-b806-cfc85483cb49", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd05fbf-41c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777245429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777245429, "uuid": "8cebdc42-2a5c-4981-a26f-0c1a9413d859", "comment": "Malware payload", "value": "968375807112c97780732bbaf55d6b3e", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777245429, "uuid": "0944eb0e-3918-4e87-b946-909aba83cef9", "comment": "Malware payload", "value": "6f213c68f22518accb2d9f401b1f0a1531ffdf0f347145ffe7bba212e14bead9", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777245429, "uuid": "e57c2424-ced7-400e-aada-94b759df90c9", "comment": "Malware payload", "value": "13ec621da3eb8b71e022cae04eac91eb27358007", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777245429, "uuid": "f5b6c7a2-e4b0-4e20-8dbe-66128bdb0d00", "comment": "Malware payload", "value": "8971e48372d87bb5e3cced4c914362082119c6ff3238eafed681d71168f6fde95a78f78d751c9aedbe4175454aaf2b34", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777245429, "uuid": "180548c0-5d90-4137-871e-9dfcd134f68f", "value": "T14A317A505BF69608B2B25E05A9BE64925D3B7BBE6D35CA0C0050C54E1BB2A44CC7BF32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777245429, "uuid": "471fdf1b-e5fb-40df-8df8-57af19ca9b84", "value": "48:pAlbYyQgQaAAzrxJRaRVSkdj4Oggz4J5MyzQw:pQbYyQgQadzrxSDvj4mzjykw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777245429, "uuid": "13030843-a2d7-4edc-86e9-5e5345aee786", "value": 1676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777245429, "uuid": "70da3bde-b1d6-4da0-81c1-d27f5e51d447", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777245429, "uuid": "897ec9a3-de9c-4407-b6d4-588fd5c68128", "value": "xgkbp_01.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b497e22-412d-11f1-a769-42010a9c0008", "comment": "Malware payload (Vjw0rm)", "timestamp": 1777179955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179955, "uuid": "4d86e549-0932-4388-806a-b7f8f7cdc4f8", "comment": "Malware payload (Vjw0rm)", "value": "2d950ba984515d26925d8d10742657b7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179955, "uuid": "6906e6b9-11f0-42b1-9acb-c091c03b1ce8", "comment": "Malware payload (Vjw0rm)", "value": "6f36499d067b78b1c861305e2b7b2c482e81b058ad040189119f5da40e7a81bb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179955, "uuid": "969f1264-061f-4cd8-9006-24352e531f08", "comment": "Malware payload (Vjw0rm)", "value": "8651e3753bf1080610bd0352d53b9afd4745b890", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179955, "uuid": "e2eb55fc-9110-448f-8e85-e767826a8151", "comment": "Malware payload (Vjw0rm)", "value": "4f0a882bd13ff8ed8f4d5a4c4d927811f40c3b2effdbdf0a86d855f48d7b00a45331c8e9308fac91d1f4952e730f1ec3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777179955, "uuid": "e4dece83-1dc4-4ec9-81b4-54cd628c9ae5", "value": "T18233FE3CFEABA23E6E7398A175F18B47D03A3386924E178A056783F4078355DE468D5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777179955, "uuid": "ca0bae4c-4c37-4356-abb4-3fa17c60abd3", "value": "384:Er7kTTNFQfq7w1y1GXnGxWFH4YeT9VF1raRs4LqiNA/tHrRhTLA6zdFgWDJMMHq5:TkWXXqK0kNxMyohw+DHDHixfeyw9lqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777179955, "uuid": "957b139e-b287-4d6c-90b7-cd466151bdd1", "value": 51192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777179955, "uuid": "a7cee45d-6fd8-421e-aad1-f93dfa88b562", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777179955, "uuid": "943afe82-34ea-431d-8fa3-fc3ad0a6191e", "value": "msedge.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eecf785e-41a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777233353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233353, "uuid": "d62dffa2-5a55-43ca-87ef-b73e8c3c2637", "comment": "Malware payload (Mirai)", "value": "ac28519e4915f43ed20f1eb7eaeecbe8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233353, "uuid": "c3c60f88-f718-4324-9c96-907ff5aeb60d", "comment": "Malware payload (Mirai)", "value": "6f8dc9835845122c654b30ba23720c31adb88c7822d9393b0fd1fa4f77a0365e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233353, "uuid": "9850e887-0a73-485c-9a8b-251552c36490", "comment": "Malware payload (Mirai)", "value": "97b4d9dd95c601ab1628d24233044e3568f6eebc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233353, "uuid": "e8b71972-4744-4365-ade7-5feb769f623a", "comment": "Malware payload (Mirai)", "value": "e4e23546dbd0b0531c500c6ce19fa2810f4bf7c68311bef9e3d6789e3b389a9d02d2bea04b04a74ed853f4dc5240e3e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233353, "uuid": "b14aa9e5-a1c5-4715-a988-708645995b36", "value": "T1167302A423B87D4BE3067EA5928715923BC978D03A6E0647BE034E1780FF89D1D7E4E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233353, "uuid": "e2cea5d9-52d2-486a-836e-edf3667ca4c8", "value": "1536:ot/57cJDRHxxlMFImUy/5El+vflRo/36W4k6E9e5SZ9YYtr02SA:+xkRRPMFImUy2lgY/KW4k6EeYm2SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233353, "uuid": "9afdccf8-b0fc-491e-ad81-89d1d1265c3a", "value": 77580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233353, "uuid": "bbf6735a-21c9-4e61-9c55-cc9136ec7b10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233353, "uuid": "89ecb8d8-28ef-49e2-8fe2-27d1b4a23007", "value": "luxzz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d970f63-41b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777239928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777239928, "uuid": "c08fca3f-605b-49e5-b0c0-56368e39031b", "comment": "Malware payload (Smoke Loader)", "value": "942fddad7fced507ff75e70a5449b8be", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX11.file", "colour": "#F3623E", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777239928, "uuid": "3ec002cd-c282-4bf5-ac43-f9f272a4212a", "comment": "Malware payload (Smoke Loader)", "value": "710c7947aaf56ec90c8f58f1d21f2f5b2f3753ff8266ba3ca3abcdfeacd080b9", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX11.file", "colour": "#F3623E", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777239928, "uuid": "7c0ec92a-0b8b-4892-b692-988efa722f92", "comment": "Malware payload (Smoke Loader)", "value": "84c3a1bdc531002390a1a44d8b8842d4c044fb0e", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX11.file", "colour": "#F3623E", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777239928, "uuid": "b20f8e0b-2c3f-4121-9ea6-593bdb69dfb8", "comment": "Malware payload (Smoke Loader)", "value": "6c8820962f87d45769858af7c7a1b5f5251ce7715ee12b6c93771865ca9f50f77ea937bd5b8e2626bccb9ffc561662a7", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX11.file", "colour": "#F3623E", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777239928, "uuid": "0b95d5d8-646b-4fbe-a9c5-76e1906dba26", "value": "T159356E03FA9E7E05C629D829CADAC95151B76E0B71271F434EA19F1D026B20B377BB1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777239928, "uuid": "c556a124-f6e4-4bd1-b7eb-277a6cb47faf", "value": "913897f0f186de4f52c303877b5048ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777239928, "uuid": "776a8155-4621-4ed8-b93d-f51ff8267548", "value": "24576:xRP+bDrGy3+I6knmMC6MuvuzjZrqPxa7YCDmMCs8jA+7f7mMCI6m/mZ:IAXjUDmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777239928, "uuid": "689c8f86-7503-46df-a1af-096f287c9f4e", "value": 1152512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777239928, "uuid": "c99e3d7e-591c-4c45-bf82-8347203d8caa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777239928, "uuid": "9d3d7be1-9a83-461e-af16-73c0691083d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded1e3e9-410c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777165895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165895, "uuid": "80f0c236-d5d3-48b0-9fe9-4a338580fe58", "comment": "Malware payload", "value": "c74729f164e6fe83e87e3b97985d8b09", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165895, "uuid": "331b0bc1-aa58-4345-9f4a-43fd07cb22b4", "comment": "Malware payload", "value": "72010c826d9fbe269fb311f5258262fc372422beb15ae50e98e6b8df02575814", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165895, "uuid": "ff060810-170a-4ae3-8933-b6ec3ab5ad33", "comment": "Malware payload", "value": "38460f6c01a7ff63339b0c1fa86e233cd8b7b0a7", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165895, "uuid": "06c2fefe-6e3b-4cd6-ab58-0eedaa6b0d8d", "comment": "Malware payload", "value": "3c9d8559642280156a02222f342b04d9ccfcaac94aa60decc7c2aeffc7a59c9400c64d27d7ceba946ca97d4fb4269be1", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165895, "uuid": "aaa7cc48-c05f-4a99-bdb8-660de5579707", "value": "T103514C19ABF91B39F3B3CA3955716A255D37BC42E53C8F2D01C0068C0575A11ADA4F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165895, "uuid": "1371718b-1c51-42a2-a5b6-30634e35a74b", "value": "48:8Kud734rR4Ji4dAKRjYiBm+eeMfQbYD00ki50KP+2EZkU6yRC3pDTa+oeXOg:8KS/EZeMuC00kiGSBEZkUxRCdT1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777165895, "uuid": "eb5355c2-04d0-4e44-86da-179d25fda1fe", "value": 2843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777165895, "uuid": "73d52f3e-a957-4d40-9c02-51faaba251c9", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165895, "uuid": "06b5b09d-4ee9-459e-afeb-f2db3db9194c", "value": "Google Chrome.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9ebc81-41a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777232568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232568, "uuid": "09b7f84c-ec99-4e82-bdb7-5f57bb3de659", "comment": "Malware payload (Mirai)", "value": "b80ea5bb64fbd768b464fa02a15f5423", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232568, "uuid": "3a2deaf6-65c1-4477-9580-d92cd28f83c7", "comment": "Malware payload (Mirai)", "value": "724b7a82a4d871f94585bb7bece99bdcd97f7af293d0b9be3af2156b033c492b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232568, "uuid": "5d0ef009-b4b3-48fe-96b5-39f72cdb5fbe", "comment": "Malware payload (Mirai)", "value": "cca08e0efd6afcc5541110410d92f5d3ce0921cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232568, "uuid": "228d6671-56a9-4ee0-a0f4-507354f35edf", "comment": "Malware payload (Mirai)", "value": "2728de8bae1a2ec45cd9043249652e5e4677715502ecc585803fd96a369bddd1e38732be7d712fce46be5b917b96537c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232568, "uuid": "3c558ac2-3cfa-4cac-a8af-55c89a913565", "value": "T1CFD3B63F6B230F23C0C6107112E71632B8B5D7C934B897D7A9E06DA92F299943546BED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232568, "uuid": "6f24443e-6104-47c9-bcdc-ff0bb9d7be15", "value": "1536:qN8ksW8aVo8gd7Qy4tJNN+q53fiKMEmgto1SK:NnjapA4jNNt3ftesK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777232568, "uuid": "fb5a9468-7a9b-46bf-a1d8-ebab6761fe72", "value": 136024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777232568, "uuid": "3b569264-4023-4a71-912d-2707880a3854", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232568, "uuid": "c9377630-69bf-44b2-a436-d2b67adf2c30", "value": "shabak.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94b19ba-4162-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777202742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777202742, "uuid": "3c6d9b99-840e-4b9e-b060-94efb376d97c", "comment": "Malware payload", "value": "5c503616d7e8156328874c03c5426178", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777202742, "uuid": "915fcbb4-8132-4b4a-a87b-0758852db914", "comment": "Malware payload", "value": "75e92004eddc02be0fc6cebaa3dcba33edf41c25528bbb6770116302fd3b0aa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777202742, "uuid": "6bbcb912-04c0-40e0-aa46-9582317400b3", "comment": "Malware payload", "value": "04e16261deebe79a5de50bf08126e82186c7d5f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777202742, "uuid": "c73722be-b14e-4aa4-ac12-19cccdce7ee4", "comment": "Malware payload", "value": "3c454b4860a0b1818998f25b443c5d017837979b330d07327b3eb0b72d0f206d694345de37012048e3fb16abf6037f9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777202742, "uuid": "6a683613-ffb0-43dd-9f52-4d78849a005c", "value": "T1020833458CCC843BC5AF6EF51A51E712A4488EFD687B387A9D2CCA583F94790C8DC1B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777202742, "uuid": "6de75422-5c88-4ded-b2c5-ed6372c1b094", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777202742, "uuid": "93a034c8-33cd-4dd9-a072-aa9aafb0bb9c", "value": "1572864:Jt9IKPuUcFOVYvgSuPKLjm4+HQMpNojc/68VYkisNMVc4Ad7:JUKd4Tvr4Kvm44Q2mCBMVc4Ad7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777202742, "uuid": "58df4161-56c8-4f33-8297-926be5bc22d1", "value": 77298539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777202742, "uuid": "023da9d8-def5-4933-9bce-911231ed7a53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777202742, "uuid": "b921cca5-e55c-4a55-a5e3-cfe9f4d421c0", "value": "Cryptex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6103b64b-4103-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777161819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777161819, "uuid": "d039f3f9-8d94-4cd0-8155-def4bcec2f63", "comment": "Malware payload", "value": "d722e5ed2019cbe1e837780869808478", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777161819, "uuid": "131f170b-7fa8-4163-afa1-c25d29f50165", "comment": "Malware payload", "value": "75ef8a3b311a9940a82392cbfb3c593c25aab349467a68c05eff1d01a88ce9ba", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777161819, "uuid": "7e53fca4-4934-4bde-9489-4ea0a83e7a1a", "comment": "Malware payload", "value": "40149a8bd494b0a4bdde6a1a53be2b0b946d4d7d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777161819, "uuid": "267ea42b-4ea2-4b2a-927a-b2b22b03ca07", "comment": "Malware payload", "value": "f950a418db7e96040bcedb8185d139698637ec10324a14e755e7ca0d9ff2a43a1464593cbb68aab9c6fc7a3126ceadfb", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777161819, "uuid": "6e5bb473-e3e1-4450-bcb1-f603e66d14e5", "value": "T1CB0833A3F718891ED1BB50728CAE2733A9754C16C683871B6B483A6C6D737C98F487C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777161819, "uuid": "ab1fc6aa-df9b-47c2-b1b8-4ce222b5905a", "value": "1572864:uIingKbfJ3YrkoFs1BLDSBSVHpK3K/I8KvsXvB3YDZVFJtRCOY890V:HinTx3akD1cBSVHpK33vG3YNVHtda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777161819, "uuid": "18ed6936-7f88-4a63-ac6a-6978efcbf362", "value": 80768290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777161819, "uuid": "55cc0745-2fbc-4c40-86d7-c10b7f737dd0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777161819, "uuid": "d9eaceae-927f-44b6-b090-570f12887ec3", "value": "111.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd40d9c4-41aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777233700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233700, "uuid": "0e785849-85ed-4bf6-a715-dfdfacec5d4b", "comment": "Malware payload", "value": "f0013579a810da8e56e3d69b19428b3f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233700, "uuid": "cbefd12a-e33d-4685-b2f3-f4ce55536b6b", "comment": "Malware payload", "value": "7607289baf32f49953c38c649e20accc344999cebce28bb59cd1de83817f580d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233700, "uuid": "7c906d89-9894-4320-a5f8-4ad2cac1526f", "comment": "Malware payload", "value": "75740fef32b3913d2e7129b92b152413297c8749", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233700, "uuid": "78e4572c-10f6-4e67-a8e4-a27e76c79985", "comment": "Malware payload", "value": "d5d1041361ffbd4d4d2f159c47bd7a1fb69512642e689bbd435df248507a4e0e0fd6b0033e2db0d0b0b6f5c536f7e0ee", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233700, "uuid": "395e86f3-b8e8-4b68-82ce-6a65a952efcd", "value": "T13C136D6566913C24AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233700, "uuid": "f59c2d8c-4485-4678-b977-195d241ccbfe", "value": "768:bg7XRWNGxVL9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bYlxeco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233700, "uuid": "64a2e403-4ae5-44f9-b015-b9b5636e06b7", "value": 45428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233700, "uuid": "8aa32b78-b6c7-4bba-9e7e-f85052f5f1f6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233700, "uuid": "ffe175ef-b60a-49e5-ad07-5cd6e7793315", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ddf139b-41a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777232546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232546, "uuid": "ac2cbb7d-23bb-49a0-a404-4a1c9381a193", "comment": "Malware payload", "value": "7cff1a80291eadc9712264d5cdbd1670", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232546, "uuid": "37a4c684-08c3-416f-86e5-45b1e5cdb6f7", "comment": "Malware payload", "value": "76558ff26e724b7c46c1f2049703c8989ed5498ce7e4d4d4865745a791d5481a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232546, "uuid": "07a952bd-3759-47e9-a83e-243b6f385777", "comment": "Malware payload", "value": "5e45d833ebe6b30ff9e59775d923264cbf08be5c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232546, "uuid": "caf026bc-cf56-47a5-b1e5-d56de4b7c5c1", "comment": "Malware payload", "value": "d5696fa14ed8d8439ce2d7021eda2054fce34fce48e7b4709ef8a2f6547c6e62a028e7b45b427b96a355419a4d9ef049", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232546, "uuid": "6b8eb09e-e95a-4dd2-bf2d-eb4310badbfa", "value": "T160814FDA01911436EE519D7E62BED1C8738CBCDAE9ED7A7890FE7960C07CC91F804A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232546, "uuid": "2f97e6a7-e4db-4b6f-8105-d2a5593c9efd", "value": "48:VE51NXE6EQ1TcE9ET1PhEonEU1DsEwEI1b4EZEH1pdEWH4jEX1+WlEydqoE091aH:fRdqm6j/PDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777232546, "uuid": "5d04c28d-5ca6-45a2-ba4f-887816d42c5a", "value": 3988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777232546, "uuid": "acc17894-758a-4b13-ab73-a40cee39d35a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232546, "uuid": "dbf0fa63-cdd6-4ee1-bbe7-e9887d2a74e3", "value": "cometome", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa440b91-4195-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777224648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777224648, "uuid": "ac20ad4d-8e5f-4c4e-8111-aae5db46a791", "comment": "Malware payload", "value": "e76f9a750c56466aa9086506bc7e9174", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777224648, "uuid": "bc998833-6e29-4844-ac52-bd2d2c76139e", "comment": "Malware payload", "value": "779abd34660f74072b0da4593db8e4639ce1c920ce394ca613dd85f94fc4019b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777224648, "uuid": "80b54b9d-d6be-43db-9b06-3f0307b99ceb", "comment": "Malware payload", "value": "1ae6de3d15fc9963fa03e65ba0e7456da82d4d25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777224648, "uuid": "4aaa1b58-e153-4c79-838f-a5454ae8e7de", "comment": "Malware payload", "value": "b9cb82c47fd75d1697e94429649dd965cb6181ecd125d812c46bae3225dcd5c23bf0bfdc0acafb84109eaf1c3ff793b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777224648, "uuid": "7b27311a-9dde-4e42-8d7a-515577b4246c", "value": "T1BB17BE77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777224648, "uuid": "2b13da40-392d-4562-9df3-9865dc2a2ecd", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQF:cqYUQuVDt0TZEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777224648, "uuid": "0507d53a-7d81-478a-b2bc-16cc6d2cb835", "value": 19562496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777224648, "uuid": "e1325e76-1afc-4af8-9902-22de5373f729", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777224648, "uuid": "61e26bb7-ce13-46dc-85f0-b9d62dcd5db6", "value": "779abd34660f74072b0da4593db8e4639ce1c920ce394ca613dd85f94fc4019b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6db5ed2-415e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777201154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777201154, "uuid": "e9fe1fb5-6706-4324-aa30-1b0f276b6717", "comment": "Malware payload", "value": "1ae4ec3edddd6ab1a93977297f463802", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777201154, "uuid": "284419ac-758f-443e-bff9-7205a025180f", "comment": "Malware payload", "value": "78eacc40787c0ad9c3a06826065733f75416aa70eaa48abdcb11cf83289d60b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777201154, "uuid": "8e9b2747-a2c5-4b05-a1d6-1eda4a7874bd", "comment": "Malware payload", "value": "6fb79ae7dabff56a601c380b338d534932b0e272", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777201154, "uuid": "c4af057c-4fa6-4c35-b702-c76b41ff418f", "comment": "Malware payload", "value": "1110b57807e4e0db04d722749ec6b5e77b038d4982fc116af6907dc7210517bcbf20b82bd017819049420da89d1870ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777201154, "uuid": "bb987200-401b-459c-b440-27bc7ddcf4eb", "value": "T12245E0C3F18808AEC7EAC23CBA424C445F6CD465A5F16B6A1F5D80397BABB15DC2D790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777201154, "uuid": "41c9dd8d-bda6-48f9-823b-6a501b091b60", "value": "24576:vdm3e9ks7EZNceQ06OyRwCiz4bMIHjarbtp9U:voZlt4wCxMEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777201154, "uuid": "f0c8e765-2b66-4af4-9ec1-9d97f8c5e7b4", "value": 1251696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777201154, "uuid": "1d0152c2-a741-444d-952c-49a456be9e5b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777201154, "uuid": "d1973c34-6f26-43b1-a397-c9f14f2af2a2", "value": "earnify-client-armv7-linux-androideabi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4fb534-41a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777231869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777231869, "uuid": "58d8cb59-62af-45c7-ab2a-078c34c92f9e", "comment": "Malware payload", "value": "7d5ee7fa5512098d53e4510f0f6c8fb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777231869, "uuid": "70eadd17-f0ee-42cd-a614-aca859fd2897", "comment": "Malware payload", "value": "798053876c6129c9e0d16548b0266cddf49dbd06e8a949afa3e8129431e0a9ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777231869, "uuid": "72d91dd8-5b66-4306-8165-d1cb79839a68", "comment": "Malware payload", "value": "6875b2f40262c8fb3ff4eda701716361c381f852", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777231869, "uuid": "a8a4f4c8-959e-4ebc-9e78-be01b70ef86d", "comment": "Malware payload", "value": "dc0f025fcb4339bbe44b884f60d6db198a592f008a43770dae1fbd38be17dc49f7ee838cad04aab119ba2661e42a3bfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777231869, "uuid": "c3a2fb2e-d420-4a26-8e4c-d8cee138339e", "value": "T17505DFD679887C4DFEE45178D0AFC3A323BDEFB49DA387439228A5321D579C12991382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777231869, "uuid": "7060953c-4249-408d-9709-cba6c85174e3", "value": "af7570de216f318e0305ac721830d4c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777231869, "uuid": "cad282ea-548a-4cfd-a867-60330bc140cd", "value": "24576:3YbSu7+OXQe2BvUF+/s5S0Y+IkBA+Op5O8S:SUOAJB8F+/5Vdk2np5O8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777231869, "uuid": "504ee50f-0955-4fa5-8cc8-60dd957696f3", "value": 837571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777231869, "uuid": "6952e092-66b4-421e-9358-8d3225b0a562", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777231869, "uuid": "27e9a08c-a2f7-4916-8d12-8865bb3293ff", "value": "SecuriteInfo.com.Variant.Tedy.893733.16455421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4832d528-41b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777236939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236939, "uuid": "ae291bfb-ea8e-4920-a79a-77d4933eb160", "comment": "Malware payload (Mirai)", "value": "91214d62b241d629fa7f16e70f0672c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236939, "uuid": "bde0400c-817f-4430-ad09-7b329b4a407d", "comment": "Malware payload (Mirai)", "value": "7a866c4e71afd71f03c2b33e527248b651c1a75717fd0a75ab1641a4c5f14f75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236939, "uuid": "4e596333-d027-4c16-b1a6-aea113d2c4f7", "comment": "Malware payload (Mirai)", "value": "42058dc70c93e6337db9af4f3de8be6ffa7db459", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236939, "uuid": "3a07ce09-7c4a-4b9e-a2c4-fdd762dc7d67", "comment": "Malware payload (Mirai)", "value": "6adfa4b108616fea4de75d202cde63371a3792b40c4d207c7d1572a6c3be6e84a786feb453664fe9435f523f6ad31687", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236939, "uuid": "5b4d5ce1-3e72-4cf7-abb9-48d53ccd2f8f", "value": "T17903E15061FE4BE2D65B40F674BE244E3750D70DAE248CB3BC84F9B25ACAF4C664A097", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236939, "uuid": "059cf1e3-8652-40a3-ad47-6f616f0a7e6d", "value": "768:0F1DbfTrL3QX9bKWjN+qGTnedgI7WzzZag789GGh/YFMtLynA1nbcuyD7UHQRjy:07/fToNbKWjwq6+gxzN7DDMt+nenouy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777236939, "uuid": "091a809c-9cd3-445d-8f72-4542cc3777c9", "value": 40380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777236939, "uuid": "e91b1e3b-0a1d-490c-80ec-e10f8db50cb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236939, "uuid": "83eadfd3-6203-468b-baab-4801452e55bd", "value": "023782pler.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbce57fd-41a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777231603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777231603, "uuid": "cd945e01-6527-40ac-957f-e2587ab5f562", "comment": "Malware payload", "value": "736253526169f4682d585bddbf544a58", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777231603, "uuid": "f764c857-ee30-4d1a-8389-40a7bad4a58e", "comment": "Malware payload", "value": "7b64dae6b3c9dc97829514f5e8c83642ee39bb14ffb93967e71d42d53831f57c", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777231603, "uuid": "d63b50cf-a776-4887-8268-b598ed267bf2", "comment": "Malware payload", "value": "6d7d557c0932a727cfb8fbaf55fb7ff6c0039a02", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777231603, "uuid": "fa90304e-3061-4b3e-b5f3-dfdcb95b9d3b", "comment": "Malware payload", "value": "3d39863d862bbf64f5acd12c5563ef5042be1d4b02d5827d5e753082a5b07dc915c54adce685d887432a110a2ea887a4", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777231603, "uuid": "31a0e5b6-1b7d-4e15-9907-8fc4940d6476", "value": "T198B57C02789105FDC099B73248F23691BB35B8080B3627D32E96AB783E37BD15D7975A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777231603, "uuid": "2aa85fe3-b8a7-4c8f-88b5-dd76eeb7f819", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777231603, "uuid": "520da1c6-4eda-4bff-a0e6-8608e310ac16", "value": "49152:YhuM250Ug+Fi1/FN8r0YX8nOOKvcXw8GRYDgjxdi:Y2bo1/20YX8Kc7GROg1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777231603, "uuid": "82bd0965-3825-4faf-87ad-59869689463d", "value": 2486448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777231603, "uuid": "84d498fc-6ce1-4d74-88ec-032df65ef127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777231603, "uuid": "87421d1e-05e9-44ee-afca-dcf731c71434", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38b2f86-41cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777247884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247884, "uuid": "b6530e59-31de-4b73-9fbb-8aed982cec08", "comment": "Malware payload", "value": "438efffcf6f8e1f2346a71f53859ea60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247884, "uuid": "285c9c1a-c37a-423c-9152-587a263a92ce", "comment": "Malware payload", "value": "7c74da0acdc43b599890548f5c3849eb96b4df63cf8ce8de6ddccaa300a682b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247884, "uuid": "ebe36361-56ce-4ac4-a119-4ab69259794e", "comment": "Malware payload", "value": "7ce053cae106989276915e53790ff6c56e35dcc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247884, "uuid": "76413855-a69b-451e-8cef-c61cc2a6ac6b", "comment": "Malware payload", "value": "c86a4412df8ea5ee49878b8b52691f26b01344f7f54a51a87c33665588471fe4410f1c5e9c5541c3201946ae6a1933ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247884, "uuid": "28c1404b-d226-4d33-945a-88e3bf982069", "value": "T17E930749FD406B10D8D635FAFF4F024973934B6CE3FA7201AA245B2523CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247884, "uuid": "40b32f48-dc20-43d0-8c15-6d8b167eccd1", "value": "1536:wqnZK8D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1Ygn:C8NUv5nTacgzafVAwe4BNRIbT2gXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777247884, "uuid": "8f7c6b9f-9e77-4f32-822c-a4962e3372d0", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777247884, "uuid": "bb74a1ec-2198-4a2c-9890-08cb6358d9e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247884, "uuid": "4c4aa3e3-ab1d-4366-835c-0c6fa8a1d999", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c4c20d4-4126-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777176897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777176897, "uuid": "7b8f8e57-db67-432a-b5a9-8a7e2b8c3b62", "comment": "Malware payload", "value": "7d157495f9060eba574e13879fdd5960", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777176897, "uuid": "fc53f27a-15f4-489d-927b-55e6287342a8", "comment": "Malware payload", "value": "7cedf35cb4eb956c15bfccd2d4eb0d2066ae62ff1106da48d777fe13a6b53737", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777176897, "uuid": "46179e4c-ee60-40c3-981c-88ae52ed4149", "comment": "Malware payload", "value": "285522c0771f8ef1b362b31b24b76c921ba27800", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777176897, "uuid": "3f5a4c00-6c67-478a-928a-775314aa9e42", "comment": "Malware payload", "value": "54074c5c29d9e43d3125f54f852270d92ebf1c6c021616117466c377941aa3f1726e9dd2f9c79e456f11e3bab08e04da", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777176897, "uuid": "5f023c8a-c13e-4a88-b99e-9f3a1edb1c91", "value": "T1DBE02B1998CDDB325628012B0F1F6950F1430257BA003575711DB7BACF0F0679AFC0C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777176897, "uuid": "22b56b91-2f10-45eb-9615-28884d0facdb", "value": "6:y2agkwEpXmJ/wI7dIGJndqFF3KeQKN3FC4wQ7KGt/7W:TR4ILxs/3KeQ81C4wQt/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777176897, "uuid": "9e7c6d08-794f-4262-81bc-da0048183004", "value": 299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777176897, "uuid": "2beb6f15-527b-4e4d-8d9a-2f35cb08ec42", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777176897, "uuid": "8c54b531-37e6-4721-b593-a4854c38f144", "value": "AMCJmBYLEh.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b90ec5-417e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777214838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214838, "uuid": "847705f4-32e1-463a-af9d-962b45bc32e0", "comment": "Malware payload (Mirai)", "value": "f1ecb3c68b123c9c29ede1f90c4c047c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214838, "uuid": "39a4b219-1888-416e-84a2-b7213efb0dd6", "comment": "Malware payload (Mirai)", "value": "81e941f34934d6a06d89b2aad020eb9c7aa135f4735d38e99742e3b86a336d29", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214838, "uuid": "aa2ddf9a-89d0-4842-b47f-19e6d61a3ec9", "comment": "Malware payload (Mirai)", "value": "76774d50717c5c47dfb7377f36e71433afbbc1c1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214838, "uuid": "62400c1d-042a-4afd-971c-4d1dc8c442c9", "comment": "Malware payload (Mirai)", "value": "eaba5f3400d174b67282a5c3f9c30689dadee913f74efc97b6be73e8a8d9353cf2d4c5a9ff7178a0d9d1f898da11abe3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777214838, "uuid": "f999f45d-f577-48cb-a09c-4b34298778df", "value": "T1DDA3E849F9646B19C3E232FFFA49428F73171FE8B3EA70258E305BA033C5AA51539525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777214838, "uuid": "81529b31-d078-4b57-9902-387811dd23cd", "value": "3072:SxsW6X+UWUa3bzF9s6a9aaeSjxXW1N+fUn/3jPy:CBa39anQxXOnLPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777214838, "uuid": "164fe71b-80b7-4a11-82f7-c76fb1cd9969", "value": 102960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777214838, "uuid": "4d36454a-6718-4627-8d8e-138b55e348a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777214838, "uuid": "19fdcb80-7e2f-46eb-9248-ab35cb6d79e2", "value": "xdf.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eabd85ef-418b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777220461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220461, "uuid": "23682feb-9f45-4c1f-b2b7-bba6741af10f", "comment": "Malware payload (Mirai)", "value": "cb6fe555c9b2ec83fedbac59016a5a62", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220461, "uuid": "7993a0be-52e0-400a-ae67-0e5eab7f8975", "comment": "Malware payload (Mirai)", "value": "8279ba73ca800f9ba6ebe31559dc9548487d569c0acacd01fd2a4fc8ca3ece90", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220461, "uuid": "8a7020f1-91ac-4643-ab40-aff2dac819ef", "comment": "Malware payload (Mirai)", "value": "f880c0c1f8388d54571cd19b9cef5be819db6b9f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220461, "uuid": "4c559ed6-60ce-44cb-8d7a-e1df8c9d6767", "comment": "Malware payload (Mirai)", "value": "a5b68836ba86eedcc5248692a675e7fe051a9666ddc5316302bf7b30f5c16da74e03d62b09c0a65ba12c795a0c19c703", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777220461, "uuid": "ff9a428e-9c77-4756-96e2-a7d8e94d1fd1", "value": "T12601CCFE95A265764458DEC8F0A35834B01FA3C431E05F1CA5AF34AAACD7A05B42CF26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777220461, "uuid": "0b497687-bf09-432b-b355-6e4151f4bdae", "value": "24:boWBG05pELMk0aNwNiqTd06X9XnjXsXiiCXmXSKh:boGGMpzavgficM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777220461, "uuid": "da7cb4ba-d9af-451a-9d4f-9c53e473ad2e", "value": 847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777220461, "uuid": "4569d56f-a9c8-45a5-af02-cfc9446dc978", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777220461, "uuid": "ce26e949-9f1a-483d-8a61-1dfbf3a726bc", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597f057a-418f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777221936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221936, "uuid": "5b49e1db-3152-4574-b699-0efe22ce732c", "comment": "Malware payload", "value": "2a076561751c99d31e6bb5d2687bd2ea", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221936, "uuid": "40f46327-6c96-47d0-be6b-d89224c03661", "comment": "Malware payload", "value": "82c69de4472e85596e1f228da74bd8c8eb183221feab7f82d940e4edc23185d0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221936, "uuid": "ab6ed1b9-b552-443a-bf92-927f17e189b2", "comment": "Malware payload", "value": "ea3c59334830983649708fd0f4fc53639f97170e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221936, "uuid": "ed0f69ca-4942-4ab6-b066-2fc83b5cbbe6", "comment": "Malware payload", "value": "2fd612d43cb7523dc651b8074c89ec424cb17e379938bcc2c000c71294becdba0c655861f4c0a40eceb160a030ffe76a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221936, "uuid": "49b7abcb-0148-403b-ba4a-4750a669cad2", "value": "T1C515BF72110FBE99376B0E84B1053D45AC6878AFD39C815CFEC80BD992BD9A4DD68DB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221936, "uuid": "adf4ce92-62fd-4720-87dc-385e63e06e9c", "value": "24576:ZM5FR7An+xFq60cOagnFnihQnxhXfk9YkJRUQY:a9rOa0iOnx/9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777221936, "uuid": "1490dc0e-9b52-4085-a8a6-c5d4ebe17ff5", "value": 957480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777221936, "uuid": "2cf0112f-ccd8-4bd9-845a-eb395790fdb3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221936, "uuid": "82cd70ee-f038-4dbb-a694-fab62f4cbfd5", "value": "svchost.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92449956-4172-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777209576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209576, "uuid": "9effd06c-3ce7-425c-88f6-271d605a90da", "comment": "Malware payload", "value": "c5ac6fa0172fcfc2821424a07f94cad7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209576, "uuid": "1a8f22e7-ef2a-49d6-bacc-7c29fd70fee4", "comment": "Malware payload", "value": "83fe8ae77a984f293bad7ce27820bb7ddbcca6e150acbc0d662a548cef96915a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209576, "uuid": "b910abf3-4c76-4d7a-86c4-ec270162f371", "comment": "Malware payload", "value": "8266b0ef775095d5260fd44e2267a9a3554c2c74", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209576, "uuid": "58712f27-34bc-40be-98af-84330c0b3769", "comment": "Malware payload", "value": "c521943d8a82ad2b4c7f6383397cefee9f3af66a5eb57202fe2f1b5e3772c43f13880f38b0e6caad6789b7ac48434234", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209576, "uuid": "55b3996d-b136-4155-9845-82cf8decb9f5", "value": "T10471DC9729E3D972FB8784785B5EB800F38DA04308A5A854F98E78A03F9D150FCA4F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209576, "uuid": "a351374c-1991-4456-a7de-d260d5314ad9", "value": "96:kmiUdHb/GmZrYo7Xq6Ibt/1Y04S4o77Bl:5imbUsprSh7Bl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209576, "uuid": "60d3d440-d924-4d7c-b0c9-2835eecbdbf7", "value": 3671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209576, "uuid": "c10e219c-25ef-40e1-b38b-ad9dc306d706", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209576, "uuid": "cfb534ec-6f13-4f5a-88b9-6f4a082e0664", "value": "init.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a865c3cc-415b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777199734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777199734, "uuid": "f70cfd05-cecb-4341-9f28-6281278b56f5", "comment": "Malware payload (Mirai)", "value": "200c1d2b72f46e5518ba1fd578a129c6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777199734, "uuid": "8f546ad2-c1e4-4d3c-88c0-96ce45fdede4", "comment": "Malware payload (Mirai)", "value": "85e6f2f66c5827ecb7172ff8150872b5e4316ca57f81d858bbce29f4dde4bf1e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777199734, "uuid": "4f09ae8c-f123-406d-8238-9df0977fc3cb", "comment": "Malware payload (Mirai)", "value": "d05ad31f65149b3f1908e49383391dbad1e759a3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777199734, "uuid": "817ff10a-0efc-44b9-99ed-950f28c18dea", "comment": "Malware payload (Mirai)", "value": "9cc0f6af48f661e4cad6fec659ee8bded33b528fa541c934d6e79c8db7c59a50f73e35b74549ded0a0f18b84799ccc44", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777199734, "uuid": "7782063c-5278-4a2c-8e47-0ea28083b0f5", "value": "T1750128F4AD98B03EBCE9BE1C38A54455B877542B35D6388989C63B638598504BDC8E2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777199734, "uuid": "7906abe1-a580-468f-b058-19fc0134b062", "value": "12:dfJcEKEYk+zfJcEKEa+zfJcEKELq2oNJuEu9WUjJuEuk3JuEuSoNJuEu9WCGLJ7z:lGcYkiGcaiGc+2oNY9WUjYk3YSoNY9Wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777199734, "uuid": "e5ecacc1-719d-41db-b850-975efb0098df", "value": 720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777199734, "uuid": "bab3bd01-8423-4c4b-9378-9a8747f1907b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777199734, "uuid": "e10dbc64-88dd-471c-b32e-4c359c6f6450", "value": "lilin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c2a2b02-410b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777165247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165247, "uuid": "cb3f1d54-8a14-4b27-a8d5-5e9b24752a32", "comment": "Malware payload (Mirai)", "value": "2507a8b00c792c554a6518eba70cb19c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165247, "uuid": "69234ad1-9bf7-43ba-8e58-94517ea959eb", "comment": "Malware payload (Mirai)", "value": "860a38800f9165b3a7f954a29ad31f5b8872cc3a4c4fe8a492f78f518300cc2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165247, "uuid": "70d3130b-b908-4ada-861e-d8fc61a1888f", "comment": "Malware payload (Mirai)", "value": "1ab3fca47d493c7287e4b5c27a1fbe4d503e6944", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165247, "uuid": "14f5a64f-8364-4074-9c78-7034568cb45f", "comment": "Malware payload (Mirai)", "value": "b28e85b430e852f6965cae7fa90460854008991e8d216ed3bd1f51d729f3c4dc3e623038df29a9c8595b92db7f5fa2d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165247, "uuid": "17695784-5483-46ce-9f9f-7f06658f31e8", "value": "T1F56302561512B330FA5A5CB9F0315012BFF63B7CE1B7B0602255AAB975D30C22BFE229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165247, "uuid": "e8586f96-8703-4296-8ae4-76d3031f50ae", "value": "1536:NUAzVZ7iwHkNFjffq2ge5ss87VKrs73oX6Dpe2F8QN:N3VQYurfq2v5F87ErADJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777165247, "uuid": "c1d7388b-25df-4ae8-9d59-eb243b50e0d8", "value": 70460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777165247, "uuid": "f1f04d39-e031-4591-a5aa-004bb580c8f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165247, "uuid": "2df2dcf5-f16c-41ee-9658-8fdb560b080b", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cfb36bb-4181-11f1-a769-42010a9c0008", "comment": "Malware payload (Xtrat)", "timestamp": 1777215821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777215821, "uuid": "d3318af3-925f-4055-8fd2-c23977be27c2", "comment": "Malware payload (Xtrat)", "value": "0f2e439cf0f17934a90f1346a77cf5d6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777215821, "uuid": "14f623a7-251c-4e57-ac1b-00661d38c31d", "comment": "Malware payload (Xtrat)", "value": "87ddc42768bd7ed76bb45245c5c134e97c840d97cab89936f8ad996410fb5371", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777215821, "uuid": "35913470-01f2-4b86-8a17-7a3a977b56d5", "comment": "Malware payload (Xtrat)", "value": "dc6477c52743b179607c7fcbeb462637a9179c40", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777215821, "uuid": "4114e229-875b-4af8-906e-1c71e72ee864", "comment": "Malware payload (Xtrat)", "value": "5aef453f6fdc7b96cbc07b2583bab195d5946cd2b73c980d360d7e30043cbbb6b027eea0bf3566eec28e11e1054e4185", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777215821, "uuid": "811f64a3-72f7-4c1c-b99d-ed4abcb596dd", "value": "T1ACC3829383274502A3BAE08C11BE17D7AA9FD5BF9278400DE7CF586C969D93891423FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777215821, "uuid": "c0851054-8650-443b-a869-3389b4882ce3", "value": "384:ElfQp1lA777AKZsnOvu064vYzpKCvdwdwkeTAsNund1CqkeTAsNMK77OScVIwRUW:NI2FWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777215821, "uuid": "cb64b89e-549f-4557-a441-bc8dd04daa22", "value": 118982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777215821, "uuid": "a8498b10-7c12-48e4-999c-8054280cfb30", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777215821, "uuid": "830f3b30-f256-4347-99ad-3f1038bba17f", "value": "server.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26949b1e-41aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777233447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233447, "uuid": "78419bff-14dd-4f7e-904d-c99a8ae6f49d", "comment": "Malware payload (Mirai)", "value": "5aacc1d85f02a8983fc62f03ce352c44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233447, "uuid": "233df690-9496-4e15-b943-d06d6e67e38f", "comment": "Malware payload (Mirai)", "value": "89ee3a5b60028f71aa74fb56cb49f5c1c9728100fa47e6bad9fc3519a6332abc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233447, "uuid": "fa4ac966-56a8-457b-bf15-358c5c390837", "comment": "Malware payload (Mirai)", "value": "835a5b070839f81d2403f27b7348fc77d5d6eaf5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233447, "uuid": "45f9feb8-5f9f-4fb7-a2a9-9bf6e7073b62", "comment": "Malware payload (Mirai)", "value": "c6ff0b4ee2c41fede42da4491d74a99b2e9cb4e03f1bd25ab3e2419af6ff534018d13d60b9427ba9c1234f85d332687f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233447, "uuid": "a3605ff4-a403-4368-814f-d3557c592ed9", "value": "T184A32946F8814A21C5D512BEFA1E318E331357BCE2DE73129E14AF2173865EB0E7B616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233447, "uuid": "20e1f5fa-c35f-48a3-a453-1b7680adb117", "value": "1536:wAnTSlO27kf5J7ZLBpqpp8GBgHQxEE3k7uaRrtOXrD0Rilp2x/F0v7Xh5GYW56:ilRbpp8Suik7uaRgp2x/F8ThUL56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233447, "uuid": "f5a8b19d-d6fb-47c7-8eef-763eac44fdb0", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233447, "uuid": "5d8f36bb-2137-45d7-a33e-391b48afdd42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233447, "uuid": "813805a7-4d3d-4462-befb-7e8e8b2ea54f", "value": "luxzz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc6ea9e-41a2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777230207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777230207, "uuid": "b8982557-45e1-40ac-90ae-394376e91e47", "comment": "Malware payload", "value": "ca52485629c2c8d92077d03832b09a56", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777230207, "uuid": "3f1c83d7-c73f-4d48-b8d1-b2c0bfc4822f", "comment": "Malware payload", "value": "8ab5051916ec795a4346f808836b42d108d8fba32671b8c146bb4d2c30cc72c9", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777230207, "uuid": "8f7ec82c-940f-42d4-9521-5e732ac22ae4", "comment": "Malware payload", "value": "6550e20dbe7a63b1d394b8ffe4881f2f73f2cce4", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777230207, "uuid": "a8a96bc1-cf0b-4682-b591-827f434dfe83", "comment": "Malware payload", "value": "166c0078135c93838cbe8f55de2cdd74cdc9a2e917547f6553b00105849139202f605f6b4624741c0ac361680cdc1d63", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777230207, "uuid": "f8be36aa-ec54-4085-9dc8-61d9cb2cd053", "value": "T115D324CA4D9EC8EC8B5FA41D052F5C1BCA8EA513052DC5907AFEAF463F21DB075A98D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777230207, "uuid": "df90972b-d2aa-4d50-b369-9b42b8d2fa8e", "value": "768:3IXXeO+8fRhDf7LXUNsj2BNOcrg3zSFccvF2HI+9E7CRorgr1QroR1WXYR9RjJHY:3aR7LXWgr1Y48b8vT41s5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777230207, "uuid": "83e2bc59-4d5e-4af7-a555-e01f5d29235a", "value": 133179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777230207, "uuid": "c784d90c-2c14-470c-b562-65c3bdbdb94a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777230207, "uuid": "c134ea3a-c199-4210-b69a-b30ac30ed1a1", "value": "Logs_France__65.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1f2f24-41a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777232575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232575, "uuid": "1d1b8191-916f-4257-b956-95e97a81ffc8", "comment": "Malware payload (Mirai)", "value": "4979934544bb6566e194b2f8908d3005", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232575, "uuid": "c4010ed6-b447-47a3-83fa-9406e4090dfe", "comment": "Malware payload (Mirai)", "value": "8bb7735c75b560acc51afa96559e892e062994829b63d89cff0b29ef91e6d2c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232575, "uuid": "27deda6a-de0b-42f2-9acc-3e33b7099c3c", "comment": "Malware payload (Mirai)", "value": "251cdf6f627e7ce499bc81d0efaacdc61e5ad987", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232575, "uuid": "e255dbcc-54f7-4aed-bfc0-fdb270d2d600", "comment": "Malware payload (Mirai)", "value": "3ef1d38050a84842acf94b5000619eddb20c80dbea4dad8b38251cd88590a1804f29bb5463eae687922bcd7cc8172b9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232575, "uuid": "65db3cf7-bf67-4202-b78e-ef9b865cd1ad", "value": "T190B3398EA5A25F77C016B0B078B96C750B19B9C42B5F2EC57579A7A0434F5CAB00EF38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232575, "uuid": "b558d56e-092b-47d5-8f67-f924d17f9ce5", "value": "1536:H7cuYMoArgXrdeQEe0EE9LFgbf6Wm9Xfa/uEsK+bKKjwE7hitRwCAQdVqWGk3s:bB6eQEfExfVmyKRItRw0zP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777232575, "uuid": "e7c71d1e-36f0-44a4-9ca3-69e223605df6", "value": 115736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777232575, "uuid": "79c27729-7fcc-4e39-b20f-501e9da2f45b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232575, "uuid": "788a638f-8b75-4cfa-bca4-8f206f5496e0", "value": "shabak.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4fd0d4-4171-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777209244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209244, "uuid": "f79f3ffe-ae38-488c-a7ff-6cff1e2b3d96", "comment": "Malware payload (Mirai)", "value": "492f1c23b6bc9e3740b2740206af3f01", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209244, "uuid": "f7b74bf3-f8a6-46c7-8695-b33abea4987d", "comment": "Malware payload (Mirai)", "value": "8bd7a26b5cc77024c44e5d4de44d63a05cee9030cde6395042ceb52b5b0c119a", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209244, "uuid": "011130c4-7307-45df-97e5-f93cc6c38013", "comment": "Malware payload (Mirai)", "value": "7119c924512584489560bcd304170810a5b91f55", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209244, "uuid": "c3b171eb-169d-49c2-a9b6-2bca7a2d5cf2", "comment": "Malware payload (Mirai)", "value": "cd74a95623b1e790af4cabdfbdbdcfdb4aa0bda7871085a876bc5d75cf2d66100287a318cb0512a13debc8d1cf807661", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209244, "uuid": "554ce1ed-5c21-4379-94e5-f8a55fc9a457", "value": "T1832301C3726FDDF9CBF6493D281BC9D8BA0181197F0A0BDB419E22D8AD685C23E12561", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209244, "uuid": "d133e06b-34d4-4ab2-9b71-f8d296bc2cbf", "value": "768:rYlu1gzShvupCJk8hRIE3kpNwWa0xeKyxEy2e0baN/fCzJA4y:JSzSxupEl3kpNTxe32TaXCFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209244, "uuid": "80c32cda-e106-478a-9548-0319231013d5", "value": 47784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209244, "uuid": "5ab63ef8-2927-42c8-a8bc-855fa8587267", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209244, "uuid": "8baa4e3d-a808-4924-8b9d-c9d2e1e734a6", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539cbd9a-41c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777246837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246837, "uuid": "f6426986-1afc-40fb-a8b7-4994363f8a14", "comment": "Malware payload (Mirai)", "value": "12b43bbb01b9e2893783d03f433b84f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246837, "uuid": "b5faa353-2ada-45df-a340-b55adebbd191", "comment": "Malware payload (Mirai)", "value": "8cd95e2f3f89a0decccce8f5a26a4d140a64e1bd4aff10ec3097a408bea298b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246837, "uuid": "401f44b3-ac27-410b-abfc-cfeffa3eaf64", "comment": "Malware payload (Mirai)", "value": "8a9418a42d7def8b9d6daee61f3cd916551ea870", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246837, "uuid": "08fe38a7-a2d9-4723-b5bc-e3e0829b5ca9", "comment": "Malware payload (Mirai)", "value": "5dafdecc6e553111cbb650f0c62eb100645123888eb458744ea62aa059187c58d9d5f4ad9b3556bd0f9808a0a7d4b9b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246837, "uuid": "71a849f3-8e16-49ef-a4d6-c93ccde82686", "value": "T153F36D52B802DF6DE85FD6BA41B30B19A621E3185B630617E316BC9BBD331E46E1DF40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246837, "uuid": "6349609e-e437-4022-a9ce-1cde0a6fd117", "value": "3072:by0X2urGBk/PoYdbbuaoHz7hEvrzewwsdtwc/+X:XX2urGBkHTZbuPwrzeEd+cmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777246837, "uuid": "5d64ccde-1441-40ea-b229-b62256a1ff7e", "value": 157553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777246837, "uuid": "16907710-e5a0-4a3f-80b6-df0f1741bc69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246837, "uuid": "1d9fa2b8-fcb9-4596-9731-25e9f7553313", "value": "Yboats.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "713b5424-418f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777221976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221976, "uuid": "405d8992-3ba0-4e09-8304-7993a3928e57", "comment": "Malware payload (Gafgyt)", "value": "87b5bdf7786f6d004c2e430ff5b692e5", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221976, "uuid": "047c65e4-843f-405f-bcc7-6f890c4f26a8", "comment": "Malware payload (Gafgyt)", "value": "8d6395d47d016ca7f896326f8c9e250791b3748780718d53f8c51452ecaf98bb", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221976, "uuid": "164d5d84-ca51-48b2-a552-225871e73407", "comment": "Malware payload (Gafgyt)", "value": "c14780429e4aac005451e0a6bd4b8a26cc3aa03c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221976, "uuid": "bc39393a-36e8-468f-85f9-e8b5355ad518", "comment": "Malware payload (Gafgyt)", "value": "753f66f9abcd79b7320eb2f4253b9ec5e56d5cfa90bf8bb1a2d5966efd94471a5e8d19cb336829b760efe56e911278cf", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221976, "uuid": "49ba8c78-39f9-4bcd-9e9d-ea2f361643b4", "value": "T1CEA31B05F9018757C1C327BAF79F474D3B3266B557DB33026A347EB02BC27991A2AA60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221976, "uuid": "435900d8-8628-4346-8910-d12296acfaa6", "value": "1536:2MYkb4sqkx0y7Q5K1Rj4tOSJv65hnKjOErjzTs2obqj0srQ0KnW64Xc7e:BlqhIjY65hnKjOGPoej0srQ0KnR4Xc7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777221976, "uuid": "c79b59d1-47d2-4c9a-bf15-926025e91986", "value": 104096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777221976, "uuid": "c4e2af50-68eb-4a63-9bce-96ac58e632ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221976, "uuid": "31e5741f-e01e-42c8-9053-283f7b9e3b33", "value": "fuckjewishpeople.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374df324-418f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777221878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221878, "uuid": "27eb8efa-f863-4917-8e4e-831fb92759bc", "comment": "Malware payload (Mirai)", "value": "03e41702c34d1d6688cdc48a9b6c3346", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221878, "uuid": "57014292-95f0-4b8b-89ed-bd21f68ffff4", "comment": "Malware payload (Mirai)", "value": "8d76e3c78b6cfa4c5aad31b96633f76b1277fe12210602663caecda72a768941", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221878, "uuid": "de3d2aa0-f0cd-4ce9-ba13-801a876186bb", "comment": "Malware payload (Mirai)", "value": "fe340760684c5dc568a3cdedded7e20c4a51fcce", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221878, "uuid": "ed5f2f62-7be9-44a9-a24c-8c9f0e793614", "comment": "Malware payload (Mirai)", "value": "7c97ab76a1ccfd136c1236cf2a76320517c60139510fffe1b11351f51a30a234e570fa8db65a61561e1dc46274d72f41", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221878, "uuid": "fcca5f02-1636-400c-9fe1-e2e79f81ff3b", "value": "T120932B07B71D0F53C0DB5AF029EB2BF14766B9E112A36181B91BAED057336B82523F90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221878, "uuid": "a5f4d7a6-24d4-4125-bcde-a6382cfe69b7", "value": "1536:v3HgV9X7apJv2pbwa9MCcrctdnUHBbWEIhN5hn3okO1jrFOeV6qDjaofSOe:vXS1apJv2l2bctdnFD5hn3b8jrFOeV6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777221878, "uuid": "69dfcac3-98c3-4e43-821a-e6382f5b4343", "value": 92910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777221878, "uuid": "30ec4c01-4365-41c8-abd2-5b688a405047", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221878, "uuid": "8a0a50e8-ebc1-47db-8120-fe2119c45a9b", "value": "fuckjewishpeople.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4484eac2-415c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777199996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777199996, "uuid": "17c0239f-a02f-4ab0-8277-dd91c67c0bfd", "comment": "Malware payload (Mirai)", "value": "cb72a814cc9f7f3363fc62c98fc4b74c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777199996, "uuid": "cc85cc55-55f1-4a14-bb73-5af61ae7a0a0", "comment": "Malware payload (Mirai)", "value": "8de046c6f9f59297820fb6ddd1cbc48bf09c8eb01a3a453f194430bb151a43f4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777199996, "uuid": "c960de86-9d53-4b0a-8533-4ca21582414e", "comment": "Malware payload (Mirai)", "value": "32850c508a0836535cf9d1af7c7329819da32521", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777199996, "uuid": "d3984250-a2ff-46c3-a1ca-4e11065b0995", "comment": "Malware payload (Mirai)", "value": "aad881e5f12de375bbd19b731578334e361464bd915d2ab458ee2422824d97745784cef91ad6c42c336503edc872a964", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777199996, "uuid": "ad2c023f-49c7-4531-9c9c-95e922b307cd", "value": "T13F3319B51516F2BCE9E22078F40720F529530A1C3ADCE2D3B0930579FFB5B48B96AD5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777199996, "uuid": "f9c3873c-c105-49ca-a3ae-da21b45fe15b", "value": "768:zMClhMqB0yBuKw3GoACzQyZRtlkABYxQJTUnRNww31:zF0vZ2oR9DtlksYiM0s1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777199996, "uuid": "8e9ae737-de2f-4e83-a783-bd357dd11d80", "value": 50632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777199996, "uuid": "be972c37-a5b6-4f71-b3e0-a0361d5ba4a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777199996, "uuid": "c430c9bd-3c1b-4ebb-afe5-52a4da003679", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3781fd4c-418f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777221879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221879, "uuid": "30ca2ed7-de22-42ba-8be0-3a3791ca892b", "comment": "Malware payload (Mirai)", "value": "4ddec121927868831e9ce4068cc9653c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221879, "uuid": "b9547409-d818-40a0-b29e-0754305bdc24", "comment": "Malware payload (Mirai)", "value": "8ed8fb973288d51cb49c2ef5a3f6270705b22b164b2516bb67f9e8608c393e7e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221879, "uuid": "860d8fb1-fce0-487d-97d1-2e04627cf29b", "comment": "Malware payload (Mirai)", "value": "4c789d71663a730f587a0f0bde5d382347815542", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221879, "uuid": "4efbae93-baa8-41e8-97d9-c300e35b167e", "comment": "Malware payload (Mirai)", "value": "a8f22ef8ac797f3e2ef71b076d599366f83aff2e52051eef48f21ce195c53668719a88a8ce16b0727cbca6e0b679701a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221879, "uuid": "b18b900f-0bbd-4f17-9e67-a184db3b1cd7", "value": "T1B0C3D757FB11CEB7C84FCD7306AA4602108EA99746D97B6B77B4DA5CE70694B08E3C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221879, "uuid": "025b4223-3522-4bf1-be85-e0de942a8b7a", "value": "3072:P+2uaXrIFfZZ5hnTSWQ7dwwBF9GhLRlge:G+rIZZZ5hnTSWQ7dwwBF9GhLRlge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777221879, "uuid": "9972ba68-ed19-4f94-8b9d-97eb01102036", "value": 118413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777221879, "uuid": "9fefff79-450b-446c-b82a-b6fdac5f70a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221879, "uuid": "2d94df51-7636-443e-8aa6-45335ddca99c", "value": "fuckjewishpeople.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0e6cd6-41a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777232948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232948, "uuid": "1cea0702-ce47-46f2-8402-8f64ebe6f680", "comment": "Malware payload (Mirai)", "value": "179962e909a20311886b60d38910fe50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232948, "uuid": "ce7cf5f9-12a0-4201-9f04-cfcbfdea914d", "comment": "Malware payload (Mirai)", "value": "8f1c948a45e78859db49091b4d5cec11d3d785174c21713d56524580d3f9ef4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232948, "uuid": "f1b6fbab-b8f0-4fc0-9216-ed15cfd9e625", "comment": "Malware payload (Mirai)", "value": "ba432e18497a12cd4cf293456c10d41e31c21696", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232948, "uuid": "a58e239c-92a3-46a9-9a91-8f5aa82c8e17", "comment": "Malware payload (Mirai)", "value": "518edc5eebc4d42ba39c0c718e7e218940a46bbca8ee69055b72dad9ebf826d11f98c26d0092e87cd63ad55bd6d7ac47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232948, "uuid": "18d05faf-a383-43ba-b2a4-c15ae48e3c97", "value": "T10FB30727B2D1DABEC097A1B027DEADA1EC61F4F80631710B33E07E616F6D9D16D09A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232948, "uuid": "cb04c55b-9dee-47a9-a19a-70ef102885c6", "value": "3072:BmqdFLLpF6XfRPB/x1V1/BTzCcJ9rODzEe/uNmR:BrwdPpTzZJgd/uNmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777232948, "uuid": "4def809b-ef2a-4145-916e-0a14d5a32cfe", "value": 108992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777232948, "uuid": "2967da52-23a9-41c4-85c2-4b5e097c968b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232948, "uuid": "af02c945-1951-4713-8e8d-5ea703da96b6", "value": "shabak.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac34cb8-416b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777206530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777206530, "uuid": "25e40cea-3a3c-4ed2-a43a-4a6d543f83e1", "comment": "Malware payload", "value": "b2cf2b018070dea3ec0241aac84e60a1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777206530, "uuid": "dd393891-7990-4ea2-9f00-c3dc9361a835", "comment": "Malware payload", "value": "8ffec3140d5d6256d76d0c2e598651bd94521fb20b48201855fa338bc0c28d3f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777206530, "uuid": "03eee010-40ed-4b7a-8d08-9528135504e6", "comment": "Malware payload", "value": "0859ff4781dcd1ed862c47ed5aac287445e2d99b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777206530, "uuid": "251a7d0e-b2fb-4fc2-b8ae-159b534be3a7", "comment": "Malware payload", "value": "0b76e368688b457f276051161fca0586e1de72b8fa812cf46bcfc57d3fc789f4174a6f81ef313a758f22bfcecb0b7779", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777206530, "uuid": "1414138b-8433-4cc7-90a4-35d382e56e4f", "value": "T160068D03FCA505AAC0AFA232897356927B71BC490B3023D76F50B6782F72BD5AD79744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777206530, "uuid": "c33263d7-5436-4a8a-b2f9-2b1b2bbd983b", "value": "49152:axoS9Wmch+E994U/ecTZanmONU562QulsCWPcn+INh+KR4GV6xjMLJ/OH04:axjWH+K62QulsCV+whpR4G2jMJB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777206530, "uuid": "0cc8c651-ee69-47fb-9ca6-aed062a56a68", "value": 3905495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777206530, "uuid": "048b7b13-3c62-4fa6-9a88-483ed9acf96d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777206530, "uuid": "6f406f63-b8f7-4b6a-8c4d-4e6d26257a46", "value": "tvt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8100b6-41aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777233427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233427, "uuid": "c1133028-3b4d-440d-b9d3-bc2ca8d24ff2", "comment": "Malware payload (Mirai)", "value": "a19bdc36f69c48cba0fdc187aad86b70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233427, "uuid": "67fa340b-ca83-4bed-904f-c8e842ec904d", "comment": "Malware payload (Mirai)", "value": "9091fc0a70bfc617df2272821d3fa1999dedfd9ae343da79aabde26e29f9235a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233427, "uuid": "f4a45301-a9e8-4aab-95a7-11f03584b9b9", "comment": "Malware payload (Mirai)", "value": "c13f37c88c854ffd3adc1388bb6d4ea044125645", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233427, "uuid": "14643f0d-2cfa-4407-b75c-396e1f6274d3", "comment": "Malware payload (Mirai)", "value": "956fe2f9e9211c31251bde26eff0a67f50137ac00e0e393dde214400e92d6e661a72d364847327819481ecf011dfb659", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233427, "uuid": "2cd831d4-4d80-4f24-b5b1-3f4d254c902a", "value": "T177044C46EB814A13C0D62779F69F524633239BA4D3DB33069918AFB43F867DE0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233427, "uuid": "a1d17057-47db-498b-9837-fbd124ced407", "value": "3072:/lE42o+DImaehF/h9PZpgBmsXCKiHUdmQy3d0fM/97ezERM:/lrKLaehF/h9RpwJCDH0mQy3dEM/9DM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233427, "uuid": "42671bf9-2b83-4cba-bd7e-23531539cde3", "value": 176507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233427, "uuid": "45426b6a-d479-40f2-b11f-74663dc37c94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233427, "uuid": "9a6f072f-5ca6-4863-a465-4383e4a149e6", "value": "luxzz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175e2442-41a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777232562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232562, "uuid": "ad989c7d-ae35-4b70-8b8e-a7741714b72b", "comment": "Malware payload (Mirai)", "value": "fe9e3b0c9fea2798e0554ca7f33989f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232562, "uuid": "1a2d6224-4704-488c-8823-97bb83c9a49b", "comment": "Malware payload (Mirai)", "value": "9126410c789b7aa366f7b17e3a6e80e89a9f5f31db74e9213de310d44d6851c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232562, "uuid": "dda445c5-982c-4e12-b314-6eb017eef922", "comment": "Malware payload (Mirai)", "value": "8b300c38174e770423e8c1a02a67e5228e8700dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232562, "uuid": "b8780867-7e50-43f0-a038-00ed193b8534", "comment": "Malware payload (Mirai)", "value": "0ea958bee07368e16562788a09550e48cd71a78d0e324319a72da45bc9050e63c699571efa44336e0b5c8edd1047e554", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232562, "uuid": "4024c730-604b-4a5c-9be9-9147cf744966", "value": "T1B5A33A91B742D673D10310F122DA9F211832FBFA2469E556E3B57DB1EA250C1EA12FBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232562, "uuid": "a7705d2a-a5e5-4195-bd92-2bbae1bae735", "value": "1536:aSnXtbrYHY/LQIFJNofx31hvCh1fSZyfP32LJI2ZZQnrLQ:aSX9pLQINofx31hKhZpXmC8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777232562, "uuid": "aff67a5f-ce1b-461e-942e-0a411f37a764", "value": 98168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777232562, "uuid": "c1d89ead-00e0-485d-a3b3-98b67431268d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232562, "uuid": "cf9fd513-e023-425d-b693-d2b4d9020994", "value": "shabak.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0589668-41cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777247878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247878, "uuid": "9a66787d-847e-435a-862e-e0bf3e81b6fa", "comment": "Malware payload", "value": "2c69fcc15e2ce164cf59db0a33edb4db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247878, "uuid": "bbf2c47f-35a7-40f2-b345-bd7569079c2a", "comment": "Malware payload", "value": "919b062d23bcfa0968319f56967965ffe8ecdbbc3ced30521d7448fa6433d7d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247878, "uuid": "30ba7ba0-a4ea-408d-99ed-d1e2a304d927", "comment": "Malware payload", "value": "38f14cd47895d13016f918e2e7f6af9908fee355", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247878, "uuid": "16db3098-726e-4fe1-bf79-b576e8a8a0cc", "comment": "Malware payload", "value": "e10bddd79e8e9d7710a6fb034a3be59ff589e91c4be67008dbaaeefcd3119520654c3c4c0f3251f07ae9af44e864731b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247878, "uuid": "953afb28-6256-4616-a27f-622151f6e4c8", "value": "T1D4E3B71A9F910EFBDC6FDD3302A9060635CC954722A43B763674D528F64AA4F4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247878, "uuid": "4099b3e1-7001-4d8a-950b-7b991825304c", "value": "3072:axjJw1Cc/0s6YAPwenUr48pzfR+Joney:axlw1xAop0YfRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777247878, "uuid": "86d63e51-309d-4010-9ce0-1f0608417a22", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777247878, "uuid": "b24afb44-713c-48b6-abf7-35588c2fa5e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247878, "uuid": "ed4e3427-8939-4c45-9452-fc6ec2bbb0cf", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c6efe9-41c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777245436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777245436, "uuid": "853af3fc-972f-474e-922f-68b042225ac1", "comment": "Malware payload", "value": "9ad7dc0e337e163cf3321763591072fa", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777245436, "uuid": "887be052-0312-44fe-b1c0-b5ff637ee31f", "comment": "Malware payload", "value": "926ba0cd4bbc68a20f282481aaf4426238820c1a57dcf74fe0bbcef57b018625", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777245436, "uuid": "6b03c0bb-3899-4301-bdb3-732b810974d7", "comment": "Malware payload", "value": "99ca2d4270311dd50c2255b1e5535fc097d41d97", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777245436, "uuid": "58b13e4c-e4d5-46c0-844b-9308b7e9ca0b", "comment": "Malware payload", "value": "77037f9faa240a196a8d3fda5b6a3d35239f417e44ddf568b6bc4095a9f433933d9fa5bf2e9c83853d593c8f67c5722a", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777245436, "uuid": "30a1b04f-fdd8-41d2-b340-efa7c98130cd", "value": "T1C1C1571057F99608B6F36F05AABFB561493B7A6D9D36DA4C0048C14E17F2A048C67F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777245436, "uuid": "b859eb95-f2a3-406e-95ee-3a52c8a1e143", "value": "96:pZyEBs5sZ5YBfOOFlkTFwpODBkhsZ5SNHAHXYEllycT44ERwcH6tHAqxADA6Q4QU:pZye2fJIqpcBRYE/ynHwJxeBFjlLMmd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777245436, "uuid": "b2034451-0cf8-4ad1-95a6-2dbbf6880e8f", "value": 6034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777245436, "uuid": "99cdffbe-aeaa-4238-8ebc-0198736ae990", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777245436, "uuid": "bc4aa072-bd36-47eb-84ca-8e6e535a6e31", "value": "zxftw.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5918de-4171-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777209192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209192, "uuid": "28e6269e-5e7b-4b65-999e-8a0e064460cd", "comment": "Malware payload (Mirai)", "value": "3b10b2f1eecac2f73e9c6f628978d2ed", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209192, "uuid": "407d2121-ca21-496f-a006-8692c87f47a3", "comment": "Malware payload (Mirai)", "value": "92ddfee8a7b64140c18e476bda2c3064ae44a82856962d8fa678753e4cdbad74", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209192, "uuid": "1f4798c4-8c5a-4732-a9d3-d74061cf9e32", "comment": "Malware payload (Mirai)", "value": "a8e43f87af1f393eac6435b87edbf4d6d9149675", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209192, "uuid": "929ebe0c-672f-4227-a0e5-eeb590b950a8", "comment": "Malware payload (Mirai)", "value": "db3836c296b99f092cb9dd9ce9643c7b5bec1dad7bbf594c373499ee94e6bb190e8d9e254445cb250bb19281356c06f8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209192, "uuid": "f761652c-72e3-43fb-8751-e958d93fb3a0", "value": "T1D5A328A3CC762F58C628D5B4B0B18F796B93AA6081475FBE1567C27480C3D8DF6063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209192, "uuid": "7633acef-ad99-4bb1-991a-52ecfbbb4aa1", "value": "1536:7NufPeqU2CVKCsNV7lsLPC9z+NzWuBx/3RhyXAL:YbU2RC4kPCtSzWu3/3L1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209192, "uuid": "bdf72a6f-399d-420a-aa92-176b18bd738a", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209192, "uuid": "2d7412f0-8a2a-4074-8f7f-c9912993e2ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209192, "uuid": "f7f27099-1f44-45d7-a9b4-812c535697be", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f26704-418f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777221883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221883, "uuid": "9b316916-eb43-49d5-b79f-28245ae3c2c0", "comment": "Malware payload (Mirai)", "value": "94fea368be9cf327ade675abce96a3eb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221883, "uuid": "f5109884-6092-4cf5-b1ac-b69e990a1a44", "comment": "Malware payload (Mirai)", "value": "935501d6b8d6f65c27ee5e6c8a5bdf47d8b13489637958a4a9f05a56b066db8f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221883, "uuid": "d90d8113-4dfa-46f9-a363-b250d2f6dca6", "comment": "Malware payload (Mirai)", "value": "9f7324d2d441b12c9705c9946f12eb945d219edc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221883, "uuid": "94e0b7a0-9353-40b4-a5cc-2de20d1f1e6b", "comment": "Malware payload (Mirai)", "value": "f247428325ce2430c6425bfaa760789d396b6757dc2a24d3712197385c3a1008e4360ec8983608badafa13dd3203efb0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221883, "uuid": "519134b8-f621-48b4-8f8d-33b4400dba54", "value": "T122A32B37BB130A23C0CA547211E30731BBB5D3D928FA5247B9916DEC6F2A6843526FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221883, "uuid": "fec7a747-2692-431b-b628-ce3a719c4dfb", "value": "1536:83HBfYW1nNM5pwt2tIJphaA/oeyZXJZGL/zOeF6OXj5ufepje:ELnN8VqphaA/ohZg/zOeF6OXFufcje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777221883, "uuid": "28e8f3dc-32bd-4a4d-9b54-6b735e5b8042", "value": 103232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777221883, "uuid": "0bb1bc19-f106-4597-b3db-5ecab63172a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221883, "uuid": "ab254c43-95e7-4ddf-9d0d-23335c79f62e", "value": "fuckjewishpeople.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c7c34e-418f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777221935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221935, "uuid": "69698095-57aa-405e-94e4-87524cf45e59", "comment": "Malware payload (ConnectWise)", "value": "cd8e87632b98101f851b68c7dc612ddc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221935, "uuid": "4beb7026-27d7-4343-8ffe-3bc7cd25a649", "comment": "Malware payload (ConnectWise)", "value": "94c50fe759a3053a97d45a0d44540a970790702b89ce3088eaa954844095eba5", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221935, "uuid": "ba84f50d-1b6d-4589-b147-6003a32a9ea5", "comment": "Malware payload (ConnectWise)", "value": "851da6655a6dcb9f7d715d171abcfe5c9abae70b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221935, "uuid": "42e6799c-56a2-467a-9443-df12da3aa847", "comment": "Malware payload (ConnectWise)", "value": "625cfdbc1e69c64774cc9b04e642a6d90ee12d8d6bb108ea2e67d00241a4a2cc98196de430a1dbebe51b09b955adbe5c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221935, "uuid": "8dc48987-47c8-4455-9e55-48dc5f7c9f03", "value": "T1EE646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221935, "uuid": "153ee535-545e-4061-a3ab-31000ca4fdbf", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221935, "uuid": "305e5f7c-8834-4f6c-ac18-efe5fe752d10", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:R1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777221935, "uuid": "2bb0c20b-1c04-4222-b9af-40e5499cb7e8", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777221935, "uuid": "7e1f05de-5966-4931-9719-57a27905824e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221935, "uuid": "bf6233c7-b908-4d40-9549-5063b0f1c2ad", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173352e5-4183-11f1-a769-42010a9c0008", "comment": "Malware payload (Vjw0rm)", "timestamp": 1777216671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777216671, "uuid": "c0ecab5a-ab85-4591-9dfd-3ddd97dd9453", "comment": "Malware payload (Vjw0rm)", "value": "9f6c3db29190c70d809761d5221050c4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777216671, "uuid": "aac421cd-2297-43ad-940f-58762c96843b", "comment": "Malware payload (Vjw0rm)", "value": "94dbfdfed823a9153b545ab799600684573a13e93d6159f434e2827a3e5ad920", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777216671, "uuid": "800e20ba-f0f6-4a29-a735-f8cd5d47c0e0", "comment": "Malware payload (Vjw0rm)", "value": "503acf33b15351ab2500f16d205350c1f91f5826", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777216671, "uuid": "bd32ce37-9b31-4e04-8cfc-aed2631e4148", "comment": "Malware payload (Vjw0rm)", "value": "4a9fbc67e791fafbf01735dc8480a2a63f2f1310a73b995efe61729e4b20fffa76221f44d9297507260101594b8de086", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777216671, "uuid": "9e3ba9ca-e98c-4a7e-a866-aec86889e808", "value": "T1E233F4AEADBB5A1F35A1C993B6D00187A46D2787B20F1F8419E18FE8075378DF469D0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777216671, "uuid": "fca1d531-a645-4002-b831-7046ecc423a1", "value": "768:aJs0b9YZq4+gJhFGKr9qdi6DEVu8/8lcWx:ks0b9YZqBgJiKr9CEr/U3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777216671, "uuid": "8981fff5-21f2-4372-bf7f-54e4ce7531fd", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777216671, "uuid": "5c92786c-f53d-49de-abbf-709c72d6a899", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777216671, "uuid": "4acc1a07-b619-46b1-a4a1-5e38415e44ae", "value": "dll.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dcd6912-411e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777173356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173356, "uuid": "7ba6adb6-6015-4c67-bd6a-d4160359709b", "comment": "Malware payload (Mirai)", "value": "c750541810f4665dfb838b4389677ac2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173356, "uuid": "d873b9a7-967e-462a-900c-4b48e7847505", "comment": "Malware payload (Mirai)", "value": "95867262e5a88b7f0af9e88904fac92050461611943f4c7fed8034253ecab5ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173356, "uuid": "7ecad528-95d4-42c4-81a8-47a6a9f0ead9", "comment": "Malware payload (Mirai)", "value": "fbf177d96d4dbd312b55ff13838d6d04deacfb52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173356, "uuid": "4b421b51-7ec6-4473-a93f-c1246fdd1aa4", "comment": "Malware payload (Mirai)", "value": "6fcd9617d8ab669031c04b9ffd1b0ca3b1eb6f06b5be2d5a05912fb0b03acd509aa3f1251dcabc902216fc7a8e8de743", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173356, "uuid": "00dee4ae-a0d8-467e-8d1e-26e918c1cbd4", "value": "T1CF2309C8F443D9F9DC4A09742036FB2BDBB2F6BA2329DE43D7A495236C51742A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173356, "uuid": "4c49b1c6-6625-4d64-b197-cc7baf6bc855", "value": "1536:6nJRT4QPfZfW5XTOeY3DvemAGX57/4Qw7bn2ige:Gv4QPfZfW5XTOeoZzJ7AQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777173356, "uuid": "a10693b9-2738-4abe-885c-e97997935cb8", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777173356, "uuid": "2143443f-f706-4762-976c-16d80915e902", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173356, "uuid": "afb89699-d893-4fed-a46c-9f3f5e0ac0ca", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4f92b4-41cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777247873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247873, "uuid": "75510e8b-9f11-49d8-9116-fd56d34e9cae", "comment": "Malware payload", "value": "09de5b225133753758890d99209ce466", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247873, "uuid": "9dee6374-598d-4ef9-9bb4-12cc1d1674a2", "comment": "Malware payload", "value": "961082df4ef13fd7cc589ffc7091d2764ca6f5f6f2af0416f4c76b2de1a781ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247873, "uuid": "6b1320cb-8564-47be-ae8f-f0354c6d4168", "comment": "Malware payload", "value": "301e1e1b4a2b56de99fbd74978e1014a98576b74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247873, "uuid": "1a4c1dc4-b935-4114-acc2-78c1685bf91c", "comment": "Malware payload", "value": "cd57b9a9b256b4f5c4a4d03ca31fb0e31c66043baf9f7e145adb0df58dbb5896c5838334f47a9fdff523ed980cb3552a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247873, "uuid": "37d7fa09-66ee-4cac-a161-649859f5bd12", "value": "T114E3885A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247873, "uuid": "b203c982-657d-4fe4-afbf-30b742112b6e", "value": "1536:p+fTcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4VxudbK:pYlybKpzEOfGQ+vEubTt4ouftL4CdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777247873, "uuid": "07644845-d3d9-495a-bd84-ea85336ec563", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777247873, "uuid": "dd45668f-9b72-4e48-984e-0b8a68619d50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247873, "uuid": "ba8a93c3-2f65-43f6-9af2-ce593c23ca21", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e538e47c-417e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777214869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214869, "uuid": "4d87580a-20d2-4ed3-89f4-31122f92bf4c", "comment": "Malware payload (Gafgyt)", "value": "b3aeb314e3ea36888529cb4f39190099", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214869, "uuid": "6713660a-7107-42fd-892e-e908930550b3", "comment": "Malware payload (Gafgyt)", "value": "97036c6183ce1d478c28be61f3f7b86d23ebade9d1632fb4a5de2975a384ec34", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214869, "uuid": "a012a5ae-fca3-4d43-a22e-2010860875c3", "comment": "Malware payload (Gafgyt)", "value": "d79df8ab9c4bb8be8bd75cf2577d3f58064c389f", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214869, "uuid": "7550efc6-95cd-4839-80b5-a7ef9e557dea", "comment": "Malware payload (Gafgyt)", "value": "f55ced9a71d57f196eca40a488540006bb7444d9bcbd8afb521d48a4625797a1d76b748a59c483169a3cd48a2eb8b260", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777214869, "uuid": "a718c733-5d6c-4916-9e17-00c2c3ec1a26", "value": "T12483F88AAA62EFB7C105B4B068BA6D79075E78525A5F0DD86438DAD0074F4CBB00F76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777214869, "uuid": "c30d3cbe-d71b-41b6-b2bb-0af05b05ff81", "value": "1536:f/FIuxiZRgcYIidXSl1fKo9+cbBjsCIW3pPhk3K:f/FBXECo1jsIppk3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777214869, "uuid": "566185d7-e808-43d4-8698-80ae52df716f", "value": 86280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777214869, "uuid": "3b48b224-fefe-4a18-ae96-65745270ade5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777214869, "uuid": "70a3e0ea-ca1e-4427-8c42-42440b8ffe2b", "value": "xdf.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd1e79a1-418f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777222157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222157, "uuid": "dee81461-be34-4913-9c4e-1110c24d9614", "comment": "Malware payload (ConnectWise)", "value": "0514a3542b11b069fa4c65f2da6b23eb", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222157, "uuid": "1a6cce3b-2af2-4482-bb4e-129cb8645368", "comment": "Malware payload (ConnectWise)", "value": "9720559ff95349df5ec7a3214dfe2bf7c7cb893e49a17c3707b2d6e08aa45728", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222157, "uuid": "1d5c70e7-0a96-4fec-86df-b783076fe475", "comment": "Malware payload (ConnectWise)", "value": "fa8754491508a4a7663c29864f9b817e8029c996", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222157, "uuid": "6013a428-58f5-4658-8668-90573deab237", "comment": "Malware payload (ConnectWise)", "value": "e8e0bd470cd94c34bb57c1485fdfd6944e9f1128d71ac0b3dbe59d886797aff1991fa735d4a2214046cabcc6914287dc", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222157, "uuid": "c22ea3db-5dcb-4274-ab05-92a5e5c70e4f", "value": "T146646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222157, "uuid": "352e7bc4-2468-4b7c-81d2-985c024aa17d", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222157, "uuid": "69557ce5-0832-49a8-9fda-98bc9118b960", "value": "6144:6mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:J1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777222157, "uuid": "b1fb5a0c-a251-49a5-949b-9987eab6bc7a", "value": 312568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777222157, "uuid": "4ed1a38e-ce97-45b0-8c2f-207ea68b3ed7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222157, "uuid": "b898c3f1-b4de-4a26-a231-1a88880611f0", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313e10ce-418f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777221868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221868, "uuid": "a53a0737-811c-4bae-a3eb-36fcf64d2ff2", "comment": "Malware payload (Gafgyt)", "value": "1370f9c18e0c2533cb088a808c3dac9a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221868, "uuid": "a2e58ba5-cd23-4f74-97c3-97833c2e71c0", "comment": "Malware payload (Gafgyt)", "value": "97cc6337807dcaaf5f1225855cde9f54c946e6189e33f33a72c1625fdd2f002e", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221868, "uuid": "3520fcf4-d6eb-405c-91e9-a7ec3d3f985a", "comment": "Malware payload (Gafgyt)", "value": "0c2648a8b4590bee1efffd63812eec202d9e6485", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221868, "uuid": "524cc3a8-a40e-49d1-b924-c9be951c897d", "comment": "Malware payload (Gafgyt)", "value": "dbb53e246299a012a4c41233bcdf1f97dbac05b2f0f66af73a7f2b41bd7a2948c3c124f9cd73c5b836021ddf5e8923ec", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221868, "uuid": "e57e233c-1025-49bc-9081-5868782092f1", "value": "T10C932B06F8008753C1D327BABB8F47493B3566B957DF33126A346FB42BC27991D26A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221868, "uuid": "f4790aee-3f7e-4394-abbf-f94626f9c557", "value": "1536:32HkBurAzlqXnP3ERWM45so5eRNOa85hnjfY9Of3ETTW+gWjvDqQEqn/kJXuXe:gczaEUuo5eO5hnU9OPEPfjvDqQEqnsJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777221868, "uuid": "a45cefc7-8e87-484d-8a21-123273c88994", "value": 97382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777221868, "uuid": "96a381c0-920e-443b-a7bc-dc96937d82d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221868, "uuid": "008fe672-e2c7-49bf-ad0c-72a76b880d44", "value": "fuckjewishpeople.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b961fc23-41af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777235841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235841, "uuid": "12dd306c-b698-44bb-96af-50652504dac3", "comment": "Malware payload", "value": "d652e7cf2a62d086a058ec06bffb2d73", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235841, "uuid": "ac5c4df8-061e-4e0d-9797-3305c7b0012e", "comment": "Malware payload", "value": "98e8d9c382b4639da213ec67d46575fd9b7c14649df1859fa6b05b209885084b", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235841, "uuid": "29887740-79c9-45a8-b98c-7ea725e5f981", "comment": "Malware payload", "value": "ad0c394d1e68b203172f15c5c1b540fbc102dacb", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235841, "uuid": "c5129e7f-4f96-4b3f-bda1-7322d12c359d", "comment": "Malware payload", "value": "d1f0f90bc789f31866d949f59e29ac4fa796ada2b33878175ea72c79e30c1869cdb18638f57dbf2fbb6b9005d843225a", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235841, "uuid": "5a52c709-5325-487b-9109-4db445a61b29", "value": "T1FC46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235841, "uuid": "0abad206-bd34-4289-a2cf-7dda0feb133f", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235841, "uuid": "641d42e7-9b35-4489-b877-e6c382afc68a", "value": "98304:CzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ChfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777235841, "uuid": "ff0acd1f-2ba4-4444-ae91-33d58579dba5", "value": 5641504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777235841, "uuid": "2e5301be-5b0b-4b2b-a8c3-ba1d94af54a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235841, "uuid": "424a2c5e-5bed-44bd-be7e-e3a7b916c480", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c71f354-4171-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777209163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209163, "uuid": "e1188584-2ca5-49a9-9e47-071889449576", "comment": "Malware payload", "value": "20c6061af90fd46562c3d4655d79ae02", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209163, "uuid": "318528e5-911f-45b4-8244-883855550789", "comment": "Malware payload", "value": "99ac3a9c439c1692a9ea8f8fd11fc7f3c3eed9da4bec4bafc461680a14143ede", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209163, "uuid": "662a9d89-e62c-4eca-aaa4-5be25e8a9b07", "comment": "Malware payload", "value": "a49d71790f46196a086dec0c34ffc5974e7b33b8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209163, "uuid": "50df73c2-3d63-456a-b919-fb70c854e792", "comment": "Malware payload", "value": "b069e847a9bc33544256084aeb5f7c28ff7924b0c7476d7b8f7d85768defadc28648bd85c21e313ee6c863c780699fd3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209163, "uuid": "c52a533b-57c2-4a2f-a3b5-53e31afd14ec", "value": "T145E09265E8C084BFA0398968BBEB7D59550F2112854B352D9BBD6442E8B8C445412937", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209163, "uuid": "ee01c4f2-4461-4dff-9bf3-1b1a497d282f", "value": "6:/2DpUnTAJr1uVYrWXZrOYB3F5/iOqVKhOqLsVKlR3iVVNMKRaiVfvOZQiOiyiiO2:/2LJr1uE/YBitgh1sglRyTyKRaitPi5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209163, "uuid": "a695ae31-c2fb-41f2-9750-9b2a8fcc133e", "value": 374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209163, "uuid": "1da53ce4-3333-40f9-9b2c-0428d1547317", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209163, "uuid": "97cf5a10-1f6f-4d8b-9340-3095a09f6114", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62105e98-410b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777165257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165257, "uuid": "6a7a16cb-8b14-4c21-b786-7f58f5e0e489", "comment": "Malware payload (Mirai)", "value": "aac8349b4c1ac461fac836f82ef7a0ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165257, "uuid": "a51f2029-9cb4-4628-b606-a17aa7c15af1", "comment": "Malware payload (Mirai)", "value": "9a774bcb163e55b4c6a5827bb51889c65fc04438f2837464ecac3711916c45fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165257, "uuid": "57e6c4cf-3385-44d7-b52f-89643f51e041", "comment": "Malware payload (Mirai)", "value": "58d48ff44a8eba8293dbfa8146017fb69fbbac72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165257, "uuid": "335fc73b-8854-4ba1-93bd-b9ac903bed3b", "comment": "Malware payload (Mirai)", "value": "5f1d574bc6232c7534e8a69b602589c5eb7cd2e04b471c9a82ed2e56a2f59ba1403bf36e410bdcec7307d4943260bf82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165257, "uuid": "80b3cc18-3f48-42a0-a6ef-f07459761bf0", "value": "T1ED73021EA28351D2DEA2B178E1B693B38E438DB5D00FD90B2F01769BFF4055D644E9A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165257, "uuid": "44929821-c872-4a2d-bffa-9af03d6be980", "value": "1536:T2v+cRAj88naBvcnq+iNOTLc3D7kPdPdE4IYSNdEMFVmmknPzVEWC:o+cO/naFcbiITLvPdOaGdEMFg3PzVEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777165257, "uuid": "d04945a2-d149-494a-b7c9-fddfec2a5f68", "value": 77544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777165257, "uuid": "d73003b4-1915-4051-9e79-e3a00c5c626b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165257, "uuid": "4d44d15c-6f32-434d-bd11-b0f2d733e755", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5390eccd-41b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777236958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236958, "uuid": "b54b207f-5e09-411d-aae1-834180d9b055", "comment": "Malware payload (Mirai)", "value": "3605b2da54e7d27325cc08b1971bbf4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236958, "uuid": "8f71fde3-9ed9-4eee-94c8-a5130e409da8", "comment": "Malware payload (Mirai)", "value": "9a816a0e0b4d89ce2b3b3a697176b265c0c4d2eb72777b86acda73d01baad205", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236958, "uuid": "a60dd5db-1121-40eb-9b28-b487523c287f", "comment": "Malware payload (Mirai)", "value": "430c645cfde15478e77804c31f00af8f676bde81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236958, "uuid": "39b7a247-7890-4b3f-a716-94b1a5dae31b", "comment": "Malware payload (Mirai)", "value": "617e4e04313841ebafa0be9b6121564e332b1d53550af91a3ce946ca8f2a4a75e72abd71770f0546c6b4b6ae81b4c4b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236958, "uuid": "849ff866-7123-45cb-bcf3-7c774efd0656", "value": "T19A839F23C9652C98C59886B5B4A0FE3617A3E94466871FF716D6CA72904BFCCF40A3F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236958, "uuid": "6f88557e-8a69-49b8-a79f-3fd5c4be3e55", "value": "1536:u/sfu1Lpb2sf8oYiKKFRP7/HIfeJCensoLEEKnS1:uUfuNEsfSFKHDIfeJRfAEKnS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777236958, "uuid": "7719426e-f62d-4ee5-a5d0-51a5dd8702bc", "value": 83488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777236958, "uuid": "c0c6ffb3-d8f4-42b3-a29e-14c697eea7a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236958, "uuid": "20dfa060-ddc9-4e49-b722-ff69ef92b81a", "value": "023782pler.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a188abc1-41c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777244390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244390, "uuid": "69780275-0e4d-4126-99f9-b1385ff10ce7", "comment": "Malware payload (Mirai)", "value": "f31d2dcf6a1621fcc3ab0f8079831e05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244390, "uuid": "684e12d2-683e-463a-899d-43bc6695b1f5", "comment": "Malware payload (Mirai)", "value": "9afbb9a1cafba22c4e13e0440a0aeb5a73de01937ea7acf14815e8b9adb6baa6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244390, "uuid": "c23e91b1-9369-4910-82d4-9966ffe4a220", "comment": "Malware payload (Mirai)", "value": "ceec019530b414ccb1aa6dcca7d07c52958fd3a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244390, "uuid": "51f74ed4-219d-4c20-b3e6-f4bc05d2ccf0", "comment": "Malware payload (Mirai)", "value": "8ba164a1bf3c2b53c255368d69a5f228f355dd00bb8d81fc9c579a25531b9959c053604f90e838715873908e00fe5df4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777244390, "uuid": "1d3a7b55-d7a0-4183-85f4-320603e7a107", "value": "T10A145B46FF541FDBC05ECE318A6F832313EAD8C65296B73B656C8D5C395A2890DC3A84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777244390, "uuid": "a33c245f-01fb-4083-8178-112007b6a7b5", "value": "3072:zryA5UBTlrNHrIh5eHrXHoEkMM7czqBi1TZ34MV9gAn0:zryA5wTlr5HXHpkMGc78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777244390, "uuid": "2dbd3842-f7f8-4e8a-b5f1-e3476f15c3af", "value": 196940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777244390, "uuid": "f2d9cae9-4a50-4245-a3f3-2d4cdd8db98c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777244390, "uuid": "94905787-9aad-4e83-8f31-c26eb488546a", "value": "agent_mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6dcdab2-4159-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777199007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777199007, "uuid": "69532d33-5164-49df-9179-a2c49d1e25b2", "comment": "Malware payload", "value": "d07d5db60a11a0c7c7bc69a235d20650", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777199007, "uuid": "e63ba38f-9555-4b20-be7b-93820f03a2e9", "comment": "Malware payload", "value": "9b5296a7fa877ae6b7f10259c18179f92d8fee1f1d6b422e1e7250161b4e74ed", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777199007, "uuid": "cbb0c95d-abe8-42e5-8322-d21e0e1b4108", "comment": "Malware payload", "value": "2531f420481a5c6596b5b1a249c457073ac63b7b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777199007, "uuid": "b8655e30-62ee-4cda-ae14-96924423de46", "comment": "Malware payload", "value": "cb2381da8deaa3fdd795cdf950a3857e858893564cea81361f528a95e1138dbf0c533074053c28de290d8ff941593d20", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777199007, "uuid": "716d3109-db72-476f-9952-123bd0556166", "value": "T1501823E7F3304C3DDAB71536955D6072EA294E24D652A30F2408B63DBDB33E28A857E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777199007, "uuid": "849b863e-f52e-4564-93d4-cdd0e81c2073", "value": "1572864:Rbl84DS/9ykNSpFQ6brDx5hxB0bq97qvs9zfhNayiVm7iWEcif:lpy9apyUnx5Om9oszNfqmOGif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777199007, "uuid": "cc513287-8693-4646-a87b-2ea1258012af", "value": 84867623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777199007, "uuid": "64fb48ec-7741-4430-9454-e09b1cfa03ae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777199007, "uuid": "a3301b21-bc97-4058-ac10-9400ffeb1776", "value": "Telegram.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ceb3de-41c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777244401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244401, "uuid": "a7d11706-0be1-49a1-ade6-3ebecc4d01ac", "comment": "Malware payload (Mirai)", "value": "cb25c4732ba09dd1f3468eda300f172f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244401, "uuid": "2f2d3491-2f86-4c96-8486-49c9fee7c427", "comment": "Malware payload (Mirai)", "value": "9b5d593629330ef69174a33ec30b79c5e7a307aa033e416cc89c301cd4044162", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244401, "uuid": "a7a8d7ac-737d-4722-bea0-836a64871f82", "comment": "Malware payload (Mirai)", "value": "20e4c17953631bf27e8f8e49f054f4ab4742b059", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244401, "uuid": "a3097628-ae71-4b64-90ee-6d3e3931522b", "comment": "Malware payload (Mirai)", "value": "3c12d0c875e2bb5672418e7ad66e6a700a8a5b17ca087969b70d86430460d038cae4cf80232adf295dbf36173dfe21e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777244401, "uuid": "05b30e76-0392-4526-a64f-fc1ba524cc87", "value": "T1F6259D2AB2F2B6BDD007C03447DBCAB15532F0355A312D7B22C4DB343E9ADA41769B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777244401, "uuid": "32dd7e44-40c7-4680-b002-26b450b7a19d", "value": "12288:OhM8J6gNgEMiTtvWWdBHzbawSw44x3keCf2k0tCDhTOyyk7ayECXDYHX/EVmqfzz:H8AgNgiv2yLKP0oDxOyyaXzVBfze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777244401, "uuid": "0c6b9053-afe1-4498-bf92-c65f7a238bbf", "value": 982880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777244401, "uuid": "4da68bf2-d051-417e-b1e4-c6d8fc859dfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777244401, "uuid": "ed50494d-de57-47b5-8214-dbe85e23f281", "value": "agent_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d273c2-41cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777247881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247881, "uuid": "d2bae7a1-abaa-4828-9d53-e6c731c8893f", "comment": "Malware payload", "value": "0e19ee4c8121e57782d794399fb11b90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247881, "uuid": "563a09db-d43c-404e-8a49-5964c23ac340", "comment": "Malware payload", "value": "9c766990cdd7d73c4a1d8c00e281a05a194f7a3f3ae58629beba202e847696a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247881, "uuid": "77860e5d-299b-4f6d-b28d-a3c2163d40f6", "comment": "Malware payload", "value": "266486054ce982babd2475bf4cf82cda3bd5b75b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247881, "uuid": "eec80816-b17c-48aa-bae2-6b80fca8dedd", "comment": "Malware payload", "value": "16dbc3c1d3b451dafb54ed7ae0da1351367c86b6ce313e4032f302e04c2a061c4ae600df6893d0e37ad6239461179db9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247881, "uuid": "96daa4a2-ca24-4146-b50c-f866b8b1cb50", "value": "T1E9F33969BA0F6C41F2C2D3F9DA8C87E13E1735E3C6778DA1790252EDDBA39D94980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247881, "uuid": "1970667c-0195-487c-89aa-35b45705ec71", "value": "1536:3dMiHrrc/qDHavM5Dtrg89RPA4b1X75rgmnX7Dy+IfMpLEn5p5M/LW:/7vDtrnPTR71gmX7Dy7fMpLxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777247881, "uuid": "4cb182fc-cc32-4909-b3c5-73aa205fc596", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777247881, "uuid": "f4f4ef0b-4865-419c-9f64-54758e342758", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247881, "uuid": "9b5a63a4-d4cb-4b1b-bc7b-017d18fe69b3", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467101d3-41b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777236936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236936, "uuid": "4054bfee-d225-4dba-8e1d-6eeb53dbbe70", "comment": "Malware payload (Mirai)", "value": "11adf7be27d8adb47d023453f0bb3381", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236936, "uuid": "c1e7eda9-93c0-417e-9081-e7fb02917427", "comment": "Malware payload (Mirai)", "value": "9cd5c1d637651179066fc0bbe3e554dca39d6dffbe64f5d80460e343287675fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236936, "uuid": "927b6035-3bfc-4aa2-ad90-cbaa84b76df6", "comment": "Malware payload (Mirai)", "value": "d8180078ac577eb9ed55e67e6714f9cb4201b685", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236936, "uuid": "544c3699-0395-4697-966a-1b0a57193a72", "comment": "Malware payload (Mirai)", "value": "294c853518eeb0f6ca6def63c6bbbdeed38891efb4b861f5db396f6aa075f2c6b81c8880eb341acda8bc49ad94695f29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236936, "uuid": "a8444428-a1bb-42bc-8c15-de666a1d741a", "value": "T1C4B2CF356591DDA3E824683BBB6DC843A292CAB59397B2233C0893D0B9D114767FC9D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236936, "uuid": "88c3f713-3615-4998-9dc0-e6076387f88b", "value": "384:4fV25V5+1HQsQiLZvvPhLlMxtLPgZeXFAmbUzcgaw8c9CCNh1XpnEbhymdGUop5J:sVYCQi1fZqUZ/CuZwCNh1Xp8s3UozuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777236936, "uuid": "99bb867d-5996-4547-8894-4fef5d5a5eab", "value": 25712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777236936, "uuid": "0669b701-f50c-4b23-8aeb-6b41a6b31fe6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236936, "uuid": "13775bf3-e57b-48cc-91f9-be6f92a061f6", "value": "023782pler.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ad54ce-411f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777173853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173853, "uuid": "58ab0ba3-4f43-4da3-83ff-205474a65f22", "comment": "Malware payload", "value": "b09bdd3f5969b032e86e1fdaff749636", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173853, "uuid": "a18dd4f8-6d22-4e43-8fcb-3f9152fde7cf", "comment": "Malware payload", "value": "9d42d6982b6927c6a40dc8250513a13338356792bb69a478f3d41c643acf76c0", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173853, "uuid": "375aa0de-113a-4860-a333-da278b2865b3", "comment": "Malware payload", "value": "ec1d7188d56d040f7cc679bbe70e7fa7458c5e2d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173853, "uuid": "9c77a3ad-152e-4628-999f-f4c517f62de6", "comment": "Malware payload", "value": "3fd3502d94b206c5e4ef9bcf9645da1ffdb0fa49843d9251d6f86efc23369a02a4306ac4bf544cf1841f9cf1a9001f7e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173853, "uuid": "6e4a2657-62c5-4b16-a6cd-fe7693c3323b", "value": "T11BE02B1498CADE325228423B1A1F5E51F0931163BA112874321DA77DDB4719349F40D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173853, "uuid": "0a813229-c8a5-4efe-a315-ccd50944d999", "value": "6:yUASEpXmJxI7dIGWd3bndqFF3KeQKN3FC4wQ7KGt5+:zxILWdjs/3KeQ81C4wQtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777173853, "uuid": "041db07a-5777-4279-850e-a265aa4d1204", "value": 299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777173853, "uuid": "0401c2bf-0356-475e-9e10-7d3dbe19d016", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173853, "uuid": "7f58618c-214c-4759-92e9-8dc5ee87c610", "value": "sEKTfxyFHe.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f306577d-4137-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777184398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777184398, "uuid": "59d9b33b-1b5c-4346-b530-ce8614e324e4", "comment": "Malware payload", "value": "9ffa476d5bc9960a81edb5a878a28f81", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777184398, "uuid": "57e60818-6575-4944-bc0b-fb4d0e4c408c", "comment": "Malware payload", "value": "9e4f0953873305442c17030289d89697c022309c1031c728cd5d90c52e71c002", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777184398, "uuid": "178a4a31-d854-4ca4-bbb6-b14ac49d8ee2", "comment": "Malware payload", "value": "36794282bf887c6a772f00d06389a60d1b6bc8c5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777184398, "uuid": "9f778f62-946e-4371-b5be-a16d3811377a", "comment": "Malware payload", "value": "d0d2c18742c39fd532a38fba4558f63ce5d3ebd180a878c97cec4acd25e9b36b6bb30d625054a00e4bb534335a77db45", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777184398, "uuid": "6fbb08ef-a29d-491d-a572-87bd9c8448a9", "value": "T106136D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777184398, "uuid": "f6751f65-acaf-40ce-a7d9-9a3654bb72be", "value": "768:bzXRWNGxV39GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bNlxSco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777184398, "uuid": "305e457e-6eb3-4408-a44c-4cde88643e39", "value": 45412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777184398, "uuid": "42c59035-3c10-47aa-b0ba-4d2668621e59", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777184398, "uuid": "35218ba2-23ba-4581-92f2-b3ea457937ab", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11991dd9-41a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777232553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232553, "uuid": "6e1e040d-7d68-410c-a287-1ee6a63fcb64", "comment": "Malware payload (Mirai)", "value": "150f2b340634673db1a35fc9c89a482a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232553, "uuid": "54e367fa-d44d-427d-8ce7-cb78b35b1998", "comment": "Malware payload (Mirai)", "value": "9e7eb508f1fcd95c40e2cf5b1e9442d068f7073b7d11995e2d94f7e916712d9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232553, "uuid": "0fe95de7-4e85-40da-9228-35aefc4171d1", "comment": "Malware payload (Mirai)", "value": "8269311fca31786e2cd727b8fd57a4e59b4de594", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232553, "uuid": "2aeec99e-bf3e-4525-8f20-a913fda0ca68", "comment": "Malware payload (Mirai)", "value": "29af367310e1532b1f9bfb8cca5a48a49e194e050a759620dca099ab411d6473a9b2bf3cb4e7a7fdd00d9f0f916fe946", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232553, "uuid": "7cb58973-fa28-4c00-8474-33e4d2026a0f", "value": "T187C3D748FD45972FC3E3B2FAEB4C06CD763A1F98A7DA31265A345EA023C5BD12935520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232553, "uuid": "c0ac3fc6-df5b-45f0-97c6-09c18dc0ffeb", "value": "3072:FKA958DAN16ofTMoMt5eK5I3rsOZTIYq:FKA9UXQMjeK53OZsYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777232553, "uuid": "8e085902-fc1f-489e-815d-da1eb1704ed5", "value": 119788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777232553, "uuid": "c08a2330-3219-439d-a5ed-98c02b3da27a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232553, "uuid": "76408311-1cc0-470b-bcd3-340ccca2371e", "value": "shabak.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49148528-41b0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777236082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236082, "uuid": "43cc40dc-f876-4891-a8b4-3370b877d5df", "comment": "Malware payload (Mirai)", "value": "c009ba3d87480a5f1601530e8ba2bb29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236082, "uuid": "75fc3c09-d664-43d1-a2d3-96314809a392", "comment": "Malware payload (Mirai)", "value": "9fd33f75aba6fe186678a8989a8e807dbd2a15c587a1a4229e4136fe396d5c88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236082, "uuid": "6aecfbe7-b1eb-4e55-97f2-ba04e649f1d9", "comment": "Malware payload (Mirai)", "value": "db8e4e7ab0b4da0fe80910865eb53f90278061b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236082, "uuid": "ef488198-a993-4c1c-8d88-4b9f41c4c4c7", "comment": "Malware payload (Mirai)", "value": "640ade838da9190760a1e43e5422ccd0aa891b0fab9f5226ed0a209db52626adbd1bb626ac6bc48a3a4ac01af472369a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236082, "uuid": "fe55d3dc-cc44-4269-9a4f-07555088ed63", "value": "T1931302BCDA1933D7E34AD877E021471C5BBB58D993CAA72C9560BAB27460816C3A7834", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236082, "uuid": "4f983f6b-f3ed-4d2a-a285-1c942a2af361", "value": "768:qlcWoNuBjL6H26MT1POdGETorqE49uOiMDnNlzmaCVGM//ckObjR8WRrp3fsl:ec5MB/U2LTcGETuqE4I4bzmaCVGUUFja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777236082, "uuid": "91897294-c52f-42c6-85e3-f0c01b42dba1", "value": 43140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777236082, "uuid": "baaaf9d9-94f1-4bbc-b42d-0e2bd43fe247", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236082, "uuid": "1d4bf172-1e7e-459a-bbaf-5405f1c0fe4b", "value": "windy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc4bec4-4171-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777209142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209142, "uuid": "acef3564-5f7c-4c14-a223-f519853103d4", "comment": "Malware payload (Mirai)", "value": "9f7c94b01a1a935c6aba650e8d478082", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209142, "uuid": "94c3088a-73bd-4ddf-9942-9b106d4005ac", "comment": "Malware payload (Mirai)", "value": "a036ca45695a183e21e8bef03456768c73c19f4939b0d80ee3fff71f9b43513b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209142, "uuid": "bec28bb5-6bcf-4872-8f43-82d856c7c2c3", "comment": "Malware payload (Mirai)", "value": "65bf4ad1136a42434e943326bc6cc6a9091e7d61", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209142, "uuid": "8be9e36a-c856-45f1-b114-782e6171035d", "comment": "Malware payload (Mirai)", "value": "7c4df06c48104f50763cf7b48ea60e405ec51a1982c1a6b3fb4345b9c1a4124c66ce7c58e04ed75b85478c117f707774", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209142, "uuid": "adb6aecc-0dcb-4d74-9792-b9fc5d36c974", "value": "T156C39DABB24F1051C82647F41BCB579C2E3325019E2B9AE77C6E373E1A369DE58063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209142, "uuid": "1de664ae-5dba-45f1-863e-22b337fdf184", "value": "3072:wf0GQgHfg5nBR4YYSOxTKB6Aq7mgbgiCrheiiU4wqe:wf0tJBR4NSALD7rnCrheiPqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209142, "uuid": "00b3b837-dde6-4256-aca7-4bb4b3eb953c", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209142, "uuid": "bca6af9f-e057-4df2-97a5-11dc2e05064c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209142, "uuid": "50217113-7d6f-4d8b-bdd7-de16575a3475", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1191631-41a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777233357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233357, "uuid": "755642c5-db16-4b00-8e9e-e65eb1bc7502", "comment": "Malware payload (Mirai)", "value": "cb2d7d310ead6fcff9b0c73e164ed70d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233357, "uuid": "3f2cff91-09cb-432c-84d7-b5af1e64311c", "comment": "Malware payload (Mirai)", "value": "a070eb76bba5c3ed698ffd2f534a9a917aa8deb2d238cadd2522b58f769aa0d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233357, "uuid": "678da623-b391-49cf-b3a6-29e3f5b34204", "comment": "Malware payload (Mirai)", "value": "62a05960447bc842a1ae7f6fe70f6a9009581c60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233357, "uuid": "515e3d88-d6c0-4a19-8476-ef1d4d142f18", "comment": "Malware payload (Mirai)", "value": "fd06d1e31ad70c8f49a57348fe0f9d894bdf28414fa367d16a91f3f7a07183b1c90b94da1b4cef1b067b78bfb7a9fc40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233357, "uuid": "bf33678b-e211-4a38-a36f-5ab3265bb2c0", "value": "T17D13F1FD990E336AE6D79A7AB47587254A3F3EE5EB887F1FC340B00670799147462820", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233357, "uuid": "79302b38-a32a-491e-990a-70d28b6d75dd", "value": "768:VlkWoNuBjL6H260T1PanzjrpfRpdSaNNs4LphFzQ+jVIGJXFbfsZ:7k5MB/U2zTcnjSavs4LphFQwbkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233357, "uuid": "93b8b40b-e7c6-4d40-8113-d0dd1efb3384", "value": 43148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233357, "uuid": "32c227a8-ff90-4749-a16b-7d2cbe833a01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233357, "uuid": "f41bcfd4-29ea-4871-9a30-09f4d4e314e9", "value": "luxzz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eed0f21-410b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777165305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165305, "uuid": "aeef983e-5033-4c75-b6f8-a2933ba5a429", "comment": "Malware payload (Mirai)", "value": "cb072ebcdead9f0bc8955678be02b4ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165305, "uuid": "44adba71-2eeb-4c5e-9954-486b7b82b249", "comment": "Malware payload (Mirai)", "value": "a2b9f0b3fa448b6e02984508056ff03579dfe79b2f03cfc24d7117bdb7b0e320", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165305, "uuid": "c743efed-5a29-4884-b621-5fc6bc60366c", "comment": "Malware payload (Mirai)", "value": "5bdfac2251dd3547752aa34a28e20bfacb8fd410", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165305, "uuid": "c46ed938-7755-499b-919a-6d3afebad246", "comment": "Malware payload (Mirai)", "value": "21b8f9a9b36ac1bf25b890289a20afcf12a4ddcedec6da6900c45e84e634053e3372d6f3b82e6658ab1c310bddacd8d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165305, "uuid": "ca75b565-40b7-4164-9519-eb54d7d4b38e", "value": "T1BA34D70AAF650FFBD86FCE3702AA0B0535CC651722A43B763678D518F54A54F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165305, "uuid": "87489f34-782c-43f1-bd58-6a09e8bb3e87", "value": "6144:lQfIAnFWYOUr2xDUZbzzA2pRi+7D2TR+r4/s11m:8IAGUr2xDUZbzzA2L7D4RF/s7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777165305, "uuid": "3f7bb74a-f1af-4d83-a42c-1d1466fde546", "value": 245420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777165305, "uuid": "edff0b48-cd6c-4258-8591-f5feb8af6bb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165305, "uuid": "e244c4d6-b219-4995-9653-1127579cb13f", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022701f7-416d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777207186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777207186, "uuid": "136708c1-bb91-4024-9782-d4c5fe49a264", "comment": "Malware payload", "value": "69c1fad80d73886433584b51eb4c95ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777207186, "uuid": "e79c1f84-d94c-4413-83bf-f7f6e1500a8c", "comment": "Malware payload", "value": "a35096ef69b504329f20e6607fe80b85667122c247f58b621c9c146c3fd01cc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777207186, "uuid": "0cf1baa7-d3a4-4cc5-9768-9eba6b816168", "comment": "Malware payload", "value": "b975a14385963e20f75fab142f7d2ba6510f0e0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777207186, "uuid": "e73f2a96-e920-4ed7-87bd-332378c9ac89", "comment": "Malware payload", "value": "cf5b7aed1dc12ed3a90a4328e45eba13232bbfde0e9893c40ed031c9c4ebe34b43a00c77986700e70134163493c063aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777207186, "uuid": "7da010cd-2ef7-4dcb-8689-4bad13c19905", "value": "T15864238FBBA93AC2DED13CEC45A5CB9A4DC91B4564BFCB051CF665C902E0113DA12F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777207186, "uuid": "90001fbe-f7cb-41bf-aa78-cc63667fb7f8", "value": "6144:66oJxyKwdJ3uPSRfC1dO5NM2fM3YVdK9Z6Mhpx2ywxSJx14kpaB1NoWywoJ:VoJw13Esa1dWMz3omHXwxWvDQB1F2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777207186, "uuid": "740cd005-e266-4272-9602-5d43454b34f5", "value": 314130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777207186, "uuid": "fbe5e7dc-52de-480d-87a9-913c07f5f966", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777207186, "uuid": "0b38dcba-7f74-42bc-a9fc-2417e7b24372", "value": "pty10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8243e78c-4172-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777209549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209549, "uuid": "76c5cb19-a3e1-4aa0-9655-2526a3dafb00", "comment": "Malware payload (Gafgyt)", "value": "7f328fde7445b6b65ac5388e5b9d9bbd", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209549, "uuid": "ffb2c9b6-c234-4b5c-a510-afa0bfcbb594", "comment": "Malware payload (Gafgyt)", "value": "a479eccb04e74280989f6c59ec1fe3988a038d0b070a1bbeba9758df75f2914e", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209549, "uuid": "e5dacea7-0ea3-419f-a93a-c68429d8364e", "comment": "Malware payload (Gafgyt)", "value": "3ee179fa8de0ec88e976795729bc6a22321436f7", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209549, "uuid": "25ea2515-841d-4760-81b7-ac8f2479a5a5", "comment": "Malware payload (Gafgyt)", "value": "e38dc9025ae699e8caad85a04d53a8d105b878d57a222ce3a79b4b0db267df7cc521cf49540469ac63a52e19fa8a6d76", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209549, "uuid": "93924528-1cad-49d3-aaaf-660b7dffabd4", "value": "T1DB442916BD419F06D4C622BAFB9E825533576BB8D3EF7002DD245F6523CA99F0E3A201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209549, "uuid": "c12ee2a0-bab0-4821-ba7d-d05fec054b07", "value": "6144:Vu4lZTfGelUs6kqESbvdnYcSffpggLmMwapUVPRFvVJO6k/yRfOiWA/D:NlZ7bUxZ1nMnpggiJapERFvVJ0/yOiWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209549, "uuid": "f8c91319-596a-470a-b902-2f4d869fb435", "value": 257080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209549, "uuid": "b355d477-5a86-4abf-ae5e-30a07c73f5fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209549, "uuid": "132a3b9c-6035-4737-bac8-aa8e263784c5", "value": "redis-buildxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f478af-411e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777173262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173262, "uuid": "560eb0a6-f01d-4697-ac91-2abb974a4b54", "comment": "Malware payload (Mirai)", "value": "890137fd2c2f5c30d3559a7211ec566e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173262, "uuid": "a755d49a-0704-4043-9664-bdf98160df2c", "comment": "Malware payload (Mirai)", "value": "a49d0f67c34bd65b5f2900ca95b8a13abd95806cadea0e4870e0021432e077b0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173262, "uuid": "ecb9e702-23e4-4738-ad5b-33660152a1fd", "comment": "Malware payload (Mirai)", "value": "922e69f8ce3db9d89abc9666e23e4bf3c88421bd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173262, "uuid": "1b73fd63-c12b-4928-8e55-3e0ca5c6c716", "comment": "Malware payload (Mirai)", "value": "27da3d0537350ba940e5c8c12a648a720875a4e783f60450d00204533bf99781a9c5e044acd9d240fc09f1df40d0e608", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173262, "uuid": "046684e2-f4a0-485d-b567-c1d4888ffd74", "value": "T122A2E135BE6644DBC973553C82D8F8DA2252AD6AE3DD894216C5C08BBCF33C8A430D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173262, "uuid": "e5503668-9c98-402b-a92c-9255e33279a4", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+Zk+aX/7g6LFUamvF0jxiTtTlRSy7:O98o08kxofBE+Zk+aX/7k1oiZR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777173262, "uuid": "08ec36b9-1336-48ef-8ece-671fd4f5c28b", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777173262, "uuid": "d2b8556b-d24c-4315-8c81-d898d343f7cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173262, "uuid": "f8feab94-c562-408e-8efe-daf3488cfbdc", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9afe2c-41a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777233350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233350, "uuid": "37984bb5-bcb8-4b7b-9790-bf57acc93c8c", "comment": "Malware payload (Mirai)", "value": "e7ff5af8292f2323a8638e338b246127", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233350, "uuid": "99a95f47-4a7c-48d6-a4ca-bd40504ca5d0", "comment": "Malware payload (Mirai)", "value": "a51f6c0fac09df29fadf58e23fc52f62a4cecfe53ab03959ce42a9d03c9c82c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233350, "uuid": "7aaaca6f-e348-4691-a662-eca6578f448f", "comment": "Malware payload (Mirai)", "value": "6144dcd45ba684cea3030d4a37ed3cca55b454a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233350, "uuid": "a1698e3f-daa0-47a8-b36e-1cedc94cc34e", "comment": "Malware payload (Mirai)", "value": "b44d08909afbf321c646b1e4969e569d611e25aaca2a2a694fd0ed1f17322a0297a2ed3cdc8b40b21f9dcbec49bd95c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233350, "uuid": "d4d9d849-74e1-493a-872a-defdb58c8c5d", "value": "T1502302C971200319D3B5193206C8A284D397FFDC9EE6A2DFEBD4A0AA2775483F1D2E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233350, "uuid": "c86a1505-8ba2-40d4-847d-58c20a639c1f", "value": "768:WI+eg11UY5hgLnHzt754NqIm7P1D0l4SzgmnPzNvG6uh3YPYplbrJ2IFUm2mELr7:W4YcL51KY1LS0mnbNvG/h3Rf/J2+2DLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233350, "uuid": "b45ac093-710d-470f-858d-786a3f85a060", "value": 46748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233350, "uuid": "4c099ffa-9ffd-4ea9-8c0a-2024f4761b75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233350, "uuid": "49d1fb2a-55fd-4d26-8d8e-f23cff9e0c97", "value": "luxzz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc13b832-418c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777220813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220813, "uuid": "fa991640-38c6-4087-8bb7-3b1d300f9a4d", "comment": "Malware payload", "value": "d3e36812728658cf03e893903a8756fd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220813, "uuid": "4800e186-fa69-4dd4-be17-4a7b16be6223", "comment": "Malware payload", "value": "a53381261bd5c194db1ffb7ab1315ad8f330113e610f35547db0cc77e47e2153", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220813, "uuid": "9aff4cc9-4be9-4f42-82cd-b8a073b1e3bd", "comment": "Malware payload", "value": "0f8f7834f84132636710bb0e9b7f910312852339", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777220813, "uuid": "c660029e-784f-45b7-9044-c8cd2673e6d1", "comment": "Malware payload", "value": "0e19626628743bc8b14188e6477704227b687f19350a66d6545f7c6e91480b23fad4af7535fd6d6ade26423407b8f323", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777220813, "uuid": "b0d83663-7b7e-402b-bbf0-b1c840265985", "value": "T1B7032CACEDEB261F61B28DF2A9F56147A02933FBA21E5BDD008683F4175350DE468D0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777220813, "uuid": "a44c12d0-1aa3-4f7e-acd9-c85464b2bad6", "value": "384:i7nySMZFEDaXbe8NzgbNhiKy1WtTiUAuvlfpND9pDrAp25+EFbv:VKHtT3A4lfpND99rSGLFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777220813, "uuid": "efe02e45-7653-4960-83fd-a2c56cb8d587", "value": 38508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777220813, "uuid": "b943f2d9-9535-4342-951e-cbc2b88bee77", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777220813, "uuid": "4f2e131e-a705-4dad-b856-ec79c087d676", "value": "Setup.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8053894f-41af-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777235745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235745, "uuid": "6c23ba34-cf79-48a6-bf18-be08bf5cebb8", "comment": "Malware payload (ConnectWise)", "value": "0656b4b9b56aac7de1436d6a0dfbadff", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235745, "uuid": "61c1d817-9e24-4be4-8bf7-04bbaa62fae1", "comment": "Malware payload (ConnectWise)", "value": "a6279a3a01c8a00e42bf368ea50a22ac606761610aceed08aaab875ad11db853", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235745, "uuid": "7c106da0-25aa-4348-b49d-8289ebacb58c", "comment": "Malware payload (ConnectWise)", "value": "fb2f7adc3df4c3b95e35d001fcdaa22d49fb934f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235745, "uuid": "2eb19076-2cc3-4414-ad16-15f53e831cbb", "comment": "Malware payload (ConnectWise)", "value": "39c4bcc1bdfd67a93978ec625e4fac77bce8db46756fafc1ef29402ca8560010bd307e00748a7c57dc5471a2544966a7", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235745, "uuid": "3d4b8f55-93ae-4544-bf1b-d6880da9a403", "value": "T1E8646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235745, "uuid": "8c2f7880-6200-4074-9741-1e3cae53e33e", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235745, "uuid": "5b946842-130a-43a5-9162-5204cc086c57", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:R1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777235745, "uuid": "63817309-96b9-485a-831f-bc107c018ec6", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777235745, "uuid": "00659204-317a-4148-abf3-fc37ea0a3235", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235745, "uuid": "8998aaab-6e56-4359-b06a-db00c2b7c6b4", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e132e094-41a2-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkComet)", "timestamp": 1777230324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777230324, "uuid": "c20a48c2-7f3e-4a99-911b-755fdff0d386", "comment": "Malware payload (DarkComet)", "value": "d9ab48ca40d5ff52c62352c014ab623a", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777230324, "uuid": "40ac467e-2779-4073-bb3d-eace9baba3e7", "comment": "Malware payload (DarkComet)", "value": "a88cfb093e1297165940818f7bb6e8441fb34462c021c525cba8683b8630e566", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777230324, "uuid": "bfc5963b-9df6-4f27-bb64-a9d6a43228e3", "comment": "Malware payload (DarkComet)", "value": "731c734b87cb5d26d9006cf8265da09d7688b360", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777230324, "uuid": "1db5f4ee-804d-453a-ab40-17c92777517e", "comment": "Malware payload (DarkComet)", "value": "962e4d741ba62466ba471018f38db84d5b3954336c40384ec8a2e6f333dbe7d895460dcf3b83038f73cd8262c1a0cb74", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777230324, "uuid": "a19426d1-ac93-40f6-bf14-81d5f3a7c72b", "value": "T130F47D31B1808837D96239F89C5B92E5582A7E202E29754B3AF63F4C5E39183FD152DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777230324, "uuid": "afb6d473-0e80-4e60-ac71-597c644c96c4", "value": "e5b4359a3773764a372173074ae9b6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777230324, "uuid": "aa34365b-8c97-41ec-8f6d-bd0de9d1aa30", "value": "12288:z9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hVO4VZ:9Z1xuVVjfFoynPaVBUR8f+kN10EBTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777230324, "uuid": "16dfb82f-e62b-43cf-be40-594656cbfde0", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777230324, "uuid": "bf852232-7d7d-4be2-b8c5-b77512b50b30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777230324, "uuid": "b7f1f9ab-9976-4aed-9eda-69fbb2217801", "value": "msdcsc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5df3b2-417b-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777213596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777213596, "uuid": "18ce0720-83a3-4dfc-bb60-58bbe3c98bc4", "comment": "Malware payload (ConnectWise)", "value": "8a9b5db34aab2625f710d24082744100", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777213596, "uuid": "c94775f7-5ca8-45c3-8baf-a95b595177cc", "comment": "Malware payload (ConnectWise)", "value": "a8d7abaa6b9d95397ec1142e030392895382527ce1481450b7b3f13a7381b0dd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777213596, "uuid": "6f7c003b-1ecb-46ea-9aa8-4b7b398fab14", "comment": "Malware payload (ConnectWise)", "value": "6e2a05f6133abf947f637f6c0fae12696152fc33", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777213596, "uuid": "00c6873b-65f2-4b42-bfab-eef54933e932", "comment": "Malware payload (ConnectWise)", "value": "bec28b348678f9ca3314fdd84cb46fefb3bc6e63716deafc01cbb4e2fb43d5e6a64f3acc07e793d6a7a896303e5e11ad", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777213596, "uuid": "2b20f3ee-9901-4aa3-bc06-30470dc32d6a", "value": "T10A647C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777213596, "uuid": "f485f376-0365-4258-b7d0-982367e25979", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777213596, "uuid": "a659b6ec-69a1-44d6-ba37-5d72078c5e7d", "value": "6144:1mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9N:A1iw7gryNkSV1hy1Z1u2JLu9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777213596, "uuid": "feca86f2-5290-4900-b75c-8f23e7b1b53a", "value": 312576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777213596, "uuid": "56135db4-1fb2-47ad-bdb5-275fbca076df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777213596, "uuid": "c052816b-6415-42ea-b26c-5e4597a550e8", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd64c4f7-41a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777233324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233324, "uuid": "018af123-c3d3-44d0-8904-6a8ec14d41a8", "comment": "Malware payload (Mirai)", "value": "4e8570e69225deb532fe500249f4dc68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233324, "uuid": "4d204ee0-ffed-4ea1-8fa7-3626e0431ac2", "comment": "Malware payload (Mirai)", "value": "a8df7d4f397541e11f9dd691be7e3980fe47506e440ee2a66a2dadaab7d04d36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233324, "uuid": "34815274-3109-4239-97ea-60384672bb4a", "comment": "Malware payload (Mirai)", "value": "469181b50aa62135574cfbaac27f742fd817c95e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233324, "uuid": "510ab8f0-bae9-4417-946f-95ab0a021856", "comment": "Malware payload (Mirai)", "value": "42e76a2e1cf01e2c802148ffd75e9be7784355d6e1899bded7c0cd2f38b839c53885fe7aa509a4b7a75094d9c0846f4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233324, "uuid": "26f9294a-2084-4c03-ad30-fb073bb6c921", "value": "T1CA13F190DFA9B04EE678B4F005A3665BBA64FEF2C90348CF11381F65077860CA9DE45E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233324, "uuid": "efd33b4f-c0b1-41bd-9dd8-97588a3d1b75", "value": "768:KWnhkpHhY5T62BSJRacEdB8ck89tvmqJHs7TPCFeGRXYaLIneiDh3Y4e/W:KWnKpHhY5m2CacmvfJHsqFeGtNLIneqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233324, "uuid": "b59907e2-495e-44c4-ae2f-eec23e1b75ca", "value": 44412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233324, "uuid": "6f55044a-9ab9-4977-b80e-94385615890c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233324, "uuid": "768e51b4-f0b9-456a-b212-155ecc16931e", "value": "luxzz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bfe3706-41b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777236946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236946, "uuid": "c0b3dede-f03e-4209-ad04-cc8dd914ab8d", "comment": "Malware payload (Mirai)", "value": "1e630cbd915eff8c09c56db5bdbf0298", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236946, "uuid": "a2391607-2b15-44b5-8993-ce71f7837842", "comment": "Malware payload (Mirai)", "value": "a940ab51ed842445b8d832cb5bc9b5991ac21f065658195fcad21f7a5037f69a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236946, "uuid": "23415a11-e264-42cc-b206-bfc5e75656a3", "comment": "Malware payload (Mirai)", "value": "47b80a1ff19f6fbecfb1cc580347113acc8d167f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236946, "uuid": "b083df18-e375-4988-a556-e883e81e3584", "comment": "Malware payload (Mirai)", "value": "f86e95449fbdc41a4349bbcde4e5134146416fa39e55d097bbbb28f7443f58f895eb632b6cf3abed821e4069e36b82c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236946, "uuid": "db2b9e71-ca6a-46ad-b5e5-7fdce02009a4", "value": "T16513F11C3BCB50F9C13C42B6BA5103200AB04FB1A3C7AD4EE79D9883BD6D6B56596AD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236946, "uuid": "8cea7322-d503-42c3-80e4-7b1084003f1f", "value": "768:FSs6hhskdZtCOOK+8Ucic/Z3iVV87dpxhyFlRaJgGlzDpbuR1Ja:9qu82YJNB3yV8JClR+VJuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777236946, "uuid": "58bd39e7-06ce-4392-9b61-43c6794b5582", "value": 43892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777236946, "uuid": "5009d1ad-8047-4494-b828-5524a6eadc12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236946, "uuid": "fef58d1f-b32a-446d-9b37-93b39de556d4", "value": "023782pler.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e95ee2-411e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777173257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173257, "uuid": "a42ffa15-46c5-4b1e-ad64-8afe28758425", "comment": "Malware payload (Mirai)", "value": "9b5451a2cbcf8da1bb5f4d1fa018898b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173257, "uuid": "9e7b78cd-0168-4e15-aecd-6735c7a518c4", "comment": "Malware payload (Mirai)", "value": "aa4d2cdb81d2d32f983a8894e03cd1c8f2e195ea76f96597eb6488d07f8d63f1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173257, "uuid": "e5154025-116b-40ba-901e-bb59e4a13e82", "comment": "Malware payload (Mirai)", "value": "fc69fd2b690301bfc2bd2756e9289611ba1663f5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173257, "uuid": "808e7434-d426-409f-972c-3b8f8194a5de", "comment": "Malware payload (Mirai)", "value": "ac00dc930c1df1dac4ed0d1270ab6ba346a3c8ac22d03b4449c16c28436bea364f271d465d4077fa00c05e4d0b0718d2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173257, "uuid": "b1306577-ddbf-4b76-9e9e-0f091a50529b", "value": "T1A2432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173257, "uuid": "4a15043d-70fe-4f01-8796-20bb064cd333", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFITQKqgESnmC/xO+KpAwg:RqtmZPuutfbltZFBSJsBcfDSTFIdBEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777173257, "uuid": "76c58ff2-3855-468a-8e97-1ed4208b4a9a", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777173257, "uuid": "8efb364e-fa5e-454f-9ec3-be93f8f523bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173257, "uuid": "8248db0a-15ce-40ec-9fff-6792db15c0d0", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f755589c-4168-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777205450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777205450, "uuid": "e0804182-3e8b-4d35-82f0-59a3321742c9", "comment": "Malware payload", "value": "ca700f8bb843815dc0f1ac310e4ae76f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777205450, "uuid": "c8ab7d30-f84d-4d26-ae18-1050b40481eb", "comment": "Malware payload", "value": "aac9d2a30dede73bc7f9cbdb1353da8141c276fd18c9edb0dc54d5547494b81d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777205450, "uuid": "08a4e485-5738-45e3-bbf4-743c01505d98", "comment": "Malware payload", "value": "33c7d4dbd9714d41117e4821641e11b5e57b64cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777205450, "uuid": "5635d141-4298-4eb9-a575-408b3a2368ad", "comment": "Malware payload", "value": "3893a1128714e256b3f192cf6e7c3f23541c0a80e2dab8b63b909c0177af98063c75729c0b507394d2da273883ccb490", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777205450, "uuid": "43a86640-2d1c-4d98-9d6c-4c154462bbd3", "value": "T1205423CE287E76A266F6B7BDCA3578CD35ACD27289942CC7346C8E1260771024D91BC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777205450, "uuid": "be808302-89ab-4652-9487-bdb0453e3aa2", "value": "6144:Ve/kO1iCx0n/MuDpZ5UaJGu+St7CerpJObMc04HvfMsNGd7QNFo:Ve/kZzrGmtWspJObo4nMsNi7QNFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777205450, "uuid": "77d8758e-15e6-4d2a-910c-7402c8af2130", "value": 290220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777205450, "uuid": "716d823c-81fd-4b76-a792-a5401323c209", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777205450, "uuid": "ec492537-2091-46f9-9f55-1a4ade2d1d17", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c38458c-414c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777193164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777193164, "uuid": "4801056e-0d89-4451-81f9-bbac44fda5b3", "comment": "Malware payload", "value": "b66ebe3b202180a15e9cb786d9c3ea05", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777193164, "uuid": "6ae55b91-b97c-4085-be3f-99bf6dfb7c9e", "comment": "Malware payload", "value": "ac6c003b7eca749b7ef87e8e10e1eb36139b46f192815e1e7db50a59e3d7e16c", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777193164, "uuid": "76b57241-4ead-430e-8c2b-345cbcbbd99a", "comment": "Malware payload", "value": "eb18c95cca44132eb6c1ea866adfd749f5049cec", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777193164, "uuid": "457dd403-251e-46fd-8a52-61159837d184", "comment": "Malware payload", "value": "1e836d277fd0353a672245405507e21c451c4afc70c826415dbf37892c67d630fb23fd0e2c26d287127acb2abd591bb7", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777193164, "uuid": "a9ffedf2-89a1-4e40-9c89-e774d4698f13", "value": "T15FD5AE05B3C866A9D117CA38CB14E332D2B2BD624766E5CB5A99F70A1F73E514F3E600", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777193164, "uuid": "af6834ea-209c-4981-b194-3dadd0a86847", "value": "9e0d542c65cbe7c62178ab7a933ed2f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777193164, "uuid": "63c90d10-6575-49cb-b791-fa3fc19ca7d6", "value": "49152:pVU8QEKcP8yTjCTmYsRuBPjLQK5lZf+JI0qnUZNrvSJA8/aiPlnA16wGalqX4:WK4SuB/f+JI0qnUZNrvSJA8/aiPlnA1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777193164, "uuid": "1e93ef0a-3a1e-4329-8624-4190be1f90ee", "value": 2823680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777193164, "uuid": "d53acf13-be31-4245-96ab-98ce93f14e83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777193164, "uuid": "a00ce202-2247-4523-94d2-0073ed396230", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e7aa3d-4186-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777218168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777218168, "uuid": "c45a2217-09ef-4063-ac12-dec6eafa971d", "comment": "Malware payload", "value": "264bcc24dcaaa6b6ee4a7a3d9f18d94d", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777218168, "uuid": "485dc2e1-5e9f-4ece-a566-4f31f8a9ab2c", "comment": "Malware payload", "value": "adfcbd2e6d09cdbf72f9d5ce8388ce796fa3025d3df34b4102c13a93f4092bd9", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777218168, "uuid": "7d513a57-6cf2-47b9-bb86-3b70cc42fb42", "comment": "Malware payload", "value": "7122803aea0b93b023bf4ae5be010705de1b9301", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777218168, "uuid": "d2c969ed-0aa2-463a-883a-0f0a8c385a15", "comment": "Malware payload", "value": "ec9cce131066fcddc1a982e28e0482958bb3220a227a4e8ec3965e624e2a5cb2a8b40a4454fb5e0f9eac272d2a4cbce2", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777218168, "uuid": "e7f4e74f-7c78-4965-9bb7-071922664cf9", "value": "T1F7B2A382AF1CBCF269B39C214CD96139A4BD075F4B821C1BB45C899E47A34507AFB876", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777218168, "uuid": "8128403d-0dd3-40bb-836b-9cc24adc5ebd", "value": "192:GEO4iwfRw8EHey9K9yhTIly8vXIQGzT7aVgHIcIf1KV5o4SRugeVG3A:GvHeyt58v+PSgboXR5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777218168, "uuid": "fd4fe658-547d-4591-98c6-aea642c8de07", "value": 24430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777218168, "uuid": "33b6fdb0-28d0-47b2-89a7-235244efa881", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777218168, "uuid": "d5e63618-4956-451f-b5bf-5622f5b1d46d", "value": "SearchHost.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d209e9c-41c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777246853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246853, "uuid": "e48d6a0c-04d5-4c23-9323-e2edaed9df39", "comment": "Malware payload (Mirai)", "value": "a34b3bccfca31c239d20df42ab194b78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246853, "uuid": "3acb4f39-fbea-466e-9c9a-e23cd96db4e1", "comment": "Malware payload (Mirai)", "value": "aee2d0c0368f97cd3ddf0fb51158059764e4c559518b054e7f42121c6cd77714", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246853, "uuid": "4cb58255-261e-4cfb-ac70-f88f551958d2", "comment": "Malware payload (Mirai)", "value": "2bdfdf17580694b531d0b60e63ff2a19b8c8a9c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246853, "uuid": "89781e0c-e7bf-4dea-aa09-c592e986834c", "comment": "Malware payload (Mirai)", "value": "1cb1d07e13736312523ed76ae08a63642ab2a7d1bc5a55cb149b2569808672725ab414490610f8fcc2d3749c805e67a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246853, "uuid": "c2174c80-5983-4d26-82d0-2f51e13edf91", "value": "T16EF32D467D918A23C6D127BAB7AF415C37316368C3DB3302AE186F782FC665E1E36251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246853, "uuid": "9f5e5a8d-fc73-417f-b4a0-53be5afd3d06", "value": "3072:E5oGraU+hjMH+q9CshKpOIO29novd4y3i/qk/ATxGv2:0rH+h45TMov2qi/9v2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777246853, "uuid": "20c8ccb0-0325-4124-9484-e7b84eec3d8f", "value": 159672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777246853, "uuid": "6516b6e0-96c2-412f-bf90-499c74cd8cfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246853, "uuid": "ad430cb0-5193-4d78-a8ec-d299f80cc8e8", "value": "Yboats.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47cc657e-4107-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777163495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777163495, "uuid": "232ce4c3-3423-41a8-94ba-fd32309c496e", "comment": "Malware payload", "value": "cb92b7a7e7de5b41b0402aa7c162d439", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777163495, "uuid": "28aa512e-702d-45b0-9067-1c96d88d5f72", "comment": "Malware payload", "value": "af9327f7cfa028f3061c488d3cd389119993325ffb2c236f66ea410be756c88d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777163495, "uuid": "8fde5cf0-bbcc-4748-891d-b11290588df6", "comment": "Malware payload", "value": "5150d1a65e1b1cfaf9ca816d4a26fa8f5efd35dd", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777163495, "uuid": "81ee440d-d294-4746-978a-9e2fdab55595", "comment": "Malware payload", "value": "7f99efafca091324c1145828e64d341339e5f2823b2d9b23124babe980f537ea391124d442c435e4d2bb40ecea3270a2", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777163495, "uuid": "872d60bc-24e0-472c-b48e-672293549f98", "value": "T16101E54AF0E55C72DF2C15E0DE4A15063B1E8589E3827BF610D60C21CE026E9C1A53F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777163495, "uuid": "d744345d-91db-41c1-b6f7-71860f015113", "value": "12:0vVhCKXWckoAUyDTqSAU0ZnZsB1yfGlPEj532lfo+5uVil8raLVxQlhj9uVdoEch:0vLpmcjAJeBZnqMIOtyuVKXAuV6uVjAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777163495, "uuid": "1510d682-1afb-43ee-9d10-4943b99204db", "value": 829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777163495, "uuid": "ac187287-70e1-46cf-bced-77864a6806a1", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777163495, "uuid": "062c78aa-4b8e-4092-b39a-776de5ad2290", "value": "~svc.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9d559b-411d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777173220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173220, "uuid": "d870ed6d-4662-41c9-8cc5-fffacfd3d05b", "comment": "Malware payload (Mirai)", "value": "68391c995a521ab1f89ff4e83b41608e", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173220, "uuid": "3f6d6f2a-cdf7-4218-be7f-9b5e7a77e424", "comment": "Malware payload (Mirai)", "value": "b08f765670a7bdc7a4ebe2f7c12e9cb6d4dd8c3633022c052d29f07b651eb222", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173220, "uuid": "c1be1716-ed70-4b50-b67f-6e24e5c7ad23", "comment": "Malware payload (Mirai)", "value": "7880568a28533a3ec9f1afd60ec1ab894a6ac733", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173220, "uuid": "6a0b5c31-4f8f-4b28-a3ef-e861d20d2377", "comment": "Malware payload (Mirai)", "value": "e50d121c96088ced9e012b8814925235a0ef0391a389cb177c44751ce9130f97dae64af1682febded94a0ec770f8c3f2", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173220, "uuid": "f462f297-bd7e-4849-84f0-85287a8ec0ae", "value": "T16C82CF24628674B0CB704831B56ECEC6672707F8E2FE31C20B486B7EDE4650A56BD2D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173220, "uuid": "6835e23b-4828-445d-a6c5-d868bdbbb750", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUA/ApLnehymdGUop5h5lZ:2dV0P6+kom0tVAoNvm+tZ/A8s3UoznlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777173220, "uuid": "a00b9c8c-75a9-466c-945a-466f7a6dc74d", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777173220, "uuid": "84c6a5e8-5825-4db4-8ba1-269b2a81203f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173220, "uuid": "48757993-1274-4ae5-8c2c-7af538bd1cc6", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e398c9a6-41a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777233334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233334, "uuid": "108a6a2e-0be2-45a8-80f3-d2f621c13059", "comment": "Malware payload (Mirai)", "value": "ea29b6027b9c9fe97eb4e8be1ebed40b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233334, "uuid": "1964d8a9-56c4-498e-9cf1-b77fbe818c7c", "comment": "Malware payload (Mirai)", "value": "b10283196319b985e2e8c04cfa8e52f7089b6f1ad8949e49432bd79414459fab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233334, "uuid": "3ee0fd71-0804-4734-8657-888eb2c9a11d", "comment": "Malware payload (Mirai)", "value": "ccce75b75a4ec2c837485a1727cb8b934fb99f84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233334, "uuid": "a503df2d-4c10-4847-ab43-834eac1e68aa", "comment": "Malware payload (Mirai)", "value": "183c8b5a9d18c7c517ea30774259ade0955ea5d60a79b942d27e505a364a242a1fc00eba149e0e6efc47de25a498d557", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233334, "uuid": "5748c913-f502-4057-adca-59eb8a610bd8", "value": "T14703F1916B6C4905CC4EA2BD830B6EFBF4730A024A9FB55A3DDD4ED38862170E2F4959", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233334, "uuid": "aad94341-d5d0-4e3d-a834-33ed43351a22", "value": "768:Y2kfZ/bHf9x73X0LRk5OxSxgunI7BtxphmYEHWjUfByv9pMTZqrHvoZ:YnZbHXU2oxSxgYItt7oUvrMTcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233334, "uuid": "c8267a82-dc29-4ff4-a78e-a73264b6e4c6", "value": 40444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233334, "uuid": "f6ce5609-549c-416a-ae60-8d7fae997437", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233334, "uuid": "bbad2b5f-96ff-4527-9257-a76d6aa391de", "value": "luxzz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68511d8e-4197-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777225397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777225397, "uuid": "b2ff51bc-5392-4d2c-b37b-124bb0fd1073", "comment": "Malware payload", "value": "e6c6f1cbb73e20da6e0daa7173e7c27c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777225397, "uuid": "f87492ec-17d1-47cd-8ef7-e25a289e62d8", "comment": "Malware payload", "value": "b1ed008ca3c376b211eb661f5168d9a118ac57d90887f4dc66708f82a0612cd8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777225397, "uuid": "5f21c324-9ae4-4d5a-8739-e506ec62eb06", "comment": "Malware payload", "value": "36f5f391a12f0dca0059c9b8fedebb5ec1edfa37", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777225397, "uuid": "b496b5f2-0524-4e98-a826-53424c5a3646", "comment": "Malware payload", "value": "434331961ce46e661ab99dba8aaa82b9a8b4d8d3803d9ae34c17404d52bea0cd61e2af2a4acfe49b96ff5365f192b39d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777225397, "uuid": "a9f12f3f-f1e9-44cc-9200-421f84c02667", "value": "T104136D6526953C25AE99883B5C7F2F0CB9A983E1304491DDBFCA3CF18C15A9CE318B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777225397, "uuid": "b6b6931c-622b-432e-a7ac-8010ab716d65", "value": "768:bzs9NyXsZztCE9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:b4HusZIco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777225397, "uuid": "5392b6ad-2469-43de-9da6-6ebaa05c1620", "value": 45412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777225397, "uuid": "0ff18c82-d128-4ffe-99dd-2ac532fbc361", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777225397, "uuid": "82517e4f-5df1-4bf6-b2fb-d740c6a92995", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da1539fc-4164-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1777203683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777203683, "uuid": "7c883d31-f278-488c-a3ce-97fa11bde2a0", "comment": "Malware payload (Amadey)", "value": "63a4b68247d851355a3d3edac8c0220a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777203683, "uuid": "8f898a9c-3ebc-4fe5-bc94-b39d2a54cd8a", "comment": "Malware payload (Amadey)", "value": "b27ecd6a59c7d2471f7d407567d1b33068845ec89f5e0a76e18dc720cc69e80d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777203683, "uuid": "baa80cf4-b612-45e7-8a73-341e28882b51", "comment": "Malware payload (Amadey)", "value": "d957c1414ef43115cf6215b98c9d195d594289ab", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777203683, "uuid": "e245c6fb-a141-4230-8b9c-0c360c2a8224", "comment": "Malware payload (Amadey)", "value": "d0221ea5c808a26c39096233d0d6a28197137cf15796700e4529b52bd1a2d920a0516a17b72e9b9710281c64d6320b30", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777203683, "uuid": "3ddb0b2d-8dd3-458d-a0bd-01f1e37ec601", "value": "T156359D16B941C071D49401706269BFF2593CAA35672145DBFBD02EB2AD305F3BE3AB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777203683, "uuid": "561515b5-8193-40c6-8c38-acc89798e200", "value": "a252cd53ebc44617e8418747345d10c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777203683, "uuid": "b4ae1ec5-c4cc-4389-8408-54e958f53369", "value": "24576:5LCrua2InCFeiwzFJEUoBmx4I1bzNEhzcJZlZ:5+ruaRnC0iwzFgI4oJZlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777203683, "uuid": "fad01d6f-26aa-491a-a52c-d9a7beeac76d", "value": 1102336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777203683, "uuid": "d1b4504f-7752-4767-b5fe-e265a5e42f51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777203683, "uuid": "0a68e4d3-817f-4e3e-8f67-89d9ea2e17d9", "value": "cred.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84f1b8b-415c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777200298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200298, "uuid": "454a85ef-fa44-49bb-8ab0-1ca383a5d022", "comment": "Malware payload (Mirai)", "value": "ab52f438caa88ab23ddea8660bf37afb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200298, "uuid": "4d5ee9d3-0946-4d41-832c-6e091e9ca431", "comment": "Malware payload (Mirai)", "value": "b35623f5047d18a36bf0da2c07515d63b349731687fed17391e5e60489eebd93", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200298, "uuid": "5a301197-5567-4b8a-baf4-b8b0a06b3806", "comment": "Malware payload (Mirai)", "value": "6c310ba3571d7ce7ea1a4fb7cf7f85a1c0b2d6e3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200298, "uuid": "5d06773b-38d1-4981-a1c3-3641582dcc7c", "comment": "Malware payload (Mirai)", "value": "71dacbc25a11c69daeffaffda4471130297887aeda29e87440efd4285fc9de047f1666618c7016a135b9397569cad1bf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200298, "uuid": "3c0843d9-0c59-4394-b34f-1bb7a3de5b08", "value": "T1B3133AC1A643D1F2EC5212F5147B67628F76E4364A7DFA92EBA92531FC03B10960B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200298, "uuid": "f78bc421-2155-47b2-a841-f4fa9bfd0deb", "value": "768:QQaiSup66OkEgy5oD5YQuj4JEUTeU4wQOncspVI/4bOGd7nX:QQaiSuptOkEX6D5YQ/JEUeUDtcspDbOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777200298, "uuid": "39add4ce-22ac-49c3-8b3d-b914001c6b11", "value": 41840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777200298, "uuid": "70f5e777-a732-4fe0-be4e-4104d0db2f52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200298, "uuid": "cea5bbe0-5147-4c0d-ba33-64239215bbf7", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c1313d-4171-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777209095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209095, "uuid": "9b1cfd65-5e42-4087-930c-04885478f9ac", "comment": "Malware payload (Mirai)", "value": "ace185eec3a513f2b4ca10baddff21da", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209095, "uuid": "4485e9dc-2e99-45e5-9e41-65fd7aac783a", "comment": "Malware payload (Mirai)", "value": "b367c72294088527bc75269b3a1baa8ec19bf588513733dae6c149cecc35bb4c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209095, "uuid": "bea186e4-720f-4c93-a829-455934100528", "comment": "Malware payload (Mirai)", "value": "1e0bab1f5198d27c7d7125c9b78de447bdef2018", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209095, "uuid": "9fe7add0-21c3-464a-aa2f-507dd6000699", "comment": "Malware payload (Mirai)", "value": "12055d1811e2b99e2541b831fb8d8ef860f7f93c0379074f4e11a558f4edcc388e3c5e2b9224adf94c06115741ef7397", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209095, "uuid": "b94fd0b8-7022-496b-8fdc-ce20f7e2587d", "value": "T14AF33969BA0F6C41F2C2D3F9DA8C87E13E1735E3C6778DA1790252EDDBA39D94980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209095, "uuid": "7461191f-be89-47e2-9357-0befac96e32c", "value": "1536:wdMiHrrc/qDHavM5Dtrg89RPA4b1X75rgmnX7Dy+IfMpgEn5p5M/LW:i7vDtrnPTR71gmX7Dy7fMpgxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209095, "uuid": "3f909674-d263-4540-a7cb-8f1162d05bb3", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209095, "uuid": "66606aae-c500-4272-9bda-59cd3dd87789", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209095, "uuid": "dde1d6f5-20f3-4419-a100-fcb8a9828961", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45ac261-4171-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777209176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209176, "uuid": "86655fe4-a0b3-4ff8-bf7f-b53e5f50de94", "comment": "Malware payload (Mirai)", "value": "2393a59d5b0408c1340290aab50dd6e7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209176, "uuid": "68117b53-d344-4d8d-a49b-2e5e8258a1cf", "comment": "Malware payload (Mirai)", "value": "b44b8259c89f884d0300e2c698e8e0b4b03f27bd97577f3cbf162eca774cd452", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209176, "uuid": "e6e7ee0b-1df5-49e5-8a25-8cc0b0a91a00", "comment": "Malware payload (Mirai)", "value": "739024dd2f262bd9b16f69f493cdb8e4c054d04a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209176, "uuid": "55cd0f50-b422-4201-a63d-49eb0f87fbb6", "comment": "Malware payload (Mirai)", "value": "3fbfd919d2d2cbb27506c02c42222bb76e0c4a2b05dab8b3549ba31d65c5e3d644fe07de7b74622d1f418025eedd1e33", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209176, "uuid": "94b4d664-afd5-4350-a9ba-fdda77146cff", "value": "T1A9E3B71A9F910EFBDC6FDD3302A9060635CC954722A43B763674D528F64AA4F4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209176, "uuid": "2ae46cea-1360-4e7a-97b3-c28bbd03e90d", "value": "3072:6xjJw1Cc/0s6YAPwenUr48pzfR+Jonly:6xlw1xAop0YfRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209176, "uuid": "7a853d72-88ae-40cb-ad59-56fe98511cee", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209176, "uuid": "a8b338c4-9375-4248-be33-1e26de09fc8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209176, "uuid": "49b82cc4-2325-442d-a8d6-54a6c423c473", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83579e03-41af-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777235750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235750, "uuid": "0448ba9c-2da8-4379-9cf4-6f94ed0491b2", "comment": "Malware payload (ConnectWise)", "value": "080ad02b7dbb52e818304d90f64f48bd", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235750, "uuid": "2646de7f-8294-4219-8af1-5dc51a020e41", "comment": "Malware payload (ConnectWise)", "value": "b491bc4386433ae495460f15a052b104eff90b278a63fb6bed85f63c8c4018fc", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235750, "uuid": "f3f0f600-ed27-41b7-82b2-8c05b9f58891", "comment": "Malware payload (ConnectWise)", "value": "b05c66216972aae833ffa51b499cc5086beacd4d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235750, "uuid": "2fc870e6-b351-4e3e-98cf-920ce07e8b0a", "comment": "Malware payload (ConnectWise)", "value": "67327545af7a46267ac1a340724e3ae79bc901373f277e087406081cf9873263fa6a7bbd63de7da6be4e944753c69195", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235750, "uuid": "dc2e49f6-d7d4-4711-81ed-f4d89611bb05", "value": "T108646C11B9C48432C673383107B4E2B28DBDB8302D655B9F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235750, "uuid": "14aae3af-10cf-4a4a-bfd2-f5e7eae50e42", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235750, "uuid": "dfdc80c2-75b0-4dbc-81fe-85bac1aca6c3", "value": "6144:1mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti98J:A1iw7gryNkSV1hy1Z1u2JLI9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777235750, "uuid": "9431c9f7-5ef8-4dc2-9113-a547ac33e85b", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777235750, "uuid": "da3b4b0e-da9d-43fe-b56e-c03dbcaae788", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235750, "uuid": "2b6aa1a0-04cb-4834-aafc-dc41a556a286", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7564070-418f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777222147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222147, "uuid": "b9df19bc-c4ee-4dae-89ec-e29946eee3b7", "comment": "Malware payload (ConnectWise)", "value": "5a9d52560da14c1b184393d4d3ba38f7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222147, "uuid": "ab543553-acfa-4716-9fe0-6f4b6d1cf3c1", "comment": "Malware payload (ConnectWise)", "value": "b4a04f404b21eaf36cff896dee702cd54fe70fdf207860958482c9198a9c3ece", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222147, "uuid": "f4f50d64-499a-4760-a5f9-ac98ac3ae8ce", "comment": "Malware payload (ConnectWise)", "value": "2ef66e6a92941ba9226a67f71186df5475648bf1", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222147, "uuid": "0ee53e69-c454-4f28-b28b-091eea796724", "comment": "Malware payload (ConnectWise)", "value": "12b61f2513e2ddbb03b5f8487c5165e11810015aca758e80dbcb3d7f3b190464b7e54ac9b6562ef15d2f8140e26ec80f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222147, "uuid": "d6bd9e20-b38b-409c-8c8e-78a90d4d5d31", "value": "T121647C11B9C48432C273383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222147, "uuid": "a4c1f3fc-c347-4450-a15c-3f2c0e687abc", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222147, "uuid": "72a4918d-fd51-4069-8f7a-51030fa0d136", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:51iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777222147, "uuid": "9a5d263b-81ce-44eb-9230-4e6e24a9261e", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777222147, "uuid": "48f1afc0-d449-405c-b3b5-218974695c0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222147, "uuid": "177c7ac3-e876-4034-8898-b6085146a561", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e1dd8e-410b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777165261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165261, "uuid": "c3ae2953-4fc9-44fa-85ec-0fda5bc01781", "comment": "Malware payload (Mirai)", "value": "4b2458f81c882e4ac442d117cffcd8bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165261, "uuid": "398bf232-563f-41f0-b07c-0cb25e58293f", "comment": "Malware payload (Mirai)", "value": "b50397272b6268d3ba59645ce9b60f60dc3fd6bcece4075d2af5489c3106e331", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165261, "uuid": "2f764338-2517-43fa-be04-adc56571668d", "comment": "Malware payload (Mirai)", "value": "eaa79b5f56b3788f8e8c06341792b0af29e94377", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165261, "uuid": "9b6e2007-8755-48f6-a44f-ec80e611429e", "comment": "Malware payload (Mirai)", "value": "71cef41a0c479edd3ad86eec08479cd48d5184f64b917194f62a9873ccac424b7a94dfa147824bede3486ac865be8914", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165261, "uuid": "09194916-9148-48f6-b467-ed55c074f028", "value": "T1A163027283506CFBD6EE0672BC5F8986950B2FB552E0B13734DAE8653150C473BD98CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165261, "uuid": "1d29fbc6-5f9c-4d88-96b7-8e8e056a76bc", "value": "1536:p4/kZsezliUiRLcx1wLED7o899dQP5oFvtwIW:ppseQUiFcfx7jnQP5opW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777165261, "uuid": "1e5a4919-5e13-47db-ad3e-b7ed8f84af04", "value": 68196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777165261, "uuid": "e9017e61-3cd1-4584-aafb-6f84f510d77a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165261, "uuid": "dc45f3fd-c646-43b5-ac0a-19cb4a92085f", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03177040-4113-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777168533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777168533, "uuid": "3e159d12-a208-4053-980b-3ae4354aee37", "comment": "Malware payload", "value": "af8f88f24eddbfd06cdcdf2540bca881", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777168533, "uuid": "8ab82198-98cb-456b-a04c-39641b5837ff", "comment": "Malware payload", "value": "b69e226ab41df28ddd629db658b29fd286cee391d320b747333f5c593c72d941", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777168533, "uuid": "6c16f176-d58a-4f4d-a13f-9381a74c6708", "comment": "Malware payload", "value": "ba8aa09da2f7c871d61f5f7ade0d07dca24a72a4", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777168533, "uuid": "31c8425f-751e-4234-9110-dd0a611a6acb", "comment": "Malware payload", "value": "e31383f7213096d8d5832cfa7974ddc27d6e5a40152d1483ad407acb00bf4138d5c6c45736823502b00badde98728b24", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777168533, "uuid": "8a74b695-46af-4c99-a683-9ab69ef7af97", "value": "T185F05C402CC7CCA24CCE1EC20BACBDC7753B545AC11E8A08199040EF685CADCC5EF9B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777168533, "uuid": "ba1dfad8-e32e-4096-8a7c-5037fae65eae", "value": "12:QUp+CF16g64CTFMj2LIQLv9WWY4CVGrMLvmuCUgh8UPrYIx:QUpNF16g632Cke9WWNCVGYTQh8YT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777168533, "uuid": "f5aee1b6-5f17-4b5e-8e2f-77152e9d90ff", "value": 456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777168533, "uuid": "9024f917-bb72-4057-a250-928be5b06ddb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777168533, "uuid": "d9b1063c-3aa6-4c9c-be7e-a0bbc2db9a5a", "value": "main.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f8890c-4169-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777205508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777205508, "uuid": "9ff80d62-d0f8-4a33-b56a-3c02a658492e", "comment": "Malware payload", "value": "373a7209956a3926a0d968a6c7763b46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777205508, "uuid": "6ff9c012-f54a-4e43-b520-1d3db4c0c048", "comment": "Malware payload", "value": "b784611fc42856f76efa68264d8fd66c5d2b12212301ac87b00f5ddef1c1d180", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777205508, "uuid": "0f99f944-eca0-47f0-b63c-db0b172fdff3", "comment": "Malware payload", "value": "5d13feda687d4c7b8efe89656e48cf4c8e262d30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777205508, "uuid": "e15e0c7b-5658-4b55-88b8-8b2ec4288dae", "comment": "Malware payload", "value": "b66d067a054c6cf73dc181a3586a68808ac89c5f35098723d451bc4bd64a4cf4fad7f323413d36fd95bef28bb1c559c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777205508, "uuid": "370107c6-71bd-45dc-9979-0082f19e5f45", "value": "T112E4F51A2E729F3CF3A487314BB34B24D66D62D713F1C585E2ACD1155E2028E592FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777205508, "uuid": "95247009-7e24-49e4-a24d-4b2ab5165f16", "value": "12288:Wgnzceo/uvZ7yaUiYLBXECu9FAl2mjvQ/xyc:Hzceo07yaOLBXECC84/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777205508, "uuid": "b61f89cc-67d2-4580-8576-f72c74156b6f", "value": 700984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777205508, "uuid": "0ebab14f-321e-4aa0-aec5-23847c74fa0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777205508, "uuid": "3b5ade06-e02e-474d-9e40-687f1e5d383f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb80757d-415c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777200196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200196, "uuid": "fb0aaf5a-361d-4d41-9ccb-99e30481067e", "comment": "Malware payload (Mirai)", "value": "dd777d70423b06834d1f5467e78e4e9d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200196, "uuid": "d22c887d-8b66-417b-aee6-01b30acc9342", "comment": "Malware payload (Mirai)", "value": "b7e2d94c0de4d571750ab7ce2f0bb1eee7cd8c45c9a2c0018440dabe32ba043e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200196, "uuid": "62188b74-69cf-4e24-99cf-ff9199b89142", "comment": "Malware payload (Mirai)", "value": "2039d7e9afae8e0d2717d899360dae2a37ffc0fb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200196, "uuid": "52646d23-745e-4b96-bf05-98af2f96b246", "comment": "Malware payload (Mirai)", "value": "c7039df08824267ee4ac6f03c3c7ea2bbf97dd175b0f6d83318dd608dd0d24d4056597e29c307a7fe3c2a70c3f017168", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200196, "uuid": "1f052c58-d90b-4787-8b3e-50f09bd754e4", "value": "T16D53941A2A258FADF76C873487B74E229799379727E1C644D15CEE001F7038E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200196, "uuid": "86502a95-fca2-469f-a17b-6af17cc85b13", "value": "1536:dMBsSfxM6HdeKImzB1M116Bc2ueZqf3J3J9:afLHdeKFB10eZEZZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777200196, "uuid": "7091fa7a-38ad-424d-94c5-8094a4bbbd5d", "value": 63660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777200196, "uuid": "a6f8e67c-94bc-4596-afa2-8b05f954775e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200196, "uuid": "3de02cbd-8277-4187-9592-33706e196996", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0da6140-41cb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777247852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247852, "uuid": "0011cb38-d0df-41c5-9158-3254b8844daf", "comment": "Malware payload (Mirai)", "value": "37a5a602cdaf4cac4531dd41a9c700a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247852, "uuid": "b180f837-ddb1-4031-8a77-e6ec222e5e28", "comment": "Malware payload (Mirai)", "value": "b932799d23e985008ef9dc007f0c0298c4f2ef94be13930abdf8a97b1b7623a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247852, "uuid": "450e639d-0876-49eb-880a-65a56f1f4789", "comment": "Malware payload (Mirai)", "value": "e87dc3e15d5368681bf2048ba52b4827807b1102", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247852, "uuid": "4a1822a1-2395-4ed7-ab81-841739b89997", "comment": "Malware payload (Mirai)", "value": "1e7192beb53eca38d92d8dc27543a95737817fb0771b2c0833644aa4b05e9221b5702b059545a98bf3075db77d0c985a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247852, "uuid": "5ecbdaf8-dd7b-4b10-b57d-06d19e4d4030", "value": "T15B144B46FF501EDBC05ECF318A6B832313EAC8C6539AB73B756C995C795A2490DC3A84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247852, "uuid": "5af4864a-27df-4fe2-bc3c-d84c5e632ebd", "value": "3072:XYEzx7GhGs/e7Bot282bbUqUOXXcoWRrgAnY:XYEzx7GA7Bg28obMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777247852, "uuid": "e54693e9-5caa-4a2c-a035-ebfca7e1780a", "value": 196940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777247852, "uuid": "da441cb7-46ab-4c6d-82b0-a49c68c47d28", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247852, "uuid": "9d4d37e9-1737-4748-bd1b-941fbe7d642d", "value": "agent_mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a10183-4197-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777225419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777225419, "uuid": "b54764a3-6178-43f7-bbdd-f183239750c5", "comment": "Malware payload (CoinMiner)", "value": "7b6a98aa24482797010c0c9c5c1914ec", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777225419, "uuid": "3caee15e-14f3-40d9-9ae1-287c941ff102", "comment": "Malware payload (CoinMiner)", "value": "b9608b0578aad10d8187ad8b7cc15325a37b55314167a9b8566a2383096cca9a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777225419, "uuid": "39b9041b-170e-4dc4-bb41-4e7b016b5f57", "comment": "Malware payload (CoinMiner)", "value": "7e3c859ff2ae84f527905d083ead34e67501b1a5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777225419, "uuid": "63d8d4ea-2739-4244-a4ac-7d194b21ddc8", "comment": "Malware payload (CoinMiner)", "value": "65a687ca818da31d905c7227eaba114e3a59a4bc2526c0f8fad0f4e4a89e69fbc52094f87f60b13c2448b213ff4ac5d0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777225419, "uuid": "98aa90b3-f699-43fe-94f5-04f9f1f02062", "value": "T104322B297E8A0331D3A048F85479424F553D5633E797E3EBF773965A4A962448800EBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777225419, "uuid": "cc6341f1-3913-4e23-a902-7bdb4054b3c9", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777225419, "uuid": "2a1fa8e7-c7f8-4427-a073-5f94f3f33090", "value": "192:i3ouWK+DBa9x+eP5GypPFJxTEZmFhSac:i3oQ+g9woXpPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777225419, "uuid": "860864a4-55ee-4f25-8b31-4988e895e596", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777225419, "uuid": "6c2edc8b-752a-4eab-a06c-b6600d3ebc57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777225419, "uuid": "f975e324-a696-4d69-89fa-6185b88a1ab8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c0edc44-41b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777236946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236946, "uuid": "3a36134e-a9de-409a-b4f4-c5da16a54ece", "comment": "Malware payload (Mirai)", "value": "a069411c38d6d51d285f1db25a3b3b0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236946, "uuid": "0e5c8d84-15a6-402c-bb22-aca5acf4eb95", "comment": "Malware payload (Mirai)", "value": "bd6bdffeeb79b79b567aa0ea09f3b630ca67d47a5d1521ec80a24ed8dae6607e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236946, "uuid": "6d08af6b-5cb8-4347-9e7f-ec718464380c", "comment": "Malware payload (Mirai)", "value": "fc938db800620c10733ff7c719f6c87a93353be3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236946, "uuid": "fe14d39b-2c6d-41e1-95f0-593da9f594a5", "comment": "Malware payload (Mirai)", "value": "4d2348539817a037e73feda20cc519a13b7341449af766026c48a1d5f933eca2ebd9e320d57a82d29b7e5722b3c96560", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236946, "uuid": "4eaaeeb9-da1f-48e8-8c04-a02934ddf163", "value": "T148935C02774C0D43D1A71EB06A3F37E583AED5A111E0FB8A650EDB4641B6EB3558AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236946, "uuid": "3fdea23b-7e4b-47b1-913e-ccaf7e86f483", "value": "1536:fgRciN3wVqd78QVISN4UopGDoLFxzERJV7HT:4RcidE1I9mGcLw5HT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777236946, "uuid": "c5c73aea-dacd-4b20-ac42-532f7265a1d7", "value": 91720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777236946, "uuid": "9805b137-2edb-4e28-be58-e4d7710018cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236946, "uuid": "df372cf3-a933-453e-8421-3395bcd23730", "value": "023782pler.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12501ff6-4149-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1777191752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777191752, "uuid": "9321f949-19f5-48c0-8eb2-6a138cfd3570", "comment": "Malware payload (WeedHack)", "value": "236440518c5ca56da8e52bfdf9bcf9d8", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777191752, "uuid": "7836c6ed-0817-4c64-beeb-7d6afb0cb0e0", "comment": "Malware payload (WeedHack)", "value": "be34b0d14f65b6866d9b38f55c9e39c53aefa0c38145ccbd3b6584b4e3d6f054", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777191752, "uuid": "be11dca0-b6dd-4a43-908d-c67b6dd3fef4", "comment": "Malware payload (WeedHack)", "value": "762288c69c49e4b16dfc6675e09cf3c7f59b530b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777191752, "uuid": "1d07c7ba-8695-4a1d-b3f3-b8495e69b250", "comment": "Malware payload (WeedHack)", "value": "67388bef3fc95c5f1ecb2da250607e81454d84dd7a5739d3a3a11ad19fafdd6d4ff6188a13db76d250289de241e4fecb", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777191752, "uuid": "bdf656c4-735e-4f1c-83c7-8bdd29d226e3", "value": "T198461237A0AA8435E67B59B2D8826F33F56A97BF9407676D20B40DC35B729CF0385630", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777191752, "uuid": "df953da6-3125-4b11-b0ae-17aed6965ffe", "value": "98304:7DgGX8aYlar49WXQ5V3scLWEfCCxZwckDjmzDPQOBQ5R6e1YwEXK9CuYDQj9:7Dg6Ylg49h56cLo8wPDSzDPQOB2UyYuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777191752, "uuid": "6c690687-c2ff-4ac9-9599-9503e7f5b004", "value": 5617715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777191752, "uuid": "251c3fb3-e377-433c-8499-f94232743df1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777191752, "uuid": "abe062aa-f2f9-4787-af3d-df9327001a86", "value": "CrashAssistant-fabric-1.6.4-1.11.8.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb459c2-41a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777232549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232549, "uuid": "6584d1ac-6249-42f0-ad93-11036ee16a0f", "comment": "Malware payload", "value": "93f57b9c837fcef7d3c14152fe76f7ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232549, "uuid": "0133945a-0d81-4653-ad32-8f164ef29834", "comment": "Malware payload", "value": "be675fa18bbac3f5e4808353a00be155b8d73b1ecc29c62bb92ea03a8a72b41e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232549, "uuid": "ca902144-681e-4820-823f-4e4354921b5c", "comment": "Malware payload", "value": "3483f1a6bc8871c2786e0d3a4d9be1561fc3d32b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232549, "uuid": "18b907bb-9c1e-4d32-809a-d20cbf365edd", "comment": "Malware payload", "value": "527c073657b67f5841798368ecf3b52ce156aecd49debb1d89e0117187fd87e6c4b4d8076fa13b663477ebc64200c7ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232549, "uuid": "fe01c0e1-bacf-43fa-ac59-c1eb0b880a6f", "value": "T1D1B32A85F342E0B2E10310B11186DF665931EEF72124A82BD7A47FB1EE351C2A665F7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232549, "uuid": "180ba4f4-f2ac-45fe-88d2-ceda8ad2bfda", "value": "1536:Ryivdy1eWeKiIElwMaOQ7NWd2Y7nFlZ/no4DLtq6U7314eA6r:0d19Elw77m2YpwYyiNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777232549, "uuid": "3c24ffd5-c7f2-4b22-89ed-d757fc9f04d9", "value": 108476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777232549, "uuid": "78f61270-a649-4d91-9b39-2047ce043904", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232549, "uuid": "53fe8de8-2927-42a2-b4ae-4b9db0d012f6", "value": "shabak.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70bb41fd-41b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777237007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237007, "uuid": "d19c2e1d-746c-4d74-aaa2-836ec500b436", "comment": "Malware payload (Mirai)", "value": "abc0e0f8f1f055c0d77c3facc7e66299", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237007, "uuid": "ac0d91a8-39d3-42b6-ba80-9a441294dcd5", "comment": "Malware payload (Mirai)", "value": "be9078696066469f47fab57ad81a330545879293655847b84911477f74cf922d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237007, "uuid": "16775ede-56e4-4da4-a230-05ef5a61bf4d", "comment": "Malware payload (Mirai)", "value": "42d247cc4f46f7b21050e7c199bce7c284f9259a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237007, "uuid": "6dc3b258-3049-44a3-a9d2-813e45c1b839", "comment": "Malware payload (Mirai)", "value": "31b879f2a4b7ff9201aa9a2e719a1205d000af50a409476dc7ffc7ff1ef2bebfb042c37f0103265c3d452d571b7e4039", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237007, "uuid": "478df4ce-12c8-476a-99e8-386efaa93c7d", "value": "T10E836CC5E683E4F5EC2209351173FB3B9A73E53E216ACB43C3A5A5269C136C1E90A35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237007, "uuid": "166c9d01-daf6-4172-8178-759282cc5a57", "value": "1536:LMh0Rj4n25p02uloicWP3qamNe/kt4ZlhcSTZ+:LdRjNE2uyibPhmko43Z+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777237007, "uuid": "bf135071-2720-407e-b7cc-7cfb7226c5c0", "value": 83220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777237007, "uuid": "44bd8f2c-740f-4c70-8236-a19a897459de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237007, "uuid": "47049631-aa66-4e9a-ac76-0e6fe0171782", "value": "023782pler.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7689c32-41a9-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777233233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233233, "uuid": "9f77b43a-0f02-472f-b2bb-f19bd12329d5", "comment": "Malware payload (ConnectWise)", "value": "34827b5e200c2be534997a5bab31405e", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233233, "uuid": "c44ebc83-b501-4aa4-82f5-32688f183e6c", "comment": "Malware payload (ConnectWise)", "value": "bf374a3abec9f6124a52e72f09960e65c67e0ac89c34cf2217b76ee10aa47931", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233233, "uuid": "03268842-6ef8-49d7-9e62-ea77fd1c7911", "comment": "Malware payload (ConnectWise)", "value": "b191673f406b6650c90c8557367f278aad9a0d18", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233233, "uuid": "b2286c9d-85e3-4545-9ebb-8c18e719fd59", "comment": "Malware payload (ConnectWise)", "value": "ddf4d49670ee4d427c31da6522d388694fbcaffede823bcec27d0632f1d49174e3c16bf017982fa4ba9feb2da0353535", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233233, "uuid": "bb880948-59b9-4bb2-9d00-a877940989d3", "value": "T11246F101B3D296B9C16F0638D8799269A774BC009316C7BB57D4BEB97D327C08E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233233, "uuid": "9d00dc5a-e532-46bc-98a6-46d3cb7b8f5b", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233233, "uuid": "c087e860-fa6a-4240-ae4d-76be6539ddac", "value": "98304:PGs6efPMjb2w6LeJR+WJ0dX2DSQG1oqryAqqlDQg+l/:OfefPMjb2w6L4Rr0AP0yANlDdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233233, "uuid": "92b36ee4-8d8a-4f08-988b-07965f760cef", "value": 5778000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233233, "uuid": "269ba866-3b8e-44e9-8c28-029e99dd4e48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233233, "uuid": "e718abfa-7f32-4387-8437-e4b861971587", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae7eef8-416e-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1777207899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777207899, "uuid": "26d2844d-106e-4ac4-8661-c2e6853ce1e4", "comment": "Malware payload (Joker)", "value": "3bb32e89bd800feddeb56a5123bda8b8", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777207899, "uuid": "01fdf73e-40c3-419e-b741-cbf9922088e6", "comment": "Malware payload (Joker)", "value": "c03adae879ac44ae9bcafc6a0b323e6e16480d2a4cbaa5bb000fc9182620fbd7", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777207899, "uuid": "2a296a38-328e-42f2-99de-be27ed1bb794", "comment": "Malware payload (Joker)", "value": "7b4de64289fcce22bd519452da2f7493a19f7e39", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777207899, "uuid": "9dde8f96-6b9a-48b1-83d2-492b33b9d863", "comment": "Malware payload (Joker)", "value": "6a76a9484a78458dcc886d54e71f6ee6799422703d16b3d3b0b329742c2ea2f5f0bf1392461a996128cb5da605f34992", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777207899, "uuid": "5d4de3bf-4d1a-4514-9bea-5c6d50f2c5ce", "value": "T13547230EFB0CE42FDCE734384DAF02526226649A4691D3676520D228FEC75E89F69FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777207899, "uuid": "aebad5ee-0d47-487e-bc81-7d5e87240c2c", "value": "393216:hUSDpFd6A27wc26Dfd3WZXFqoDTI91BSsTD0MT+PICWiHPGYxQYsSZkrMW5f:hRDpFd6l7pDfQXpgZPTDpT+PrWiHnxB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777207899, "uuid": "a6f74557-7fd4-4fed-b0c9-6fb5eb11c77a", "value": 24660406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777207899, "uuid": "7fc1efb8-cea4-4c7f-83df-4e1a78b383cd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777207899, "uuid": "7050345a-0a33-48dc-b210-6fcbf660f6ab", "value": "com.aigart.cleaner.forphone_1.1.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb7e74a-41cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777247870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247870, "uuid": "3fe8b0e1-c5b9-4314-9cfb-f6d4468a1f05", "comment": "Malware payload", "value": "41bd4dfbaea47c041f5aaf40e213120e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247870, "uuid": "379704d9-e7e1-4bb2-8516-fd70d8304ae5", "comment": "Malware payload", "value": "c06a2446a9d8680f7ecd2e453daa5472af2dd9a93579b793241de3f861fa7d0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247870, "uuid": "436cc54b-6237-425c-a15a-8795c0294dd7", "comment": "Malware payload", "value": "1cb780e100b80cb67f38fb4672796dd102813a8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247870, "uuid": "55a4bf53-ae11-4b50-86b7-6d8e89bd252b", "comment": "Malware payload", "value": "465013c0376355e802fd4f25f75a93bc8ffda7bb061ca27281b7a7938518bb5f79a52d53a4c3f59ac4df2cbffc18da26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247870, "uuid": "45cdeeed-7fc9-4266-a0c4-1c9bae44f093", "value": "T1D3D3F8C7F900D9FAFC0AE7374853080AB230BBA545925A372257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247870, "uuid": "b5ca17d5-7cbd-45c6-809d-597ecd64f442", "value": "3072:KNbul4MGHJLqHy5Fut5K/cwpifdDounVoQV1jbiGLD3rQpJ:nHy5ct8/cyiWuVosLDMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777247870, "uuid": "ef98a61a-31a2-4258-9030-48d9249ac260", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777247870, "uuid": "52180bdc-130e-41f5-a89f-8b3a0254c233", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247870, "uuid": "8490cb76-83a4-4ec2-8181-a7ec28d39433", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d11a70-41a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777233338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233338, "uuid": "f026fed3-0f5d-4975-b837-07ba03a16961", "comment": "Malware payload (Mirai)", "value": "daf005d8b9e63ba097393fcbc3f1fcf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233338, "uuid": "1c7729ce-5ab7-411f-835e-2879cce5292f", "comment": "Malware payload (Mirai)", "value": "c1afb04669793bca31bc3254c7e2224ffc4bc7292a0bcdbb724b5ce5ba2f5619", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233338, "uuid": "0f62f420-a40e-4ee4-96d5-c092e81ff9f4", "comment": "Malware payload (Mirai)", "value": "4b8c27b5d720ec1768dd7efcadbbc9d0ba836a43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233338, "uuid": "f4143d9e-3479-4097-8502-03eadf93e4e3", "comment": "Malware payload (Mirai)", "value": "21c79dcdadba5589ab402a4811d2102a5cedcf59cb38112ddfb86252da26b924c9a7804bbedfa3b58423b9c56263e7ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233338, "uuid": "c73a72ce-aca7-4f95-a24e-84234692f24c", "value": "T1B6C2E19567A3F70EEF16497147970A96E673340C2D6D893A601C7C21896F84BABCCDCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233338, "uuid": "53fb21ff-e82e-4b92-b9ae-b9d7dd25c88b", "value": "768:gshw8UP2T1rBPUg2xu3aW2fZpNLcxssH34dRQ:XUP2DPU6r3heRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233338, "uuid": "2cc04b9f-ead0-4e5c-9880-7b4af40f76f1", "value": 27076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233338, "uuid": "2fefc3d2-6fd1-4f2a-a99c-c05de65b8f23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233338, "uuid": "b6faf0cb-ba6d-4967-a03b-04c5c2f1e63f", "value": "luxzz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "121994ce-4181-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777215803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777215803, "uuid": "953c2312-e4ea-4687-8edc-187849cc94e1", "comment": "Malware payload", "value": "623b6d9b9d4022ed5613ac13444adb7a", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777215803, "uuid": "1a79dd9e-6849-4b11-8462-b41ec2a84cd1", "comment": "Malware payload", "value": "c2089314f24e59ecefccc9236a474ef9ce7f1f9f7fc597f210bc569327756206", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777215803, "uuid": "44e4a69d-d6ad-47ee-a344-20bf5a220f83", "comment": "Malware payload", "value": "b4f7396e7519d4c881537b73cfd5564a6808f8af", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777215803, "uuid": "83fbada6-49a6-43a1-b6ba-4e70590ec2c8", "comment": "Malware payload", "value": "e06c8335db634b90ff8a76f99524f27b7fd05fd13eb42af5895380daae27a2fb730338afeadd5f51975e6c95df67aa7d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777215803, "uuid": "f45ab8f9-9e71-4647-b2c0-bb91458dd777", "value": "T16162B66A7C47E466C1F39B7ADAEBB154FA2B147B13521040B9ECC1D06FB0C74D2A4E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777215803, "uuid": "1652cbbb-1350-4cd1-937c-ced1f8ba169c", "value": "192:MZ585kERu2Q7vz4z9yefMz7mbIszIcDdakesZIFjDOXjafY5OXh5bB3sh4:YfjO09z7mD3dZnbGfY5s5bBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777215803, "uuid": "b124e998-afa9-48b9-8968-02ea5ea8f252", "value": 14856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777215803, "uuid": "107335ec-b718-4cd8-9b44-7144c7d253c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777215803, "uuid": "24fd019d-05d0-4d75-b0fc-fd5ec57061ee", "value": "HO4DFFamfjZp.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0bd0c0-4180-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777215521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777215521, "uuid": "0d358111-b733-4928-a0b1-d5c49468727f", "comment": "Malware payload (Mirai)", "value": "3430d28e594b4db854fd4282688bbcb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777215521, "uuid": "03c0eac7-e3a6-4824-8a0e-bbd13233288a", "comment": "Malware payload (Mirai)", "value": "c308caa00f8eb0824b0def1ce58f5abf9072ff6e6db0d078718146e819f59563", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777215521, "uuid": "6f8ede7f-7803-4d51-97e2-0f8a4b61e7f3", "comment": "Malware payload (Mirai)", "value": "65b8abc80c833414639f705c7332c62838f46463", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777215521, "uuid": "efa3b7c7-0008-49f7-a173-8789669b0c46", "comment": "Malware payload (Mirai)", "value": "53c2f9d9cddeab90f1be8fe766f56605d281f66d8fe004dc58c0a1e94f2020b17d1c9a9f81e455c9fcf144f4371dc02c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777215521, "uuid": "04cf6f32-cd66-4bb4-ad0a-f2ddfd7ac5fc", "value": "T113D3312ABB619FBBDC1ECD7306A94601108CA95A12D92F7FF6B0D518E38BC4E44D3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777215521, "uuid": "1b9c76de-0c55-4977-bfde-2624f6cf654c", "value": "1536:upUpwpUBAZOcFrMkBQrmWVohoAlJy7KrvIA95fXUG4NZdp92V3d:upUpwpUiPS6nIq5vA8V3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777215521, "uuid": "5a4d101b-819e-49e3-b3ad-c4cd5b083b8d", "value": 137912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777215521, "uuid": "44dc19d5-0444-4713-a85a-9c3cb36b508d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777215521, "uuid": "f09ce598-4b6e-497d-9756-5fbf04f6af6a", "value": "xdf.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7895b1b-41cb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777247863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247863, "uuid": "141ca0b2-3809-4b67-b12c-617eabc63262", "comment": "Malware payload (Mirai)", "value": "c9bcc8fdfa8da0514732bf9d6b78b835", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247863, "uuid": "db4830a2-d4c0-4da0-9ea4-bf438ca1d072", "comment": "Malware payload (Mirai)", "value": "c36d042bd9352b86858d03984e2a3f7000e31cf3308a50e7dadb3b8011c00f3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247863, "uuid": "69ab26f7-f497-4b08-92f2-a16ff2d573a5", "comment": "Malware payload (Mirai)", "value": "1fc8e43b0b6f97d63bc88d8e2964b8148442b699", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247863, "uuid": "0bd829b6-0ae1-462b-ba0e-976513e7d493", "comment": "Malware payload (Mirai)", "value": "32f6b8589dfba5d1b520be50b60fe46749250eefd41abe4e7d61791775bd4b53fc989757165655c70949fe4d4db5d8b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247863, "uuid": "44ea5f21-068e-484d-975e-7ce6b43b86cf", "value": "T16AB30945FC505B17C6C652BBFB4E428D7B2A1768D3FE720399256F30378B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247863, "uuid": "14876fe9-343e-45a1-a97b-6c2c03542eae", "value": "1536:TUK9yqnU8vGRz4VA4j6T9y28Ty6O5FtZpqQcZlCtwywXvqcVuafhPeA45Zvj:AixnUHz4Z+5ypkn3E8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777247863, "uuid": "83746fec-c736-4618-a62b-04abacec9866", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777247863, "uuid": "c30556a5-2352-465a-b9b2-0d241d8cd210", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247863, "uuid": "829d2077-0e5d-4fa4-8c8f-b7c4b5ef3953", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643589ac-41c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777246865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246865, "uuid": "cecd741b-9c01-4fa1-ad3e-a18efb5c136b", "comment": "Malware payload (Mirai)", "value": "ae11170b8be228afd7b6c23a95c6bfab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246865, "uuid": "e6462541-5956-459a-8bc1-7767d4b9aaf9", "comment": "Malware payload (Mirai)", "value": "c5202a2410ce5d0f8a2451e5eb0b8387b21c300e673e12d96bf87f6378791c88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246865, "uuid": "48c43d9e-f21e-4bd1-9c1d-e6208d404901", "comment": "Malware payload (Mirai)", "value": "afd033ccd7317783b344102d7c578151cdd8a3b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246865, "uuid": "fc74453e-097e-4fb4-bff1-afc115cb0c6f", "comment": "Malware payload (Mirai)", "value": "7e814cdfae6b69f4adf45e4c2f32f80fdd5ff1f94202b06dd8df05a7bfd0e03a2f0050981e70a6a608b133516d7be254", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246865, "uuid": "b28158a4-e190-4623-b880-b1de3f8838eb", "value": "T1CED38C12B8D14EE3C1821BB812F399385762F8159B270FB3B61CEAF915079DC761E369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246865, "uuid": "c1cbfb3d-4503-49c6-9ebb-d795e93ac2d9", "value": "3072:HK5FVp0F4/C4P3vlpuzCoj/sESHNK/rCLG+1ipqX:HK5FVp0FbebZQsWTq14qX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777246865, "uuid": "edee34ed-220a-425a-8070-960c5ebc411c", "value": 141733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777246865, "uuid": "7eae3caf-3f58-4fbe-9779-795fc712d86b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246865, "uuid": "de823209-62fc-4e7b-9cac-5c5eb00df745", "value": "Yboats.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a012e24-415f-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1777201348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777201348, "uuid": "d452b4f4-62fa-4569-a0ee-00abec11a4b3", "comment": "Malware payload (WeedHack)", "value": "057ea0de4fc7f201d25d27747930b2da", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777201348, "uuid": "8c1bf907-fa45-4e42-8bb0-3867a868adc0", "comment": "Malware payload (WeedHack)", "value": "c5215f48f6038ec5d14d29e380b9760135f328bcf49c6f78571e0cf2b23278d4", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777201348, "uuid": "6d33f36e-8550-4b91-8c20-e59b6734c6a2", "comment": "Malware payload (WeedHack)", "value": "3d0ebd84186d1589b1c665804a5cf9e5908ed250", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777201348, "uuid": "b13133c3-df5b-4f12-8340-66e9387eecce", "comment": "Malware payload (WeedHack)", "value": "f60fc3856d4dbb228986bc1883ff59813b0477a782c4dc8ac8eb7eb19fbb7c4480ec1353acbb7f9a16b4274058491167", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777201348, "uuid": "2b891c68-0750-4d64-be1f-f1ab1ac2d01d", "value": "T183353335AA4F0D20F5F9BB70878D22F55E255A2C06A67F5F40C6FC661F024CDB9A9B10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777201348, "uuid": "bc01b951-db48-4cbe-8d0b-26d99ded8ef6", "value": "24576:jVQ0zfRMCbyYFGQhPX0FWTg+f4jbcXXUYEysq1LqjEogFDp24o9c:jVNR1xhPiYgomNYF5+dUdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777201348, "uuid": "a9f7ec7c-d5e6-4593-9966-ee1a7dc117a5", "value": 1162612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777201348, "uuid": "a87ae37e-6193-41e0-a27d-461389ecde2b", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777201348, "uuid": "6ec3de43-ae78-48a1-ab81-c6829a771ab6", "value": "krypton.1.21.11 (2).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f73a20-41b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777237014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237014, "uuid": "219d19c9-c95f-479c-b0e8-8ffa3ae69a70", "comment": "Malware payload (Mirai)", "value": "ec0a098399e6d7ea8f63fbbfb754cf22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237014, "uuid": "fdb80334-e793-439d-83a0-bc62f508c927", "comment": "Malware payload (Mirai)", "value": "c6bd569705f6a3375839cc22edcf795c93eeaf67818689ba1016ccdb7ef1d25b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237014, "uuid": "946ac504-6264-483c-8a74-f6978a0674ad", "comment": "Malware payload (Mirai)", "value": "0c794a382c5d093fa79866489f69bad2f3e4ce5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237014, "uuid": "a04470d0-8c69-413b-a535-086d263bf1a6", "comment": "Malware payload (Mirai)", "value": "076184610fd2a18fda1839f81662872730af45668d2dc5188002427187e3b37ca876d4ad421d2950daab1f2ead071733", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237014, "uuid": "518b622b-676c-4faa-93ad-4ef5c25fb9da", "value": "T193B3D70E6E319F7DFBA8823447B39F21A79923D227D1C585D19CE6011E7038E285FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237014, "uuid": "dafe53a6-bb80-41c4-8bc6-093e59d356b9", "value": "1536:LIYBLaZQ6sdHGWKODP0B1EE2xY44YY44Y8sc/0Uh3X9DQPyJCGYo6Tj2Xp1p0oBu:p9a1ARvP0BFYoSj2XyoBodnCryGjXW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777237014, "uuid": "b89954b2-071c-454a-99d0-5ceddf78a28c", "value": 117980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777237014, "uuid": "7e79cb63-58e1-491f-9d79-abef5549b084", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237014, "uuid": "767076ad-58ac-438e-9935-f274df34adb7", "value": "023782pler.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc09c09-414f-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777194643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777194643, "uuid": "fad942b2-634e-4954-b135-4f155ae12fcb", "comment": "Malware payload (NanoCore)", "value": "7c96d5874539bdf4d32520ba53d17d88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777194643, "uuid": "b66a4dc5-fbb2-46dc-939a-369460605887", "comment": "Malware payload (NanoCore)", "value": "c702ec4d3e248d3a70d1458ff658048bb4c81c39f4eba94449f13dc8df11a91c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777194643, "uuid": "caed4e27-0fe5-48bf-90f5-6096fcf46a0f", "comment": "Malware payload (NanoCore)", "value": "eb97f3360cf3524e50cbe1e104027c5cccca29b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777194643, "uuid": "8e8cb2d0-5cf5-452e-b661-a02fa05706b3", "comment": "Malware payload (NanoCore)", "value": "90d351d01b626ac5c7f413c4792494966a33b3d067a5279beb222d12abc6ae8ac841e393ed057bcddbaa7564410bca82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777194643, "uuid": "18143031-dd37-41e2-af70-7d63d77cb3d0", "value": "T13414C05677AC893FE2CE8679602241429779C2E3D8C3F7EE28D855B68F127E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777194643, "uuid": "363f4fac-effd-4197-af95-f0a3dd7d9be0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777194643, "uuid": "4c376477-8098-40df-b974-e3dd6b975e0d", "value": "6144:YLV6Bta6dtJmakIM596d/AQBSuZ1iXbvf:YLV6BtpmkV5Z1On", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777194643, "uuid": "27ff3d81-82f6-47ef-b79b-39626456f31e", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777194643, "uuid": "4f91fa10-4ad5-43c6-b73b-091084460b85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777194643, "uuid": "09170ee1-09f0-4403-b5a5-1b77f1a55831", "value": "appslot365.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83422209-414b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777192800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777192800, "uuid": "84169dac-1b33-4e5c-b89c-95952c757b49", "comment": "Malware payload", "value": "108f23bf173d59247491ebc419596e56", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777192800, "uuid": "098627ab-52b5-4297-ae32-91e2d1d6e59b", "comment": "Malware payload", "value": "c72d83574f944be80ec569963810a29fee4feff2d119efc227358f5d6c7e1c72", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777192800, "uuid": "65076b37-1b84-4973-a90e-41d56f09f67e", "comment": "Malware payload", "value": "c753d27562b8a34ec5644be596b4877a8887f4b5", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777192800, "uuid": "29c0d3c4-83a7-44c2-a69f-14aa583837b1", "comment": "Malware payload", "value": "de9b72e60b250b4a62b803a1602b9028504568687f0c1ccc8bbd94b419924ab983c0787e4d5d370ab0cd2061494548b9", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777192800, "uuid": "60444885-a7f9-4bf6-9f3e-e7ad9f82eec0", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777192800, "uuid": "688d51bd-b54b-4ee5-be36-78d0566a9438", "value": "3:VSJJFIqF1F65IFV7Np:s8qF1Fhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777192800, "uuid": "d0339a7f-3032-4129-9e64-933209b62249", "value": 44, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777192800, "uuid": "6e8b8134-c50c-4ce1-8950-2bf841407e03", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777192800, "uuid": "8989c708-46cc-423f-9cbd-0754abb51180", "value": "c72d83574f944be80ec569963810a29fee4feff2d119efc227358f5d6c7e1c72.PS1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ba99c4-41b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777236927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236927, "uuid": "09c6194a-651e-4ed5-8850-7e062e637ca9", "comment": "Malware payload (Mirai)", "value": "7219ea9e039a602c77755c73f3a72514", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236927, "uuid": "f9ebe05b-513f-46eb-8c1a-2391b7de876a", "comment": "Malware payload (Mirai)", "value": "c7c5207a1613f80d8a463df707d093cfb1db3374c87db52eb86f47b2b2836394", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236927, "uuid": "a37adde9-fffc-465b-b227-645fd764792a", "comment": "Malware payload (Mirai)", "value": "863a1b10a07d5227cbffbe3f4c507d3e5a8d810c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236927, "uuid": "54c55598-b5a2-4bc5-9f4f-fb5614d1c9ff", "comment": "Malware payload (Mirai)", "value": "cbcf0e0df068fec3dbbd7232476fd7a4c0502530d6c88322beb165f73b07adc7051568b6f19001df9f2fdb41082a50ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236927, "uuid": "75bb6c4b-8910-4898-8130-32b0ee1e52a8", "value": "T142A328CAB401DC7DF80FDBB64463590AB931E3611A830B27636BBD93AC321E15917F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236927, "uuid": "922ce0de-3554-4197-9700-74310a7d5ad7", "value": "3072:GHHCKtK0cO0LT9eYUP5iOn02UQd83bnZVF:+CGK0t01wgO02c3bnZVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777236927, "uuid": "421f2252-6837-4665-bd6d-d4acbbf1def4", "value": 98844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777236927, "uuid": "8e6b1453-bd45-4506-a292-8e95d21ebafc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236927, "uuid": "f6ecd7c8-8a6f-455e-8e04-ad1dfd45fb71", "value": "023782pler.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25edc7c6-41c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777246331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246331, "uuid": "30fbbd5b-4bd0-4efa-b0c9-731f18fa41cb", "comment": "Malware payload (Mirai)", "value": "6589db36e7e8876ef2ef44f2cfa9c7a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246331, "uuid": "c7f71a28-1fd2-465d-8291-ffe66408fb82", "comment": "Malware payload (Mirai)", "value": "c80deb663184da8429500b6e9715aaa2126d26d9abe2debf8adeba0105c2fad0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246331, "uuid": "d6b28791-9080-4b7f-a5ef-9157d94ea6b1", "comment": "Malware payload (Mirai)", "value": "bf42ac145928f0e731b844fd770121de5e265235", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246331, "uuid": "de5f268b-7378-474c-b60b-9c810c4c6064", "comment": "Malware payload (Mirai)", "value": "5a12ad3787f8669d7e74c04e48f4bfec9a8353c98d7f0bd9065e582c84024a6bcd59c60d897b17af4610eefc9e1bd879", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246331, "uuid": "955497a6-c721-43eb-aed4-4b6408adfa19", "value": "T187157DC9E7C7D4F1E55301F50A9FC7B60534A2264003F6F6EB8C9A767472B522A1B22E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246331, "uuid": "0e5af11e-2a8e-4de8-8fc7-d81d82535d2c", "value": "24576:ZcOCOhKh4LhyKHR4+5cGXUbuW6QNNTk3Iq1Rz8me4EdCRQOHkJSJ:Z6OIh4LhHGqmuWJk3sdOHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777246331, "uuid": "a1feb6f4-ab76-4faa-b770-867c676731a4", "value": 937232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777246331, "uuid": "2c4908b9-20fb-4168-aa23-38726a2f36f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246331, "uuid": "1445f58d-2abe-4b44-b550-5cf21e1b036f", "value": "agent_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee35e8b5-41c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777247096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247096, "uuid": "a908a338-d16e-49a5-86d9-b44578a0db99", "comment": "Malware payload", "value": "b212b9dde2c6039243c05fc52e616be8", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247096, "uuid": "84bd5c4b-99cb-4156-a32b-2d22c9dd5e06", "comment": "Malware payload", "value": "c892a74ec0327a2a8298eb9412818f3ebfbfb1cc02211241e9f7086a0d0c9b66", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247096, "uuid": "8a207c55-512b-43d9-b4dc-1d31c1a38432", "comment": "Malware payload", "value": "654ee767d580aea3f4f84bef4b57132f86bcb3d7", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247096, "uuid": "30d339fd-9f52-448c-9cd2-595d71bb1270", "comment": "Malware payload", "value": "745c18a32d597d74b72d7a0f3d4e0b0b5db85de7f6f5c07be8dfc63fc6d99d80e1824358cc8977cc10869e8b54fc5174", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247096, "uuid": "90cf6754-01d7-43e4-a430-e04bf5655490", "value": "T15806CF316866837DC2472AF210FAD4DD7B1BB8C0A9F7293714583660C9B6B405F1EABD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247096, "uuid": "2b6820e4-3511-4d3d-ab6b-99c0b4f41068", "value": "d9bc6a5333d82a38a77fe473e96e5c34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247096, "uuid": "80976453-306e-4f64-9568-12cf5f94c27f", "value": "98304:M7ghf8N8O2jurAESTdovuBkSYYd+PRPp6FcOl:0ghf82O2qEUv2kUdTDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777247096, "uuid": "2ba149b1-476f-4e36-9b1d-63da3aec3f5e", "value": 3801088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777247096, "uuid": "7f805387-beaf-4bcd-a0b6-6ee168a77a10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247096, "uuid": "9c8be3a1-810c-431d-a12e-257ce8bbbee6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43da8542-41b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777236932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236932, "uuid": "78f3c487-da25-477e-927e-8ffc03997a05", "comment": "Malware payload (Mirai)", "value": "32ef0c3eb23c670cd6b20a0421f88a8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236932, "uuid": "3d34fb80-a62e-4723-866c-f8717b53fd8a", "comment": "Malware payload (Mirai)", "value": "c99c02330529253b033a50c0cc77d24e097b97ef0082e60d3312c4c65e45374d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236932, "uuid": "8a3acb2c-7813-4d53-8614-f324964b2ed3", "comment": "Malware payload (Mirai)", "value": "e5c8679465bfb71d6f7a65264d7c98bf7d195435", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236932, "uuid": "b1cb7ff7-8be8-4c2b-97f2-d84d927dc610", "comment": "Malware payload (Mirai)", "value": "4d9014c7a16172af7ab904a582dede43f87065bca87a3e9543375ef69cab9afa3fea118e04f1ccdf829f49ecf60dfc64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236932, "uuid": "ee325c02-dd13-4e2a-a42b-7017ba3855ac", "value": "T1FA6302B8BF9E3196E9540030ACE387251D692AF7AD4B7E161D2260FE8E130073DD1287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236932, "uuid": "323dcf12-c674-4790-8406-ef83447c4119", "value": "1536:qm3iXA87kR6PMI865BZRPVlQrkMaL3k/LLZ2gPdhRRcVLQ:qmSZ7HPj7ttRX3kDLZ2khA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777236932, "uuid": "0f665844-d39a-41f8-b4a5-6ef68f62e87b", "value": 68092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777236932, "uuid": "c4a17796-1a93-44b6-bd26-8bbe02ce2ad1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236932, "uuid": "d236851c-130e-4486-be0c-f3427ed28f62", "value": "023782pler.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d177c82f-41ac-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777234592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777234592, "uuid": "1d5b24d2-95c9-44d3-a1f8-5e5179042845", "comment": "Malware payload (ConnectWise)", "value": "91c6c556a4a8abf0bc0d938985579ee9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777234592, "uuid": "7f8a19c4-53e6-4e63-899a-865051e1173f", "comment": "Malware payload (ConnectWise)", "value": "cba1ee4a393b13018670a55c94819fce1cc69580bbc6f7a4bc1b3cee3db21f85", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777234592, "uuid": "361021bf-2a3a-4b9a-9428-77d3e4326748", "comment": "Malware payload (ConnectWise)", "value": "72b88ff03db3999d71c1996eaf819d52a21765cc", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777234592, "uuid": "75c6cbc7-baf5-4ec3-b680-cdd92b9bcacb", "comment": "Malware payload (ConnectWise)", "value": "21c878b3bc7b663efecbcdb35ce4d0dddfc418dabc5c4dcd9e5e15b0f26307c6e8459b918260649b586b4c771199633c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777234592, "uuid": "f9ec64b5-6849-4257-9f6d-b4dddf946da8", "value": "T16946E101B3D695B6D1BF1638D87A52A56734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777234592, "uuid": "30bd483f-9c2b-4a84-9084-146b052d453c", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777234592, "uuid": "b6ca3525-0cd6-484a-a945-0a2b2a5c3f99", "value": "98304:GzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlr:GhfefPtHxcp9ym3nltDUJVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777234592, "uuid": "d80092ce-5975-419d-b99c-53f6376f9dfa", "value": 5680256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777234592, "uuid": "dc334a9c-b860-4c9f-b795-cbcb27949d41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777234592, "uuid": "02be71d6-ef6c-4c0a-b0d8-1e675b5e7bf2", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3064686d-411e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777173334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173334, "uuid": "3bb9de0b-d93d-4695-8475-8fc93a87b6f6", "comment": "Malware payload (Mirai)", "value": "c796bfa7a71183754030256529224a67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173334, "uuid": "b21b5c25-805f-49fc-ac45-162f942bbc4b", "comment": "Malware payload (Mirai)", "value": "cbe3adf3336c223849b5ab3046f0a0039d63bc39d29d269997458042f460e96a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173334, "uuid": "f66909cf-792e-4639-809f-fe4807946257", "comment": "Malware payload (Mirai)", "value": "9cc5fafefef3e4fe2f952c023c5dd9fcca3b16ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173334, "uuid": "7380ed35-5289-4a26-9cf7-72908bfc7c68", "comment": "Malware payload (Mirai)", "value": "d6a24f635e9ade79665c3a8d9dc23dc0892c1636c19fce008eeadd892d16adbe04bebcbb210f89c66434cb102313db79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173334, "uuid": "35d02e9f-c314-4ff2-8ad6-f6f51abfa1b1", "value": "T17F334B42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173334, "uuid": "f8f20348-590e-4b3d-a9b7-a0e5de028aed", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GdPS4yns96BktDgIPi8Twr:ivW3jdQGqt7Y+Z+wN9cGgI6br", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777173334, "uuid": "e9ad6a23-8c85-46a2-9679-1620d134cd34", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777173334, "uuid": "b032f061-9e90-489b-8612-cf9ef9cbdfda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173334, "uuid": "3864a02a-1881-4f02-926e-977c9b0ca66d", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e26c79a-4161-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777202267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777202267, "uuid": "93a3d3ca-1fb9-45fb-a72d-55cbe2127d9f", "comment": "Malware payload (Smoke Loader)", "value": "fdca9a03612a6f3df2f5a2438e632b1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777202267, "uuid": "f3d430ae-3a91-4897-be71-574729dc7db3", "comment": "Malware payload (Smoke Loader)", "value": "cca6a5ed0923cbb7539836f7865bf0bed07037bb453374022be5217ef03fd40f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777202267, "uuid": "7bc341bf-a914-4359-9a35-46f898f28821", "comment": "Malware payload (Smoke Loader)", "value": "e2c4d133c06496e9fd4ea8e16a9301b69cdf0e72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777202267, "uuid": "4c1809da-4954-48e8-a2da-fc0bc19ede2b", "comment": "Malware payload (Smoke Loader)", "value": "f39f47ddcc7f2c989cef695a6795aaf48c4d07db771ab38a1c2f929a3f5b233c6fe2e87bd0bfc91426b9fa65829ba4a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777202267, "uuid": "7e230f33-f282-4190-b6c7-55d8ffa52eaf", "value": "T18BB56C0279D104AEC49A77314CF62681B734F8480B2667D32F93AA743EB7BD15D7A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777202267, "uuid": "10b7c6aa-b5c7-4108-990d-15f7dea29421", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777202267, "uuid": "aa5e5c3b-31f0-4e3c-ae57-9f1a2b2e4082", "value": "49152:C2qjOfs6LdoA6Mnd19wnjtKeuaFXidiHCzGpozv5Hjusp:C/uSnNjtKeu1cozv5asp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777202267, "uuid": "b94566e1-deb9-4090-ab2b-e6e876b4b1e7", "value": 2474512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777202267, "uuid": "50cfa7a5-34c9-455d-8820-2ee2ed603042", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777202267, "uuid": "be248273-786a-4b8f-ab70-1fd662dadde3", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef0bb445-417e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777214885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214885, "uuid": "c6e8f731-4f56-4b77-8f54-c9c3ca109b9d", "comment": "Malware payload (Mirai)", "value": "58bfe248cf6e787bfa8d967a02a509e1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214885, "uuid": "27068b0e-4f3d-4ac6-9034-309759f60804", "comment": "Malware payload (Mirai)", "value": "ccdd99bf2a205b516162f5b0866245cc7214b3a498018a32e15f22c8b858ac1c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214885, "uuid": "66da4fed-7acf-410a-9570-7519fb79e6f9", "comment": "Malware payload (Mirai)", "value": "7511e7afe20375bbd504d18a5dc8862a298aaae3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214885, "uuid": "8694ade2-a729-4915-9f42-c2c6115fc308", "comment": "Malware payload (Mirai)", "value": "d3b5960afd71a9a628b56a8061802444e2dfa7e8bc1a19dda2810672033b8aeb42f1ebaf07b99498f9131badb5d79999", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777214885, "uuid": "2d17e208-1fef-4802-b9e3-7333c6111f77", "value": "T17493E51B9B2C0F47C4EB8AF13E3727E4876DB96101E841C85917EEC507379B16612FAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777214885, "uuid": "2976c9e7-7cf4-4ed7-a812-5c64ab364517", "value": "1536:Drn+Zta344ctjvGejUrBQOQMRz1xgJoW040z3sX:ue344X+czDgtY3sX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777214885, "uuid": "09390e85-8fb6-439a-b4fe-59c690cd8fcc", "value": 91704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777214885, "uuid": "a09f311a-c791-4591-a7ed-12d063cf96ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777214885, "uuid": "7b8ba01b-660d-4045-b508-ce0e0b584a01", "value": "xdf.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e58203-414f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777194580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777194580, "uuid": "73334d81-34e4-4b3f-a21f-c22154f90395", "comment": "Malware payload", "value": "1150f556ca525ba7cda341b8f3d643ee", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777194580, "uuid": "9a439b90-eb86-4cee-b793-34ee9a6eb8e0", "comment": "Malware payload", "value": "ce7ab39fb850026562715fd647f796e34a175ede083fecc7d5741b89b6e3aeb4", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777194580, "uuid": "791ffd39-f780-4c1a-aa12-82567bb574ae", "comment": "Malware payload", "value": "00ac78e3a42cddd07f0563a0bba53ad562af5a4e", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777194580, "uuid": "8fd61bfd-9e2a-4678-9573-6397e26bd007", "comment": "Malware payload", "value": "76880f46946a64db70f88f111df9e1217e2c87a8e8fbf8c059cc9ca9144f260c162212025d4f1ca297f371a53d35e23b", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777194580, "uuid": "451ef1fa-e604-49eb-8b71-7d32c626b231", "value": "T168E623E690D521F0E5DB4790724E5BCE3591706A4ABD7C2D3AC50C42AB76EEB060EF23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777194580, "uuid": "3aa5e61b-ba8d-4113-946c-46f686761202", "value": "0938e6d4824defd0f860b06e1b4080e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777194580, "uuid": "4d1e9f23-89a6-435f-ac57-8cca797e53e6", "value": "393216:SVZwH3oIFcYB8yVXlk3K/RGo7ZwfK5EoEl:gwHY6cYyyLk3K/X7Z5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777194580, "uuid": "7746bfa3-a169-4fcb-9678-b851ab6599b6", "value": 14074368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777194580, "uuid": "94819d1e-ffbe-443f-a6a1-8e8f48243a28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777194580, "uuid": "8cba7473-ca45-4960-84b9-9adf9beb4e55", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970bf7aa-41c2-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777243943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777243943, "uuid": "9ec96db4-1b1a-4968-8321-76a0905aa691", "comment": "Malware payload (AgentTesla)", "value": "fcac10f8e4474a1470c29a836f758a49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777243943, "uuid": "dee0f832-854a-40c6-b18a-044e072b1826", "comment": "Malware payload (AgentTesla)", "value": "cf594e3556e5a225ea250aab0b818120425b55607683d1aa9a1c19af9169b108", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777243943, "uuid": "6098ccef-8c00-4430-b663-503239b9e5fe", "comment": "Malware payload (AgentTesla)", "value": "c1643eef4966816f978db55501eb99754143eb88", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777243943, "uuid": "c84e984e-72e5-4f52-b560-697a796b756e", "comment": "Malware payload (AgentTesla)", "value": "f5fb189408439e9bdc18791e2be096217143ee5d6e9158b6d8420049f529fa4afa2b83fab6dc1069890865ee3da65e85", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777243943, "uuid": "e87525f7-b09f-4583-8381-3a19d79335b7", "value": "T1FD15BF126D46AF45D5BF0B788121106A73F2CC034F93D7DA5EEB3ADC3963B518A66823", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777243943, "uuid": "822a1719-983a-4ca9-81ca-447f21df8c31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777243943, "uuid": "11232e64-a12c-4f90-92f3-5e211363a02f", "value": "24576:NwQjx6U0/mgMzL9pp5F50DbG3WNk1+zj++3y:CQ8EgMzL9pn6ag4Mj++3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777243943, "uuid": "21535706-4055-48db-a358-64d19be87948", "value": 893440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777243943, "uuid": "5e29c8e3-8201-4238-a038-dba737862efc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777243943, "uuid": "6fe3dc69-e539-4ddd-a245-d254c5215a9b", "value": "sale order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0230ad-4167-11f1-a769-42010a9c0008", "comment": "Malware payload (EvelynStealer)", "timestamp": 1777204792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777204792, "uuid": "cca8d018-a772-4bbd-91c7-11aa047884cd", "comment": "Malware payload (EvelynStealer)", "value": "d12be47c72b6cadcade5da31bb0c5fd3", "object_relation": "md5", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777204792, "uuid": "656b0e20-1c43-4dd0-a370-ba3ed1d16ac3", "comment": "Malware payload (EvelynStealer)", "value": "d031fe2081f05f1cd65de0dd70401989f075e0e3a37cc5a23a1a43a8a4dc8580", "object_relation": "sha256", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777204792, "uuid": "d6065fd4-17e1-4612-88e8-6e4c1b9ac980", "comment": "Malware payload (EvelynStealer)", "value": "ba489631b7df2b1302439bf099c1fe349ff055e0", "object_relation": "sha1", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777204792, "uuid": "70470d1a-4e6c-4ba2-b9ae-58585a0738c8", "comment": "Malware payload (EvelynStealer)", "value": "11995b81cde411e9c746d7cf8d8e9c3f963db9146e55d2994dea6fb0c02cca2adc8593d4dfd45498f753a79ff22303c6", "object_relation": "sha3-384", "Tag": [ { "name": "EvelynStealer", "colour": "#F1656C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777204792, "uuid": "4435da55-f5c6-4eb7-8b62-e73ef253d1a3", "value": "T1F9946C89F7C9ECEAC9110131485B43B92339FAA41A8ED733193CB7391FE29D1ED51A46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777204792, "uuid": "e89b4ae4-83c4-4037-a019-4bff15c8c8d3", "value": "43d7dd2fa664ac83cc607bf541a9a330", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777204792, "uuid": "02fe9214-4627-4dd4-a462-046d121197b7", "value": "6144:6+vnAoUjfjqrVisJGcr0+lSrKmul/cbFHey+F+G:lYLjLqrVi1x8SrKzUFH2F+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777204792, "uuid": "aedb74ff-747f-494e-9b72-ac4513594557", "value": 428522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777204792, "uuid": "7803b91f-9093-4807-a6e4-b2228039d0d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777204792, "uuid": "2d7cfd2f-1087-4b81-9489-bf3356088d79", "value": "SolarisLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ea5151-414a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777192291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777192291, "uuid": "0fbaccc1-aa0c-4fc1-b1af-a6c4b2eb4dcf", "comment": "Malware payload", "value": "3274be89e0afefecaad9929765f0c56e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777192291, "uuid": "f2aecb1e-b271-4aba-9146-7090afbd3246", "comment": "Malware payload", "value": "d04797a0ebd841da1f875a30ef19a9ae700c4d713ec6b57cc885601adee51b03", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777192291, "uuid": "6c540648-e1ed-42de-9544-2c2abe059518", "comment": "Malware payload", "value": "dd6458a3211bb202265ea1d33d9a787735061301", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777192291, "uuid": "6ab2914a-b2a5-425a-8aa1-433a2fe51440", "comment": "Malware payload", "value": "25fc098a61116f4a353d50b6c351f6abc13a23fbc806a66c0e3af14fd5ab7385a2fe5c7326b29929025231a3243a879f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777192291, "uuid": "ee06ebc9-0c01-413e-9b89-b574f63aee37", "value": "T1460823EBB301FD38D1B3463297469561FD284E21DB12E10B6408F72DAEB36D045EA7E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777192291, "uuid": "be590207-d9f5-4432-b15f-9f58b11f1eb7", "value": "1572864:VowDl2UI0PSYD96txURn8gOX5KNkFVvci1jbCU0AUqa1dAt:VoJUI0P16txrPX5KNkFVx0tdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777192291, "uuid": "49d045d5-4ad7-4be1-9a3b-9a99031a3ca8", "value": 77537538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777192291, "uuid": "db92418b-75fa-49d5-a8b5-59a8e11522a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777192291, "uuid": "2aa5c77e-a5d6-4575-9e82-8b7720adadfc", "value": "Telegram1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b64026-41a2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777230224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777230224, "uuid": "d454a02a-4736-44df-9ab2-0fae5225093e", "comment": "Malware payload", "value": "daedf7188c21ebf3b30cd1e5a3f9d742", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777230224, "uuid": "113788d7-d6ec-4f07-bd41-391026b86e7c", "comment": "Malware payload", "value": "d109a1ea4aa75cd898c19a57a80065ad74a5d67a509410af84d6477b521bcf17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777230224, "uuid": "b602d961-e5a2-4372-b33c-7577ab045db0", "comment": "Malware payload", "value": "de3b937ac502546def69a51915604ac5662c9448", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777230224, "uuid": "2bd1b599-a45d-4f4e-a9c4-b66459381cfe", "comment": "Malware payload", "value": "da69418a106f8ddb7f6cca548d57108247dd8921ddb2f8c786d69ca0c16c83c2337464b85f01362f09985704af01384b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777230224, "uuid": "ea245a26-0e8d-44eb-a9be-5de54cad6595", "value": "T15B545B16F54494AED09EC078834785B66BB274CA0B31B6EF13A406343E6AFE12F7D758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777230224, "uuid": "744f9911-0f60-4766-a46d-c6b8ee4649d0", "value": "4d3fc231e00a1b27bcf9e5331c32225a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777230224, "uuid": "a6361b63-4bd8-4305-a3dd-8cb416d67cd7", "value": "3072:QgYpGW3DTyb/9tCl7KyirqoNcurj/bMSyP5MtfOm9a29Hw5XIjEP9oTp88ieY0AL:vYDDebul+y2Q0DyP53wa2OCkEp83PL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777230224, "uuid": "71061fb9-7231-4ce3-a7df-e0ba6fde621a", "value": 303768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777230224, "uuid": "ef028e84-4c7c-4839-8e7c-87a4d15bb957", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777230224, "uuid": "f434beb5-f440-468d-87bb-a0e92a992320", "value": "userenv.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5812c3f7-414c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777193157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777193157, "uuid": "b47241fb-95fd-4f9e-bfa0-b2e1e0f0d3fa", "comment": "Malware payload", "value": "96da3fcdfecf185938f2863751ada37c", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777193157, "uuid": "2790bd26-4381-409f-b275-c63849b3bdeb", "comment": "Malware payload", "value": "d177cd262d9c52a9e66cf3cb1e41afbc6812e9a7b69af4a2d92a59fd2e0ed60f", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777193157, "uuid": "7f8dc863-4f9f-4656-8e57-a2cadc18894d", "comment": "Malware payload", "value": "60977f6ff0a79a859ebd13c10810d28a4f915d5a", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777193157, "uuid": "63d7a851-d729-4ca0-829e-92c2de321111", "comment": "Malware payload", "value": "9c086dcad39f574d6437efa3252bebcfac04883ed10c715c4f77e99711dbcb03314568e93f006bc8781ca2d64d36e99c", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "insureongo-net", "colour": "#DCFF6C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777193157, "uuid": "80f225e1-217e-46b4-b316-5b7ccd5c7491", "value": "T12C56332AF43819C5E827C57FA0F22AD541A1231FD583E47AA6913BD8F1E37C908CD56B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777193157, "uuid": "e85529f3-3916-4c4d-89ed-26db2ea57ffa", "value": "196608:FlbHXUBZftn6/vDP8gF0uU+HB/OGUElH6XU8Yk:FlbEBBxIwCrU+h/PUEl0U8Yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777193157, "uuid": "97317fd7-1df3-44d0-9f57-2066a4e77a02", "value": 6459071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777193157, "uuid": "4001024d-71d0-4b7b-9233-8ee671eb5db5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777193157, "uuid": "95ff439a-86e9-4e8d-ba97-53eef3b9fdfe", "value": "d177cd262d9c52a9e66cf3cb1e41afbc6812e9a7b69af4a2d92a59fd2e0ed60f.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9df39cd-411d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777173215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173215, "uuid": "ab147948-3292-4e5d-8f44-5fa68434b23b", "comment": "Malware payload (Mirai)", "value": "4aa925fa866782f27ac9716f1094ff10", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173215, "uuid": "f25992f1-5187-42af-bbfb-37eb5e5b19c7", "comment": "Malware payload (Mirai)", "value": "d1b4cba62f90f288bf4d421ff1a91f3a6e96a957b57e1346a57e3e3fb36c8824", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173215, "uuid": "7dca7f24-7127-4114-bc45-c39d5cde0daf", "comment": "Malware payload (Mirai)", "value": "2743ef9e700b0edc1eb9c95f2916819bb46a5c99", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173215, "uuid": "a3bcad36-d83d-4d5b-a6b8-5d4cae186498", "comment": "Malware payload (Mirai)", "value": "f0ff817453b8cb02684d0e8b55a04489d91116dd56c0e827177315d75ebf6ca72aff5e6d5dc21adfe43d4f1a7333200f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173215, "uuid": "4ae2b92f-fdb6-4b0a-93f9-7f9ce0dc7da0", "value": "T1CCA2C031219B2FA9D3BD2834C66AC246B35B1FACD1F431772A411E30DA5910B7F68B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173215, "uuid": "25e0563b-968a-49f4-a632-130e23b06594", "value": "384:UvtIoZxrSniaXs+qx+bwqPXJDh/4YpD5y8WzzLhymdGUop5hk:UvQn4j+t/P5y8CLs3UozC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777173215, "uuid": "3a111f77-ae7f-4f40-aedf-21b74c99a531", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777173215, "uuid": "82b2d3b8-60a4-4831-b272-bc9c7ecbbec7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173215, "uuid": "eba11435-d5c7-4454-8c4f-7fd0e5c3948d", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c808516f-4104-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777162421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777162421, "uuid": "6379f2a6-df19-46ab-8252-c5dd6082ff96", "comment": "Malware payload", "value": "b9a4508920d5f74f5358244679bfa249", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777162421, "uuid": "c0618fa1-cad3-449a-8cb7-96361eddbfb5", "comment": "Malware payload", "value": "d1cc2803952f67da1ee2556254e0850af45a7ead8043d737be2aad800e3caa66", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777162421, "uuid": "370b13e3-23bd-4679-acf9-67c54b9df3db", "comment": "Malware payload", "value": "a38ce1766a33fb64c97a563788e90dd4b41e966a", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777162421, "uuid": "0bb2889a-c52c-45c1-9750-427433eee525", "comment": "Malware payload", "value": "a9bd505db8a234f52ee595a2d7bb782eb7d839427cabd6036b2a3a245581114c121462bb67900495e2b64852f9c52870", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777162421, "uuid": "4f8820ac-d137-48ff-9207-73befb747e6c", "value": "T10265395BBCA409F6E0AA5332887751A27BB2BC450F7113D72E50B2782F726D8DE79344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777162421, "uuid": "883de14d-1a80-4ae1-afb5-d987009f717b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777162421, "uuid": "dd953096-262e-4080-8fb6-e5ac1ec6bdb3", "value": "24576:MR8/wMiIt5iKU5M6ImkOND+eQ/NBele5zK2I/LD6em:MRGRiItMKUamFDmGnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777162421, "uuid": "1788b2df-2c8a-47b0-8011-006bed77b4c4", "value": 1531904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777162421, "uuid": "22850e20-96bb-4b2d-999e-0bc2787233b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777162421, "uuid": "3fdf2c4c-6c9c-4f99-b4e3-45981ba952d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b030059b-4172-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777209626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209626, "uuid": "6afc4c01-39d3-454e-aa38-c436f9b46ff4", "comment": "Malware payload", "value": "ac8564ac63297d5758bc985148741516", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209626, "uuid": "93185eeb-d174-4b65-9fcc-604e9d32441a", "comment": "Malware payload", "value": "d2ae2d2203786d3a1ef722b614801d4d7ef826ea4cf22e2148e4771c36305139", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209626, "uuid": "98a5324c-12fb-451c-a936-78b17d643926", "comment": "Malware payload", "value": "e5436425e8563bd0e45e9a11188636b94a79edae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209626, "uuid": "90cea4d8-d93b-4f42-81ed-4dadc8d7b595", "comment": "Malware payload", "value": "db589c36ae025091cb2a7d04e47cc4e523e19978941a34040866917aac127c32f42013ac442ed7dd22810542abaf52fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209626, "uuid": "e7ddf374-c495-4c30-956d-218ee65994a1", "value": "T15C07AD77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209626, "uuid": "ce09d3a6-450f-40f0-a1b1-046540a0f80e", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQG:cqYUQuVDt0TZEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209626, "uuid": "3a56c17d-4839-440b-b0bc-73c6c4fa2196", "value": 17006592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209626, "uuid": "3177ee31-2cc4-4de9-b0d5-c96c1f51a867", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209626, "uuid": "8183a298-f5a1-48c2-9340-dac85c356542", "value": "d2ae2d2203786d3a1ef722b614801d4d7ef826ea4cf22e2148e4771c36305139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd017803-418f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777222156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222156, "uuid": "844cebd0-d9e1-4da2-a04f-235da555fb19", "comment": "Malware payload (ConnectWise)", "value": "686fd515349ab66b021d345bcdc7dc68", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222156, "uuid": "62324a25-568b-4b9e-9506-756d68ffb8b1", "comment": "Malware payload (ConnectWise)", "value": "d3a9a9219ecac2a4f1ac39ba36b31580910ba6e91287cd4f58c206f3918b0e38", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222156, "uuid": "78038903-74e2-4adf-bf7f-8ac1e8ccaecb", "comment": "Malware payload (ConnectWise)", "value": "52c85ab173e91a050f96db7abe2cf513b4106e4f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222156, "uuid": "02fabf8a-8eb3-4722-a7a1-524ef25ba40d", "comment": "Malware payload (ConnectWise)", "value": "899cc3dde5c58d756a7012b5a21bd6833d02236d9cfb3f8103cdf2477879b83ac5354f7027232b89cb663d920a25ae72", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222156, "uuid": "0df3bb5b-1a55-4da1-912c-f8ceb97d4323", "value": "T1F2646C11B9C48432C673383107B4E2B28DBDB8302D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222156, "uuid": "679dc3cf-c24c-4f25-848a-25c6f5f90946", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222156, "uuid": "d3cb204f-af37-482e-860c-7f3c54d2fce4", "value": "6144:6mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9bY:J1iw7gryNkSV1hy1Z1u2JLu9bY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777222156, "uuid": "27b98ca2-1499-448c-9c3d-9648582c02df", "value": 312568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777222156, "uuid": "5d8f21c2-37e4-423f-ab65-b31e8b361528", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222156, "uuid": "5b127c08-3027-429d-8011-d3324f8b181e", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f5eb99-414f-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1777194554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777194554, "uuid": "ac12c456-10ce-40d2-ac33-51d625f0c978", "comment": "Malware payload (PureHVNC)", "value": "bf1af8eedad6db2882d86a79c4186e81", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777194554, "uuid": "a437b5c6-4fd5-448c-b296-21a08cca648d", "comment": "Malware payload (PureHVNC)", "value": "d401cfe9de20d46c8cc86aafa2448aa38c94c1911aa7f27d7ca2d84a88f09685", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777194554, "uuid": "51b12b1e-0a32-4144-9364-1257b0f64666", "comment": "Malware payload (PureHVNC)", "value": "45e6641f559682a43101cd8c1eb82c5517cddf2b", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777194554, "uuid": "02935b37-be0b-4bd3-a732-fedf4d5c3e07", "comment": "Malware payload (PureHVNC)", "value": "8c232d12851b8466c51ad79ce889a22201f9dc44bd367da96c2fee9c72b97baa64db80b38d3e7daaa77197f9831f36de", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777194554, "uuid": "fc74d10a-b9ff-4fb0-8dfb-c6df6df0967a", "value": "T1A305E12EBA5454F9D1ABC174834A6A22B67378870721A9FF03E442353F66AF11F3CB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777194554, "uuid": "cfb6fd6a-a660-46a5-9170-4950d31125d4", "value": "4fe4d7fa4db2a9b9eb2e66f9023e9437", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777194554, "uuid": "bae83441-80b0-4827-ad1d-9669a428f13c", "value": "12288:jrKi0JmUDI3hhgeDhebmTvkwaiNidzyi3DVyo9pVA66HZA:vKiIqhgyKmTvVaqidzRVPDj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777194554, "uuid": "52228372-1f7c-46af-9fd5-b17b161bbfca", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777194554, "uuid": "757ec441-83c5-444c-917f-013c313f2828", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777194554, "uuid": "dd25acca-d131-4122-83f1-e90f0c1e3a2c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978d3dbc-412d-11f1-a769-42010a9c0008", "comment": "Malware payload (STRRAT)", "timestamp": 1777179949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179949, "uuid": "ef5cb3f8-ac01-443b-8afe-25b8cdf8d4d0", "comment": "Malware payload (STRRAT)", "value": "5e12218e4623a0cb685cca5151a40c36", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179949, "uuid": "34384056-270c-4315-8f17-a98488445688", "comment": "Malware payload (STRRAT)", "value": "d5720d5a74836d98cd5cbcd00bcbf3b2f112660538ea0080781be8751a2e3d42", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179949, "uuid": "13d5f66d-6f91-4405-9d3e-89bcc11c20a0", "comment": "Malware payload (STRRAT)", "value": "2bf9340e320b6aefc26efdd400d212a670fc97ff", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179949, "uuid": "e89e9aa2-63a1-438a-85b8-3aba024d0c60", "comment": "Malware payload (STRRAT)", "value": "9b7ed040fbf27d90731aaa3ccf9fcf500a259ae217c01f9c0f335b47f357b65d2041fe997a8c47156af4dcfb75278a36", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777179949, "uuid": "2a93114a-9c14-4a92-b349-6fdc19953fe4", "value": "T137746C76D7CC9DC4AFF27D8DE2192B2A8D68A55382F4D6139C10E6620B7642DDFE0C24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777179949, "uuid": "8712d511-c321-4838-b710-ed808f95af6b", "value": "6144:B3OzpLBnm5ZiYTkhXndtMm14ZG11ZzuvuR+0mXnHs5Rydk:6ps7m+g11ZnEXnM5Idk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777179949, "uuid": "7c22ecca-eddc-4b7b-8f4f-338314607a3c", "value": 367631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777179949, "uuid": "5d65f5d0-72d3-42c3-9398-b3ee93b455d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777179949, "uuid": "66fcbd90-9a11-42d4-8e99-f8381783ca3d", "value": "java.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d70a4a-415f-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1777201175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777201175, "uuid": "ed790d32-f017-477c-96c2-bd23b55031c0", "comment": "Malware payload (WeedHack)", "value": "15058ca727c500ef9633a7bc080048d9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777201175, "uuid": "362dc2fb-53bc-479a-af25-ddebc96b97ab", "comment": "Malware payload (WeedHack)", "value": "d58d1b6f1c3302406278e9977b47552e9422ab36d750e666c2a9def34fe4b901", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777201175, "uuid": "1476e083-35b7-4f8a-901d-91bc8eb37c5b", "comment": "Malware payload (WeedHack)", "value": "7e16e15710d33216cc45f69dde55c1190e8e54f4", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777201175, "uuid": "af22b7bd-cb5e-4da6-bb6f-2f827f37fb2b", "comment": "Malware payload (WeedHack)", "value": "ce8e64cfc6011c4977d5036fa2c69b588cafbd0bc06a6e726e4f95fa8c7417a6e3305de682ad58ac99f001ae3ea62179", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777201175, "uuid": "b5f9509e-2f9d-4dd2-8361-540131f28711", "value": "T1A6053343EB070803E65E0FBD4BE1A29AFF89142AFD5D445F15E499ACBD2898CB1CC1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777201175, "uuid": "f85893bf-24e9-4fe2-8436-955f831b7596", "value": "24576:jVQ0zHpXk/1f0ISBkcLlzJYzBB4Y/MxNT7w:jVvkNkxZOzBBWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777201175, "uuid": "04722788-05a7-44d1-b6cd-45eff0473f75", "value": 834932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777201175, "uuid": "42443d5a-da6f-455e-916d-253f6b2413cf", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777201175, "uuid": "7772893e-b5c9-40c1-b82a-795ff7b5c74a", "value": "cwb-fabric-3.0.0-snapshot+mc1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c246054e-4139-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777185175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777185175, "uuid": "a64cf725-d78e-4e40-a34c-b0349e59ad1c", "comment": "Malware payload (Mirai)", "value": "61e9c71259cb3491c67ad5289e61cf53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777185175, "uuid": "e3b2a780-e31f-42e7-a104-86b4208bb8dc", "comment": "Malware payload (Mirai)", "value": "d5b9defcb563f5e460b2d7814fe31b35e8389033795b5d690d80b40dcdb84597", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777185175, "uuid": "6f7da32b-e94e-4105-b999-facfa49aad56", "comment": "Malware payload (Mirai)", "value": "4408b494d852c9c92dcc3be867001a6c4091827e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777185175, "uuid": "c1eefe39-fa05-4454-b1de-0b3761fd6469", "comment": "Malware payload (Mirai)", "value": "6902667b13739d2de4dc95a3ee0c0c950f0b175873ed4d118a545f351dc4fe618ce4dd045d98bff0297709cfa3b35cfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777185175, "uuid": "7774ca25-a30c-485e-85d2-28e1394eb953", "value": "T12744238CCE8BEB994266DE3B2CDAC4B475176BD0DE456C1A9A48D009409C27FFB8F944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777185175, "uuid": "117fa48a-833e-4137-b462-6de034fc1938", "value": "6144:t3Uiik2HYfhntKge5CtJldwxXjlq+xiDo4y+llmqLiJ:twVHiz5QjlvxRVdqLiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777185175, "uuid": "4bc0583d-0892-4100-8cd9-184c5d7f89b4", "value": 277860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777185175, "uuid": "ccbfc24d-cd5a-46c0-93dc-e080c83e7ae4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777185175, "uuid": "bcc38087-353c-4f97-b59b-244e810f73d6", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45ceb26-41cb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777247858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247858, "uuid": "4b6f4253-715b-4979-85fc-5be874cfd68d", "comment": "Malware payload (Mirai)", "value": "28888b08b8caeee9b34abba522d470e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247858, "uuid": "d4e711a5-5f44-4612-af2d-03073843668f", "comment": "Malware payload (Mirai)", "value": "d68e81c8ecf018e3202812329344122ebfe5f41782243ae4b7231fbbce92059b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247858, "uuid": "fa8a9ea3-8dd2-4ba8-9de3-0d8e045d9a41", "comment": "Malware payload (Mirai)", "value": "153d1889242396b406b254e9d6a9988f5181989d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247858, "uuid": "c718c827-1ed6-4569-ab89-f49fa49dca46", "comment": "Malware payload (Mirai)", "value": "2125f73d56332f6ab3de70f024aeb09abae0824314c89be97876c810525ea558e5a8b9c77df8e43f6a17620f44ac07a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247858, "uuid": "0c17350c-fdc9-4a52-9731-596381d1a4e2", "value": "T1A4C39DABB24F1051C82647F41BCB579C2E3325019E2B9AE77C6E373E1A369DE58063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247858, "uuid": "a4d395b5-7289-4742-b441-f79d1441aa35", "value": "3072:gf0GQgHfg5nBR4YYSOxTKB6Aq7mgbgiCrheiiU4/qe:gf0tJBR4NSALD7rnCrheicqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777247858, "uuid": "2028f433-9c25-4dfb-b71c-4c9a04d82fe6", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777247858, "uuid": "0c0ba926-dbbb-4152-bb9b-eddd9db3e207", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247858, "uuid": "4d74b017-0082-4349-876a-841f576b8d2f", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d55cc6-41a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777233232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233232, "uuid": "5095172d-046e-47d7-ad42-fd8ee72ae13f", "comment": "Malware payload", "value": "570a5f97e7faf2c367f4982aecbb31d8", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233232, "uuid": "3f7a484a-cfb6-4769-b820-351592ff2f26", "comment": "Malware payload", "value": "d6fcb06185569ade19e68ee72887658bfc3c527d21b0f0c27306758f1e50f531", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233232, "uuid": "56d23f42-717c-4ff8-8310-70d30c89aaf5", "comment": "Malware payload", "value": "2585ccf4486873bbc25c687b2ec07145f0e5391a", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233232, "uuid": "daabfab5-c4b2-42bd-971a-b8cb6d7ac643", "comment": "Malware payload", "value": "2a13a55cd7e212adcfa29d99a303d4c082526e49447cc343ddd5dcba1250f1ec29d5a6c40b9cafe7cb3e4e40e34300d7", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233232, "uuid": "519510a4-3076-4719-b589-a776dd1a0e10", "value": "T12146F141B3D695B5D0BF0638D87A42A65634BC108712CBFF57A4BD296D32BC08E7237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233232, "uuid": "16430204-5df2-42fe-87b3-d92b15f8e823", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233232, "uuid": "ffa7d5db-9cd0-45d3-ba05-bb3ec2933ac3", "value": "49152:ufRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8ifo:Kqs6efP3rn/TYGVxz3GBwRVkGuyXOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233232, "uuid": "4913c3d5-b83c-4ae9-9c07-c1ad8b1e9a0e", "value": 5667224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233232, "uuid": "76fc4319-40b5-4818-847c-72fa635c83b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233232, "uuid": "331e2122-4ee2-444b-a36a-2d0ddf9f3d7d", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c1ec6cf-418f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777221886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221886, "uuid": "186e4ca6-c540-4543-9100-a1ae8612d6c3", "comment": "Malware payload (Mirai)", "value": "6dcea1b0b40542a843404ba25cc91ae5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221886, "uuid": "01b7782d-832f-4aee-ba6e-cfa23a22561a", "comment": "Malware payload (Mirai)", "value": "d8682575a15c817007bcdd5df0dcb7efa58f76b60b40ae55eecf4b93da7de0a9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221886, "uuid": "a936c9dc-499d-4284-a6dd-07c3605372f2", "comment": "Malware payload (Mirai)", "value": "116ae1ee9f8c764d444c016710c27059da4c8410", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221886, "uuid": "afda505d-29c8-47a7-bf05-120e5108e850", "comment": "Malware payload (Mirai)", "value": "1a3f6285f7d740e7b747af4472604fe37c65b16955cf62705870923ec768ee372859f3ae7cf3d4211f589b9d5ebc96b0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221886, "uuid": "eb6e0b61-f566-4529-ae98-8ddc0804297a", "value": "T144935C23A61BC6BAC0A346F917DB6A229D23BCBD1B23711673D4BCF42F168D51D19B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221886, "uuid": "7e1e0f37-ffad-4f95-a9e3-fc7b2839718a", "value": "1536:V7K6pnUiMu/M2o4AkFI/V7r5SVpGfQBO3zphaQWZ/Q9TSYmg6IDum2Xj5YZb0e:FweJjI/JiAfQByzphavZ/QJIg9Dum2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777221886, "uuid": "898b5198-c960-4798-8255-92796989a44d", "value": 94508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777221886, "uuid": "f44d27cc-7abb-45f5-a7fa-9a6a24610870", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221886, "uuid": "e93c22bb-aa8e-407f-93e0-095d555e8706", "value": "fuckjewishpeople.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce175e2-4171-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777209083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209083, "uuid": "e4cb869d-b30e-4455-9e9d-e2c14303f275", "comment": "Malware payload (Mirai)", "value": "c9a708cfebd00f438f1c857989de3c68", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209083, "uuid": "dc4aa798-9b8b-43f1-a67e-f8889c5f5c3a", "comment": "Malware payload (Mirai)", "value": "da21fc59351a8601fabcc66483ab193b29b7a55be4cba08ab707901d4c98ad2a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209083, "uuid": "7915131c-2256-4018-9134-e4d6b5f5f772", "comment": "Malware payload (Mirai)", "value": "decacb7fd24ca384c8985973adb8997c021bc6c4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209083, "uuid": "802b63a4-7c0a-4aed-adb1-13b13690ba43", "comment": "Malware payload (Mirai)", "value": "f21568ad219068b067566e7f608603de3ed0e8882bdd7e29e25ebbe79def0f5197c8ac329e28715e292099d1f26e33d9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209083, "uuid": "3e057a40-f21c-477f-a942-cb043e281c22", "value": "T1DF41538E60F06261E6DCFE0470E18DC86385F591639F2A7ADEC12EEBC4DAD467019B35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209083, "uuid": "a370708e-dc75-422c-a86f-de2f009077a2", "value": "48:sQKQGQkQWQLQ3qQ8Qw1lQLQg5QvQHaQoQ+QsQWQ3QSQAQSo78QhQPqQSQqQ/QeQn:HtB/Rc3NXw1ucgK4d7ZHRg1zSGSl1NId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209083, "uuid": "90100af0-9f86-4fb5-a380-b4933745d216", "value": 1901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209083, "uuid": "a2f86e52-d1cd-4691-b86b-9e2cb47cf1c6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209083, "uuid": "12fea48a-5ac2-4b1d-8c64-619a25369fc2", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d045bf72-417e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777214834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214834, "uuid": "606e9e7b-d770-493f-bc5b-8b709dc9ea5e", "comment": "Malware payload (Mirai)", "value": "e8258a82cab0644790e9d313d77bf0c9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214834, "uuid": "34de8a10-4da7-4602-b53b-bde0b8247d32", "comment": "Malware payload (Mirai)", "value": "daa40fc33eb3257ade9a439ae7ebadcd4b302ac1e16b560a4fc1257b9eea2c2d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214834, "uuid": "7d89d63f-2fa4-4433-8609-b98aed84c661", "comment": "Malware payload (Mirai)", "value": "f0d4fe6b44cb9cf070b3ca8fe5cd004dcf3c8419", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777214834, "uuid": "6f1913f8-44e9-4d82-bfd2-021d9e115203", "comment": "Malware payload (Mirai)", "value": "f4f7dd17843c268b3a24cc197a1bceff0c3820b25be037f925c8f4614c2cbffa78c5b67d8a8c898f6b0e406e2e2da5ad", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777214834, "uuid": "d2080d0e-2a08-4aa1-8927-00a010feff09", "value": "T1FFB3F949E9646B19C7E232FFFB8D428E33171FA8A3EA7025CD305B6133C5E995639121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777214834, "uuid": "f5d4071a-487e-4587-9e1c-93aee1d3c5f8", "value": "3072:PVwjNW6X+UWUCIp05Wyu9acaCParBkMJtonzucPLD7cT36ruO:IlM2gcaCParBkMLolPLD7pruO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777214834, "uuid": "4b7ff03d-4e1a-4dae-87c6-1c67483d99da", "value": 116572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777214834, "uuid": "5f245587-badc-49f1-8d26-c3e9cef9e09b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777214834, "uuid": "88fce1fd-f6e4-4299-a744-b3fb54942427", "value": "xdf.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3e110d-418f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777222160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222160, "uuid": "dc4659be-9012-47d0-b979-5619ad4085a6", "comment": "Malware payload (ConnectWise)", "value": "a18c7c9c2e85996dda8780e7e5835156", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222160, "uuid": "1e0cf7e0-4d54-4ef8-b8d6-5c17c4a72151", "comment": "Malware payload (ConnectWise)", "value": "dab0438112544b32d0e9a5f24b94758c199e09399b5504ac20169efcd07b4df0", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222160, "uuid": "47c4a049-a6e4-4b55-8832-3cffe63174ad", "comment": "Malware payload (ConnectWise)", "value": "484d641ffffce297fd389a6020499a64125c118c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777222160, "uuid": "b000046c-4138-4b25-a010-6a5e433edaee", "comment": "Malware payload (ConnectWise)", "value": "8fbab218eb1b2f623842b0287561b1de10fd0d4c1fbf398680673e677ce5e796a8e3e00a49b9af00dc3285984d894258", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222160, "uuid": "d4cc3352-a19f-49cf-b792-83a82c5963c4", "value": "T150647C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222160, "uuid": "f6bd797e-e19a-442d-ad22-4cee09270c69", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222160, "uuid": "fd0e42fd-e6e0-468c-822f-0562ca3d7531", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9g:h1iw7gryNkSV1hy1Z1u2JLu9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777222160, "uuid": "7ac4a506-f16d-497d-bf7e-ef18bc6f35ea", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777222160, "uuid": "670dca76-19db-4041-939e-e9eb459cab57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777222160, "uuid": "6db9e39c-449e-4fd7-9940-665c0e08b977", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4757eb-415d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777200521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200521, "uuid": "ce5cf417-4fc0-4c6c-81ef-9ba10738b3be", "comment": "Malware payload", "value": "02b4d37dffd7a21b52001d544f65a31a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200521, "uuid": "b41a5bc7-c0ad-44ff-b31e-70ea342d82be", "comment": "Malware payload", "value": "dadc5d82ded96e1cb2a84c273ee24cb3255d92875f187ec84d6f03f3227fbae5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200521, "uuid": "b7ce3e4b-8027-48df-b135-f0ce7cc7fde8", "comment": "Malware payload", "value": "30267887259506058ec80916eb8d7d8424dd88ae", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200521, "uuid": "622bcf8c-9322-4e3d-925b-4f2279141469", "comment": "Malware payload", "value": "e1ab48e9d6437598a60469aca6edd29a8e99cec6cc6c8df6a9e505685b7efaff871772db2e8449cba0d78e9ed21b014d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200521, "uuid": "f9b478a1-ca38-4d5a-987c-31cc05dd1837", "value": "T13BE0C284049280085EF3563D8AE651E0D043300134307E79E1B6C3539BE82C03B72B8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200521, "uuid": "92c382d7-93aa-4ae9-ad9b-a1e4b80cb36f", "value": "6:hdcGr6Uc+crmTRQ5xymY2s1aFZnElYVsgeafaIg+l5blzY0W:XA6DTRQ5xyL2s1OxxVsXaCR+l5blzY0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777200521, "uuid": "67fdccd8-0e20-4fda-8346-07b44b52b4a3", "value": 319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777200521, "uuid": "3ea6c1e2-053c-4384-ad8e-fd4b89f05957", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200521, "uuid": "1945fff4-e7fd-4b10-ac50-1ca3a077088f", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a9cc8f-414b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777192717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777192717, "uuid": "658b7e4a-2e58-43c4-9c4d-0d7c0512ae4c", "comment": "Malware payload", "value": "6a2022dfbf44a907d21088fe0c643acd", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777192717, "uuid": "b3d91643-d75b-4559-88ae-f3165b0ec157", "comment": "Malware payload", "value": "db8629568b96354675fb4891490829b0314de94c86200cb653308d9f80b26e10", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777192717, "uuid": "da7d1b73-f486-4bd6-bb03-1383b6fd5b78", "comment": "Malware payload", "value": "2d4d844d46b669483c884feb7406c1b56bf66686", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777192717, "uuid": "6ad507a7-694a-49a5-b78e-cc357bfc7eec", "comment": "Malware payload", "value": "2fbc0effde3ae0c9c6a2b72b3a7e9de88d9e8e9a4b16100977ecacc9cd57a1c5fae4f94911b77440872c6de00036c6d4", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777192717, "uuid": "e6854db7-2b50-4f46-a3da-6d9b2983e92f", "value": "T11E563336F06C1AC4D46FD53AE1711BA0C7E2230DE542D83694517AD8B2F278A9DCD2AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777192717, "uuid": "f629fc02-bf13-4e97-a2c7-4afaa3457102", "value": "196608:+ZftuqFHg7ua0uU+HB/OGUElH6XU8YYlbHXU4:+BoFVrU+h/PUEl0U8YYlbE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777192717, "uuid": "ccbfce3d-d824-46a0-82fa-f316f4e125e1", "value": 6346268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777192717, "uuid": "fbbc71eb-1eed-4225-a123-1c0c66eb2a29", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777192717, "uuid": "8d445ba1-b3d8-4a0e-be38-fa1878bd3052", "value": "halfmillion-iq.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af05e73f-416a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777206188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777206188, "uuid": "9905cdfb-166b-4cbb-8199-62465573775c", "comment": "Malware payload", "value": "fbddcdddbaf4040259303e7dec9024d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777206188, "uuid": "2eb462c7-3ffb-4ff1-a3f4-920379ea4fd2", "comment": "Malware payload", "value": "dc06cf3983981f0996b24f8724a292bb2a401c7a57c33dff0ed88fb737dc54c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777206188, "uuid": "e88b08c5-1586-4fbd-8038-c6d499bb2f9e", "comment": "Malware payload", "value": "d3f1a2e072bd67aacc8603a663f63ffe85d47057", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777206188, "uuid": "44ce32f0-0607-4668-a717-f8c34a7aad90", "comment": "Malware payload", "value": "458acc8d4ccff1d0fd69016faf14babc1c617f2afdf0695041a2ff434a810a3683fd8ed03dec758313d58d5ad3865b16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777206188, "uuid": "2a37d88d-9148-42f7-8bd1-7cc46736a72d", "value": "T1D2E73397086A364FEAFDEABDE66210EB344E355687A52F1FE340029C45325D0623DFD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777206188, "uuid": "362a8ac6-0011-44a3-99cc-04d3c44e55d2", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777206188, "uuid": "06e3bbaf-1eea-4b55-ac7c-9ec5f318c8fb", "value": "1572864:M3DswoerEAnqqF1RSH2azhe31EKpuNe9akxMOXDPM5M23G:M3oCdnzFrSHPd217T0M23G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777206188, "uuid": "5878df9b-f910-4175-bfd4-8ced3ecd84ab", "value": 65688648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777206188, "uuid": "20e2ae16-6179-437c-bf30-a9f6e9575114", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777206188, "uuid": "fed2937d-8d46-45e2-b465-1157d54ad9d5", "value": "setup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec37d99-417c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777213838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777213838, "uuid": "154a3ade-de60-430f-be2c-b8538e630121", "comment": "Malware payload", "value": "db21bf625aa48e2e055fcb8e2155ed0e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777213838, "uuid": "7ed42597-91be-4548-86e9-e6b0c4a34100", "comment": "Malware payload", "value": "dc6db551dd3022687349df55d196ab9611b53d6b90234aaebab356d149953c2e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777213838, "uuid": "cedb920c-c58a-4b75-87a5-4ca7328f268e", "comment": "Malware payload", "value": "d4d2bbcd87ebed45784a54e91731ad83499d99cb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777213838, "uuid": "94c454d4-e7c7-49e1-9a71-8079ea550022", "comment": "Malware payload", "value": "31832a11c2be0441b6de209e2e6b4695e0607101fb5df42ff434d79914648852425ee2025c9b3e217503002b579348e4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777213838, "uuid": "d42fda7d-799e-49eb-a410-d104738f7f39", "value": "T1C62158CFE41111C58935EE0976BAEC4D6163C39466AA8FAF6CC81E3E84CFD12B051BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777213838, "uuid": "e9fe3b77-4404-4b96-af8e-ed9be340006a", "value": "24:WePRfRgdF527WnDWNIoZkgtvUlqguqgiugAMouKgY/WlHqhyKg2:WePRfRgdf27WnDsZ5G9ubi7AMouKgY/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777213838, "uuid": "75f1d697-fb10-46c1-9b74-948a108367c5", "value": 1333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777213838, "uuid": "df7d0a3b-f547-4765-a4c7-eec0f7d4d933", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777213838, "uuid": "1e7937be-72ff-49a4-bad4-d41a638b90cf", "value": "xx.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787b9eb9-41a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777231866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777231866, "uuid": "0410cdf8-0df7-4aac-bf0f-2ce706dcadf4", "comment": "Malware payload", "value": "bdccf804ba3c10fe824189853c221531", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777231866, "uuid": "6d5d9016-c590-41ce-be16-4186493a4c28", "comment": "Malware payload", "value": "dcb8ecbc2bc73f2b46723146e598eb710a573e1e74a96a2e07d44af320862faf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777231866, "uuid": "90919358-74f4-46a1-a77c-52235d4fde24", "comment": "Malware payload", "value": "4a4f560b2abfddd8feb2d44ef7f01fcff5dd3253", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777231866, "uuid": "4bc5e29f-e676-4f78-84ac-c6e118ff3b2c", "comment": "Malware payload", "value": "48fb54e5ac92022f807ecff74914594aafb298f2d2742150873b10774060b6b5dfee6e0ed08c6d865a7e370bf09befb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777231866, "uuid": "7bce7dde-5d02-42ff-aa49-189ae1d227f3", "value": "T1AE7302B3E4B9D898C17A61F519C02A74B37861333EF3522B1691663C8F3A8582704AF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777231866, "uuid": "35fa640c-eab9-4675-ad9b-7b37fe369938", "value": "c73b062616a5cb86de24f970f653f4e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777231866, "uuid": "dfde3dc6-f13b-4680-ba24-217087247b92", "value": "1536:CUxK32Hg2rqMxegZvl6+Wrgl1Y6RMe/TRnOW6DuiWlU4yGQW:1xQ8Jxegn6PglpRzQW6il24B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777231866, "uuid": "4a65388f-ca25-4efc-92c0-d50c03d8a66d", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777231866, "uuid": "86687194-8a2b-4c1b-ad76-98101f1d7bbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777231866, "uuid": "220b2390-a99f-45c5-b750-6318e88dbebd", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.44966.27449.13377", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7faf5db0-41af-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777235744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235744, "uuid": "5c4683fc-e692-4a75-8be5-eb63ad51a9d0", "comment": "Malware payload (ConnectWise)", "value": "3e49608248b546247f54387c7b6ecb69", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235744, "uuid": "d43fa4d2-8488-4e69-b640-ffdd1a6a6c23", "comment": "Malware payload (ConnectWise)", "value": "dcdc579bee8f06e5472c5cbdf353a1d724994a729a2a39f6e0434b8e65012c2b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235744, "uuid": "014b9114-5f5d-44a0-b50b-5768499775c3", "comment": "Malware payload (ConnectWise)", "value": "70b99888b77df4a4cdefba02bc39b3037c95154a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777235744, "uuid": "43d1f58d-5b59-49fc-bc53-73fcc1780c4f", "comment": "Malware payload (ConnectWise)", "value": "bc24e89d6de1cb9aa318fa483d9f87cc68be7ca4e47f52a8fe13722c0d855da835b63fa874d0a97b617959851cd58943", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235744, "uuid": "90b0fe7f-5f51-4142-ad95-aeda3f1b37f8", "value": "T17846E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235744, "uuid": "808fc3fd-0c53-4800-b26d-22cf875cf1fa", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235744, "uuid": "b0e8e55c-8f19-46ed-ab3f-25b38807581a", "value": "98304:KzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:KhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777235744, "uuid": "cd799e5a-72a2-4cb2-bbb9-47324f2f44cd", "value": 5641496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777235744, "uuid": "d08a9f4d-f1bb-49f3-a698-4742c0d32f32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777235744, "uuid": "3956201d-b619-4f97-8da6-2f46e5f6d6d3", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d55320a-4195-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777224519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777224519, "uuid": "216749ca-3c8c-472b-bdde-075e0a9f7a7f", "comment": "Malware payload", "value": "111e7d86957a9d5e6a94e8d2a643cb4c", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777224519, "uuid": "142dbbd9-abb5-4c33-b6b2-f1eb34900cdf", "comment": "Malware payload", "value": "ddae20a2ed0c2c4de5933fadc0c35e62e9eae01fcb57bb5711ea93cabf6f39b8", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777224519, "uuid": "969bcc3d-4a36-49bd-9102-a9b7c0428e5c", "comment": "Malware payload", "value": "ea4626e70c31c950cc08b89cd660140ea1e4794d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777224519, "uuid": "3bcd094a-8962-47df-a4fc-d04b14c12c8a", "comment": "Malware payload", "value": "8d86ad052a11f02b3c695de02ee257da7466dc0fafb934b1c364ca88a3751c74733bb5d986780bffa1bcd0a913fc78bc", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777224519, "uuid": "e9b32679-daec-4710-affb-dcbaf6e5bcfb", "value": "T12471FE486BE96730E3B45A773E3AC7105233FC51EE73876E010C658D2767910E925F26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777224519, "uuid": "a9a49437-50a8-44fc-b299-04184552e2bf", "value": "48:8gxhnJF7HS3xZkuWlcjktOUI2Gp7xq1e:8UhJF7HS3v0Yktf3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777224519, "uuid": "f6edc8ba-a81f-477f-a2ef-7097a258774b", "value": 3808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777224519, "uuid": "0acdffe3-3f3f-4ecb-86f9-cd734fc4e872", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777224519, "uuid": "01edf29d-9767-434e-9fdf-329244ab3c03", "value": "Windows [GOD Mode].lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f334db46-41a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777233361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233361, "uuid": "c05689ff-2c35-4f45-831d-9a20926f42f1", "comment": "Malware payload (Mirai)", "value": "a3a314d49d929b3297feb364d53adb6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233361, "uuid": "cbe95198-ffa2-47ea-a985-cbfe3b5fb79e", "comment": "Malware payload (Mirai)", "value": "dde05f7c8cd529666b953aac0b06f10343c3f35554987d74452836f1ff35f0f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233361, "uuid": "395063eb-ea63-499e-a261-b13e257fa922", "comment": "Malware payload (Mirai)", "value": "e8c3296f28dfc09d7c1698db839fe272716453c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233361, "uuid": "4f146436-6d13-4544-9a34-6ccd8947802b", "comment": "Malware payload (Mirai)", "value": "dd21012b915479d786c2777e9873fc1fe960a4c6aad3368d0d70abb316271578e3fa1f40104a2728c51f0231dd6959f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233361, "uuid": "5c94e40f-90ed-42a8-a3f3-2f07fb63ef6c", "value": "T1AE1302917396799FCBD2533B823C2CDB0973B502AAD7DF9E32E457E0A5274F181012A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233361, "uuid": "03f77a37-3f9c-4389-b00d-c7c2fac64dc2", "value": "768:X3/FQh9sCCiwPUCLJyBJdFhyUxBrERZ3XchdVzcMgzqhrh5wlzu7hspnkF3/b17S:XvFw9sC4AJdX7pED3MhdVcM7mlzu7hQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233361, "uuid": "6373154f-dabd-498b-b75f-4913b7288f73", "value": 42776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233361, "uuid": "7fe2b99d-a671-4df2-8800-48580cc601f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233361, "uuid": "1dc5099b-2296-4874-bdf6-47edfea90489", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73de50c4-415d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777200505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200505, "uuid": "82bf4c13-c32c-44e7-80a4-63c37d8216fa", "comment": "Malware payload (Mirai)", "value": "eb7d5f12f2e5e948acc9db895acefe64", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200505, "uuid": "5917c6b8-4c1f-438d-ae0d-d9debd56916c", "comment": "Malware payload (Mirai)", "value": "dde8fbd302fef0e38e1474eabfdf124678675ef0718564f5405e6ea5f8d7eba3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200505, "uuid": "3fb3e93d-d857-4d7b-ad30-fda896af83ae", "comment": "Malware payload (Mirai)", "value": "92ca5fbdf8151d0d3f113c5ab57fe753cb04a0bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200505, "uuid": "62cef3d9-a839-4262-9536-f08ead36bade", "comment": "Malware payload (Mirai)", "value": "0f3c154f9d247886d46359c7fa83846f5d80b331041d81a5e5bf03d96f7acb35ee06342d846afa90da0a877022a216be", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200505, "uuid": "d2347acd-a542-4ab2-b184-3e1c2ccc6e98", "value": "T10F859E5AF2F366BCC057C430479BCA629531F07469313DBB36C4DE352EA6DA41B29B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200505, "uuid": "4feb992c-c1d7-43c9-9977-4028e39b475f", "value": "24576:JIm6s9iXre2zxHLZNgysMOvh7922sZJSuR1lY03q/P:Om5iXqarZNgQ09nkJ9Rw04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777200505, "uuid": "3de5f2aa-5e3e-4ac5-8098-d250492dd275", "value": 1801656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777200505, "uuid": "c7c36542-b2cc-4c97-80b9-42268d5b110e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200505, "uuid": "d678d9fe-7d00-48e5-936b-91051868bca1", "value": "sys_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9e3b2d-4185-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777217918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777217918, "uuid": "a950cb0c-16dc-4d18-a0c2-1d1c939a8d61", "comment": "Malware payload (CoinMiner)", "value": "9a8acea9a2727b16f9040e4af96ef695", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777217918, "uuid": "a0cc548f-d30c-4d5c-8192-41b6461e3786", "comment": "Malware payload (CoinMiner)", "value": "de8d4ccd5e141a209fdde559c42c0c1d4e9cb8020630a41f67783fde7cf95974", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777217918, "uuid": "db0064df-f3fa-47ec-ab99-79780c960d9e", "comment": "Malware payload (CoinMiner)", "value": "8247595f118a6b3794f653cff3082b120a9d742a", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777217918, "uuid": "dd1062b5-27fa-41b5-9e60-c6f4a32eb8ea", "comment": "Malware payload (CoinMiner)", "value": "4996be19f0b22b136e9cdf8d5081f70db314a6cd91ca477d15057855293ecb06705e7a1f579ae0f270e2d2b7261a3089", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777217918, "uuid": "9f401412-0887-4d73-a903-982d0627adc8", "value": "T164A623ADA248772CC05F84B09523AD45B2F6572D0EFAC9BA71C7BED07BDB821C801B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777217918, "uuid": "8b8b6ac8-a463-43b3-af53-45c89e908af8", "value": "50c790fdbdb0d2921a6ba57a58a86fe6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777217918, "uuid": "b5cc790f-1227-43bf-b224-56fd5d404433", "value": "196608:qNvYoirs1GK7Ingpy0m8v3q3Y8MoxFdej3S76LqLxQcjZaomrvA9EzHD2aL67BcJ:MvYorkK74g0yv3q3YrofswrycjZaomrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777217918, "uuid": "29205c4b-b7b1-47a8-85a8-1d130a0c94ab", "value": 10337280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777217918, "uuid": "93880d30-0076-477e-a26d-7322a55c20c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777217918, "uuid": "fe17369c-e758-478c-9f58-354acabbb3a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e8c0ef-41a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777233372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233372, "uuid": "e15fb6b3-501a-40ee-9a01-bdc8757185b8", "comment": "Malware payload (Mirai)", "value": "ec0d9ad580ab7de6cc0121575ccaaf33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233372, "uuid": "f9e752e5-263f-4929-8ee4-0a793d0337dd", "comment": "Malware payload (Mirai)", "value": "dea9727f5f97518cf2f605b903a7019506eec4137a1e55536ff155250957f763", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233372, "uuid": "af590b04-1151-4d9a-85df-a60ad591e381", "comment": "Malware payload (Mirai)", "value": "9596946e2b9fb84832ca17a3683413281fbbdd14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233372, "uuid": "86e71cc5-8b8b-4879-9eb5-078a96c96c9c", "comment": "Malware payload (Mirai)", "value": "55cfa907c9bf88f841e572a85332079cf9b0719b5295d66472ecd65e63736a80fa400fbadea8ef2e8520249bf9d1b61a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233372, "uuid": "18b0b304-1c16-42f3-a97c-1650d48aad3d", "value": "T125935B22B539193BC4E4947722F35326F2F6438A14A88B2E7E710E8EBF156D026477B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233372, "uuid": "0ff5b561-97ae-4690-a499-d772bc228423", "value": "1536:08RsLd2/48pr4LaYqPoQatq3KtHw8Ym5owAtQItt/B:0USjsF6R9YOlW/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233372, "uuid": "bad419ff-cab6-4a6f-a2d8-1da7c8dc8214", "value": 91968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233372, "uuid": "53e4032f-c6c5-455c-a4b2-82f3cc003904", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233372, "uuid": "ff00575c-4ba0-4192-9bfe-deb0d54a2142", "value": "luxzz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158b5472-41a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777232559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232559, "uuid": "447db9cb-7cae-496e-955b-fc188a21698f", "comment": "Malware payload (Mirai)", "value": "035c9f894bb500d8dc3fd7b8875e55f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232559, "uuid": "eabddc1b-9210-4e5f-a5ff-5e9d7fe50085", "comment": "Malware payload (Mirai)", "value": "deaebd8756bddb1f46a519b4bf61609073f8100d59f70e3a0b97bc5d7cd8881c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232559, "uuid": "b8f9ea32-248a-4ddb-aef1-ff2fd9493c2a", "comment": "Malware payload (Mirai)", "value": "8e2f02da341070e428de61cf9597ed483ea2d08a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232559, "uuid": "d796436d-e1d0-43bd-816f-926e66a4f7d0", "comment": "Malware payload (Mirai)", "value": "62e9c7f627dd7b9f8874cb9d946a7b54f2517ad79f5233505b87bc8e73574a7208c84014b46663d01bffb1cf9d33eebe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232559, "uuid": "f1e4a6cc-385b-467a-88ed-1a4cecd0e15e", "value": "T1FD04635ABB619EB7DC0FCD3301D94902208C959A52E93F6FB6B4C618E74B94F08D3D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232559, "uuid": "d794a040-8684-4ec4-b3ab-7bda78e8df77", "value": "3072:lSeeMyURMr9Q7PaZaJ+xiXMvwGhMKMMm:l6MyURMr9Q7PccKiXMvHMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777232559, "uuid": "c8908797-1cba-437c-8037-0684c10f87f8", "value": 176120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777232559, "uuid": "a9f8820f-1ee4-49ce-8dfd-ec95cb592c52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232559, "uuid": "923707cf-309d-406e-897c-420bdc4adc40", "value": "shabak.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1859fb-4131-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777181752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777181752, "uuid": "c572a67a-e7dc-4585-ad86-f1eb3f149f7d", "comment": "Malware payload", "value": "00fa99ad08b40a0831689f84a0d59112", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777181752, "uuid": "e0e06941-6920-4cc5-911a-5a721a69417a", "comment": "Malware payload", "value": "def0a584ea229e27695440415fd9016e7e5ec9c9ce85ece82b0b86901071bb1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777181752, "uuid": "ac1150af-72d9-4b92-8718-4f473ec20c5a", "comment": "Malware payload", "value": "05feeb2d775c4d8ce26ece52258426be74902733", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777181752, "uuid": "c2b2fd4c-c8a9-4901-a38e-f8adb9ed0272", "comment": "Malware payload", "value": "4db2ce512dce0711195a6e3328dad1ead00e9692a6f1f0d341ea5fd04bd040787caaf43d839b0c49d04a0e90a4fce6a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777181752, "uuid": "915caa80-d443-4923-ad02-dcb835cc50fd", "value": "T150E4E40A6E729F3CF2A487304BB34B24D76D62DB13F1D585E29CD1155E2028E592FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777181752, "uuid": "3c0393b7-aa39-4dbf-9894-62371ca5638f", "value": "12288:TDwCvWInrjatGOza8EXtlzF7wDAz0D8ZRiR1Na:YCvWIn5Ozaz7zF7w6rQRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777181752, "uuid": "040649db-334d-4a6c-9f0e-be1863340b00", "value": 709108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777181752, "uuid": "3ee70bf0-b74e-4c1d-a983-a80ce28d4854", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777181752, "uuid": "fd4631a5-72d5-4993-a789-9227db3b3046", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95771909-4166-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1777204427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777204427, "uuid": "9fbf3835-945d-4d6c-94f9-02f70f19cb44", "comment": "Malware payload (Vidar)", "value": "9449a30930b6974dd9b2b788f43bfa05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777204427, "uuid": "689d82f8-f4d7-4dc8-afdf-571d6f351f1b", "comment": "Malware payload (Vidar)", "value": "df15eaf4f30afa77031861ce664291dc880977506b09e747a065edf41a6faf3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777204427, "uuid": "bc43830f-c0d6-4c40-8d3b-ff2e2bd0074a", "comment": "Malware payload (Vidar)", "value": "471585fe314cc86f2b9ea97a2c46c1413c27043d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777204427, "uuid": "42650700-598e-4e12-bb9e-5946b177e6ed", "comment": "Malware payload (Vidar)", "value": "8a770caf7fc60eace2559db61c4781096f5321ba7ea49bde0279bdf2781e8bb0c51fcaaf4b5b2c2ef82ec7af230d305f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777204427, "uuid": "698e4f90-db90-495a-9b24-c7fbe4d35a80", "value": "T1B2B57C02789105FDC499B73249F23681BB75B8480B3637D72E916A783E37BE01D7A74A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777204427, "uuid": "b01bc015-3810-470d-b3f5-d65ad774a98f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777204427, "uuid": "21904b95-f09a-47f2-b385-dd3940f04c3c", "value": "49152:AGO2VxtSwZ2ZTshCKdj4vOfJ4N3Z4+Z36D64uDi1rdV:AWpi4l232+j4u+xb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777204427, "uuid": "df2dea20-a38c-4473-85b0-02c8aa8680d3", "value": 2482864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777204427, "uuid": "2cb65cbd-6620-4611-a443-cad3804d87ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777204427, "uuid": "00eaa1ef-1796-4705-9f62-ae92dcf37b50", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f943b1-4171-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777209124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209124, "uuid": "4c1526e0-42b9-44b2-87ba-bcfae82340d6", "comment": "Malware payload (Mirai)", "value": "2c203c83da934021c64a8d9daa6ca61f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209124, "uuid": "0bb05467-855d-4690-a3c7-b72f1c3553f1", "comment": "Malware payload (Mirai)", "value": "e06a22138113ff7d68651733bb4ad8da33cd45ed8d8b55c088c051923c16e57d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209124, "uuid": "de63058d-bd45-4a9d-8dfa-a81af8486c07", "comment": "Malware payload (Mirai)", "value": "a84ec3887b3fd839a48c8bf35b3cbd0c1a4aea6c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209124, "uuid": "1b02a253-8cf5-4cfd-bd53-62fef428c304", "comment": "Malware payload (Mirai)", "value": "e0be89dac3c57d553a4a05d8248b26b4044fca0d81b2cc19885fc1008d1e97f0880f04d402eab6201dd66763b944c9e5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209124, "uuid": "b95fb65d-c576-481b-a7f3-d36c788b1de3", "value": "T17DE3885A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209124, "uuid": "49cc73ae-d41a-45b7-bc0f-2f54324c1420", "value": "1536:p+vTcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4VxNdbK:p4lybKpzEOfGQ+vEubTt4ouftL4JdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209124, "uuid": "be00a27d-115e-4d94-b4d6-69253b93defc", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209124, "uuid": "f53e39f0-7bf1-4871-9637-a6bc87d5f7cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209124, "uuid": "93d368f7-a090-42d1-8e0b-fa1a5a980266", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10d4bed-416f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777208312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777208312, "uuid": "9df547ee-070f-4d35-970f-1ccf56365dea", "comment": "Malware payload (ConnectWise)", "value": "ff359f10b7f27d8b1d980aac02c396f9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777208312, "uuid": "decbe9a8-46b0-4081-ba86-150a44c94bac", "comment": "Malware payload (ConnectWise)", "value": "e07ec2972ab4a52bde76b80dd46fbbf4fbd8ea79585472ccb12a8b23e833ebc4", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777208312, "uuid": "57bbc6cf-6672-45d5-8a9f-1ace2159b80e", "comment": "Malware payload (ConnectWise)", "value": "2cd2f9d2b09c0c628a320970a7431544f274e98b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777208312, "uuid": "f0feed61-3a45-471d-a9f0-1e2049c4dfbd", "comment": "Malware payload (ConnectWise)", "value": "abd8a4cd712ccbac63966266c8cff95ebf37c66cae31ec83e8c9ccc4251e5279f78a49f94741547e1f957c8325cf85b9", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777208312, "uuid": "0ef84377-8899-43c4-8e0d-4535dd9928b1", "value": "T136646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777208312, "uuid": "830f5cbb-0108-4a01-a021-be919f9bf911", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777208312, "uuid": "09cecadd-0c99-49fc-a4c6-6dab4049f700", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9s:R1iw7gryNkSV1hy1Z1u2JLu9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777208312, "uuid": "31cce822-6798-4153-a3cb-5d7138f6784b", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777208312, "uuid": "bb6c710e-1e17-4376-b999-edc2470eff0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777208312, "uuid": "1556cf64-3a06-4401-aca0-009e498d1848", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34417b94-418f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777221873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221873, "uuid": "f25b7516-5f3a-44d5-94b2-176ef51c4213", "comment": "Malware payload (Gafgyt)", "value": "9bcdc99594e68efd3f84e516cb70b7b8", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221873, "uuid": "406e883c-e0e5-4415-a969-7e84433e6559", "comment": "Malware payload (Gafgyt)", "value": "e0a726420a69d4f0fdfe403fa43e381e1d31a945ddabef2e33b690c91c8bf9fa", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221873, "uuid": "5a102604-6d8d-4b41-900e-e858d481eb6c", "comment": "Malware payload (Gafgyt)", "value": "6bca539c37f8b0cddf444135ebb81ce2054108bb", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221873, "uuid": "c854ea62-347a-4ab9-afde-07a43e2d3ba3", "comment": "Malware payload (Gafgyt)", "value": "825d0f136fe8b3c7b7ff80ceef5edc03ad95f536e0c032f192ba23d4d7bba4e10e9dcbed54f706b39617b8bd721a6538", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221873, "uuid": "94a3567e-7b53-4ee6-a8fa-e322b640afcc", "value": "T133E33B06F6408B53C4D22776B6CF520633239BB5A3DB33065924ABF43FC27AA4E36955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221873, "uuid": "f493b48d-c777-450e-9eb2-3b3649b4688f", "value": "3072:IdHnVYz6raaaTI0+pDSOuOsMrZ5hn+nX+CHNoM/9j5HRmvwTsLOQtyn:UH6GraaaTILpVsMl5hn+X+CHCM/9j/me", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777221873, "uuid": "51da1cf4-31e1-41c9-8ee9-df3a509e1653", "value": 157103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777221873, "uuid": "449571bd-ff7b-4ecd-a14e-4dfb10a67035", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221873, "uuid": "3b49df6f-a2e2-42e4-907d-618f687375db", "value": "fuckjewishpeople.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1e4290-415c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777200036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200036, "uuid": "7c6c0a3c-95ee-4f2b-87e6-9dbb7373ed62", "comment": "Malware payload", "value": "f2ef8968faea770a48e48a308a290b0c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200036, "uuid": "fee731ed-58af-4587-808f-bcd2307c1fac", "comment": "Malware payload", "value": "e22737fa3f80a5ecad6420f406a746d34b2bbee141f4c224fb56bae7657ddd2b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200036, "uuid": "3e087b16-9f63-4708-9075-3bcdcbad6bcb", "comment": "Malware payload", "value": "e9caa110d7369fa55055d3851c264422525564e8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200036, "uuid": "00cb603a-3c24-4159-8e8b-d9e969a3c328", "comment": "Malware payload", "value": "61f97c8c94a08818722e32c602fafe4ccbd5ba930a23fca1a170c8cdec4928e567cfeda66d95e51d0ebb62e828bb39ae", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200036, "uuid": "351743d2-0d56-46b7-8267-716a4491ca29", "value": "T1F4E0EDDE7069346CFC007E8334C08B885212F39B2D4B4F49145C1D20FC45578302BB41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200036, "uuid": "6c0730b2-85ca-4e35-b370-a2ab2d52046e", "value": "6:nUBRXr9UCuyU4IU6yUBRXr9Uh0yU1BFIU57yUBRXr9U4LyU4IIU4hnUBRXr9UeGj:YDIfTHFIAfnIUedIIeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777200036, "uuid": "2d2288f5-9943-4c4d-a530-ea692be04bdc", "value": 407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777200036, "uuid": "5afdfed2-1c9c-4fb2-8cdc-e19706e0c351", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200036, "uuid": "82fc28fd-256b-41e9-a3f6-54037105fb38", "value": "t.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61dcc8b7-41c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777246861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246861, "uuid": "9e69285d-ca2e-4ed7-b059-0ca23d241f98", "comment": "Malware payload (Mirai)", "value": "6512d1edda773412c1e13f7468b86793", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246861, "uuid": "e6a63c5a-f1e8-436b-8978-9fdd598110b6", "comment": "Malware payload (Mirai)", "value": "e25c04266de411fcc6c6f0761b01c783d35541ba3a67b70d0e35750a798c3a95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246861, "uuid": "c2e150bf-fd1d-40e2-82a6-1992d14126db", "comment": "Malware payload (Mirai)", "value": "83e78bb42ac6f7d24ee586b642e3802917615fb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246861, "uuid": "3b787029-cf1a-470f-9400-dc113c4a7450", "comment": "Malware payload (Mirai)", "value": "7161cd85d2e65f559f0fbec2f373f16a955cb0e02d4b3534feffff0457edcd7a558029bf54785e259a59fa73258c81e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246861, "uuid": "5f654cd8-b46d-49ae-b478-cf6042847e81", "value": "T1CED36C816A83C5B3C8055BB831A79F314976E87F071BCBC6E3ACACBA6E15594B00735D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246861, "uuid": "1c5c41d2-bb28-4acd-b4c0-3c0dc31b0466", "value": "3072:dIadkxM994JkqJqatyLBJPqVguddgQRDYofOEglR:yuyc94+qoaYDHi5OxlR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777246861, "uuid": "abc695df-a743-4e24-9483-4fe4ef481927", "value": 136624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777246861, "uuid": "9523ba3c-bfe0-46b9-a598-0ebf6b17af70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246861, "uuid": "950ca191-78b1-4f51-821e-dd4f1434307f", "value": "Yboats.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d8f3bd-41aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777233415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233415, "uuid": "a9a06a6b-8774-454e-99db-16e6c6cbea4f", "comment": "Malware payload (Mirai)", "value": "f949e6233f0bcb6e2266d37dd279dbdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233415, "uuid": "5eee525d-395c-4fd6-b368-361982307305", "comment": "Malware payload (Mirai)", "value": "e287c2ba0ed382754c0378f96d61f1f7cd59ce82ff7b494499aea0af4170c7f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233415, "uuid": "7574af86-c50a-49a4-beba-d9948faa3227", "comment": "Malware payload (Mirai)", "value": "d5d122903fe18a31b7b8d0e68004fada58f14467", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233415, "uuid": "d41b7099-7670-4371-b435-790db9801a07", "comment": "Malware payload (Mirai)", "value": "b56b222f3fcc3a5d9c22b40d26c8a9774188f5032250eaa74eabed7b3a702b25e81af4335c5833e1ac1948463a911179", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233415, "uuid": "5dad3593-c175-4ce4-a45b-e88d478f42a6", "value": "T16FB3E84E6F318F7DFBA8C23447B39A21975823D227E2C685D19CDA011E7028E645FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233415, "uuid": "f8563cda-f4a0-439c-b2cd-95710e95dd8c", "value": "1536:SEkWiTLiZECcpHOWWJDmmn5Pd1Oe4qPrs9j4Zinyk7+TeVedVPneQBZN01faD:gni50poFfP49j4+7+Te0dVPZ01faD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233415, "uuid": "10db73d8-ecbf-46d1-a19b-663a70911ed7", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233415, "uuid": "b4763b2f-8248-42be-939d-1779d267d16f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233415, "uuid": "2fefd498-9245-43cf-99bd-e8b4d8f13da2", "value": "luxzz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f1fea9-41a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777231860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777231860, "uuid": "7208dfff-c2de-4756-9e9c-e7461af0b730", "comment": "Malware payload", "value": "30c79893c19e1d585e72c1793b19af9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777231860, "uuid": "a838804e-ea78-424f-953f-5058e4f8fe7e", "comment": "Malware payload", "value": "e3f894ca1868d4dd9c8a0cf03bd00bb4268359b05feaabac640f753f7ef980ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777231860, "uuid": "4b78df3b-5ff1-4288-8b03-e110a4203164", "comment": "Malware payload", "value": "ada3b62dc0a45b299edb5bda3d1f62bc7fc3f052", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777231860, "uuid": "44e151db-a5f4-428e-8ac5-1f49c1920d9b", "comment": "Malware payload", "value": "95d12e8f4d775d39986eea6bf817ccc1fc5b9b5c66bba00cbcb5d43aac9e95df1a25031cb679c7e9180ecabadb30f0c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777231860, "uuid": "43cc25fb-a109-4f64-a740-ea0e98078ee1", "value": "T13155E242A2C6FD1BD3362E358594E32D89247F31EEA6930B30BD35AC543BBAD8549353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777231860, "uuid": "8466b470-7ffe-4024-a498-d115015ff029", "value": "24576:ltsCDb36T6hRRCCXUJWpQ+NGkIAm13QuQQe:ajkIAm1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777231860, "uuid": "b3146afd-7774-4ac5-be78-135ca2c9e94a", "value": 1309448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777231860, "uuid": "9349c360-1972-4a54-972c-35259bb988ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777231860, "uuid": "747c47d3-b78a-4100-b315-e546fb4c76b2", "value": "SecuriteInfo.com.Variant.Application.MSILHeracles.7055.68718421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80178edb-41b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777237033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237033, "uuid": "d6c8b410-7562-4741-980d-f85165a61263", "comment": "Malware payload (Mirai)", "value": "cc2d39b48bcf5c6cd74c578f73f94c2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237033, "uuid": "568277e1-960a-46f3-855c-8a5c4f4deadc", "comment": "Malware payload (Mirai)", "value": "e4a74c7baba798556e5d6f32ee7cb72a26251487f6f0dd902140bdbdbbc377d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237033, "uuid": "fcce92e9-37b2-469b-b108-69e7887bcb73", "comment": "Malware payload (Mirai)", "value": "2009094b57da844e46383840749d8ad0ba0bd302", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237033, "uuid": "aaa63107-5883-4ea7-9f10-42e5ac0c88f0", "comment": "Malware payload (Mirai)", "value": "a9153e7f93c3701e454dae8775e84ef01c88ef7bbadc2df0feeb03b701dd06b664d15a755eff890fc5abdfc1622be9e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237033, "uuid": "726cd905-e0cb-4448-9423-47a370b99096", "value": "T149932A45FC919A12C6D413BBFA2E218E372663E4E2DE3207DE299F11338659B0D7B741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237033, "uuid": "4d10878e-e4ca-4061-997b-d5a049a6058f", "value": "1536:NHcnygaFrVfQMbabTPF6ITa1Plpxz2q3QQndvuqvpIk:NHDgaHfQToFPlpxzgSrpIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777237033, "uuid": "107f2918-13df-49a3-9efd-90495a5778e5", "value": 95720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777237033, "uuid": "1691120e-fbe7-48a2-aa8b-01e015114c83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237033, "uuid": "95c479af-0d66-4dd6-98a6-7040eb646cc4", "value": "023782pler.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318305a2-418f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777221869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221869, "uuid": "d98e9a94-4e89-458b-8a61-d1a97831f475", "comment": "Malware payload (Mirai)", "value": "42ea0275b067ddfd18ec9178fb84a186", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221869, "uuid": "f5f2cd56-7dbb-48e3-90e3-4c2c6de9db2d", "comment": "Malware payload (Mirai)", "value": "e55b07ec5f9a7c467622234b424f97f095894869d50a5727b61e68e4377e0cb4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221869, "uuid": "97380816-f9d3-4ec7-a4f6-3d3b7bc60410", "comment": "Malware payload (Mirai)", "value": "1f5b8aca684348435d527b4e693c2550bee6406f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221869, "uuid": "b210dc50-a1ef-4e22-a644-624102198f44", "comment": "Malware payload (Mirai)", "value": "8e0b192ad527f4d7969678c86a87d1fa7b3972d98b87acfb5e4764e73238284b459d49cd4422fa68f79b5cdc2cbd2d77", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221869, "uuid": "ff1d0c43-346f-461a-88a4-e1107f2b84dc", "value": "T169C33B06F5018B53C1C3177AB69F561A37232BF997DB33125A246FB42BC279E0E39A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221869, "uuid": "3bcb850a-53a3-4ee6-8743-b6e5e42a0ede", "value": "3072:HMdhrJakugmtQiWWPBXA5hnOLSGLR1Z2mynQUJ1nXI7n:HghrJakugmFXA5hnOLSGUmynQUJ1XI7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777221869, "uuid": "22aa1518-b95e-40d9-88af-8541dc40b5b2", "value": 119190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777221869, "uuid": "5808ccad-5bdb-48a4-bff5-d7a85195f96b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221869, "uuid": "93ad8411-cd47-4110-8590-3fb2e50c06c9", "value": "fuckjewishpeople.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d65ad7c-41c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777244384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244384, "uuid": "233e3fe4-c248-4ac5-a81d-73a4940b286e", "comment": "Malware payload (Mirai)", "value": "72588ffd8b3cc70123cc4a853e261df0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244384, "uuid": "06d5ad30-6b47-4bf0-b39d-b87846a7694e", "comment": "Malware payload (Mirai)", "value": "e6c1ef5376195eed87bc6c13e55b7840f422829a4eb19186b726b935c6517105", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244384, "uuid": "8685acd5-8b81-4c86-8443-afdeb4aca809", "comment": "Malware payload (Mirai)", "value": "1b30072fcc7cb3f74c413278758ae44f59e6382b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244384, "uuid": "db1aef1c-9c06-47f3-973e-ba83fa54a1c3", "comment": "Malware payload (Mirai)", "value": "66f988b985d3a13d2bbb8aa6c94f5d9a8ed09f68ddefa7136730339cc7eafb6b32fa01fc5d14c27d752115ca7f4e2b77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777244384, "uuid": "dd6cec4d-c2ac-47c4-95e6-209afd5cfc64", "value": "T14BE43A56F8809F62C5D1257AFA5F8268731347B9C3DB720699189B383BD782F0B3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777244384, "uuid": "b5d2b7f6-cb45-4417-9d58-9e563a9a9c75", "value": "12288:CuqvDdhZTSqO2n0KOA2nc+I5PlK/fOJj8gpkItb/W7vdaiPd4lqZ:Cuq5TSqOM0/k5NKnOF3luhai14lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777244384, "uuid": "010736b7-be45-448f-824c-b5b8e297cb0a", "value": 667540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777244384, "uuid": "3221d926-c96f-4b81-abaa-f8b22bbb78d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777244384, "uuid": "259e70e8-6463-4aee-87e2-5addd6fb0116", "value": "agent_armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897f6d4b-419d-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1777228029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777228029, "uuid": "070a1ba1-990c-43a9-bff7-8815303dda5d", "comment": "Malware payload (SheetRAT)", "value": "7cdd26a5433b865a097487ecd5f45f1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777228029, "uuid": "b3d6654f-7356-4d36-98da-cd194bb66761", "comment": "Malware payload (SheetRAT)", "value": "e6c750d2a51d1fc9994175db6c3000743d6b01ade5d1582fff6f796ea74e4973", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777228029, "uuid": "d0aeac12-6b64-4320-b138-dcbf3d670568", "comment": "Malware payload (SheetRAT)", "value": "fc59c80dc99995e614e80c7159bedb2ce4a1863a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777228029, "uuid": "73c31b0f-bbe5-4750-8272-f87fc8196815", "comment": "Malware payload (SheetRAT)", "value": "74222fc52f14f9bf31dd52ac06849ee3e3d6957d3715aed396b5baaa4dfa791452816d5cfd7ad3d3c233b238d33fc979", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777228029, "uuid": "b3d18757-93f4-4bca-96c7-c5fe39248284", "value": "T1F9735C0133F86226E2BF8B7E98B450104F76B9136E72EA5D5D86904C49B3782AD70F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777228029, "uuid": "dfdcc691-85e0-4e59-a777-31f0213423b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777228029, "uuid": "806e3ef5-b9d7-4dc1-b71b-a71a4ddf98a6", "value": "1536:PB01KIyTsqa4tsi5dnPfXwbLCCj6Nb1AIP:PB01KIyAX4tnf3XwbLtu11X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777228029, "uuid": "bab074e0-2bf4-421f-a3ea-4e10b0ce70ff", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777228029, "uuid": "964ec72a-7541-439f-9f75-94f23a6c717f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777228029, "uuid": "713fb6a8-0265-4db3-a379-e838bd5860dc", "value": "mshta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d549f73-4149-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1777191770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777191770, "uuid": "af747cdc-5f5a-4625-aa1a-5cebc1ce80b9", "comment": "Malware payload (WeedHack)", "value": "d6937837f15d7fe8891272c0c7c55ed2", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777191770, "uuid": "fcc5fac3-9f5a-48f6-90cf-6cae75f280da", "comment": "Malware payload (WeedHack)", "value": "e71f48cc967b458e1e0c20ced205b2516ff27914106e163d34d5c48eaafbe03e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777191770, "uuid": "4e9658d3-27f9-4979-8311-6af102e4c5fb", "comment": "Malware payload (WeedHack)", "value": "a5cee8493815142917232ab53d9b7198885fd3d8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777191770, "uuid": "8ddb93f6-0ded-4f60-a1c2-b9d21abdeba4", "comment": "Malware payload (WeedHack)", "value": "a4294e749e9bfa2f2e8c1dbd35c503c8eca44cb5212e42c493590fab324aec96dda6c6ff243215c6bf3a3f14fa457963", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777191770, "uuid": "065dd788-ecd4-4875-843e-88525dbab88d", "value": "T143F41223D22DF032FD8B89B6BA64AE22389D08F454737211E7993CFB5CA75A5834435D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777191770, "uuid": "eb693520-eb4f-4238-9444-dbbbacc8765a", "value": "12288:ne0CzATrD4enMi9IpFi6p+BAY0pmSCRMqXvK3lyCjcCXRRG0px6:e0CsT4QMgNUYi3ECwCXGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777191770, "uuid": "74682074-3619-43ca-9aec-3c48dd10ec58", "value": 768444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777191770, "uuid": "fa5432c4-7325-4f0e-a703-5d27f0a03da4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777191770, "uuid": "4c804b7e-c692-4654-873d-8b2111b6637d", "value": "Krypton1.21.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5df1de7-41cb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777247861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247861, "uuid": "e5f6a0cb-56e9-45cf-a427-99f8e70db457", "comment": "Malware payload (Mirai)", "value": "a3b70e3bf0b27f680d82a193e2d34b63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247861, "uuid": "1e5a331f-ffa1-43b8-9004-77fd56cc3aa5", "comment": "Malware payload (Mirai)", "value": "e76c1268558776e81ddaad587a8aeef906bd4c67ec133ab8532bc3757d974722", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247861, "uuid": "67863281-98e4-4ac8-93a6-af5de913c45e", "comment": "Malware payload (Mirai)", "value": "7aca72f1267ed81c5038d97e20ec9257da22eff0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777247861, "uuid": "b0bc489b-0ccf-4ceb-af13-e010a358b8d4", "comment": "Malware payload (Mirai)", "value": "049f6df425af5bf48df64ab36b90c251a566a018406b6629b3aba2d1aeacc1577907cbbf1be31f5013d22ceacabe01a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247861, "uuid": "1b9f9c4d-df33-4a0e-90b4-b3a160e08496", "value": "T141C32A05B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247861, "uuid": "0901683e-017b-4793-b038-b368317cc0ee", "value": "1536:68B72AZ4ex10JrZqQ7UrZb6wI0vAnjiLVRuzae8Dhq6N2te5f3dWJ:6eB4exMF7oZKJnCNYa8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777247861, "uuid": "c634b8a6-3266-4e97-8efb-4348564fc7cc", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777247861, "uuid": "b896b006-aaff-45b4-9e0c-d1cd4cb7b603", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777247861, "uuid": "a889f6da-4ca2-47c0-890e-76d8b615ab58", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb4d08b-419a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777226751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777226751, "uuid": "696d4e81-912f-4545-a688-13542f4022c0", "comment": "Malware payload", "value": "7827c50cb1c7152544d47f238c5b913d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777226751, "uuid": "aed7712c-a0e9-40af-ad21-c0a32480daaf", "comment": "Malware payload", "value": "e8637ea28e04226406dd17e097e9238ed2d9d92db5c353eb7ae57aa1d8bf67f8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777226751, "uuid": "6a411dc7-3267-4678-a9db-63351ef6938d", "comment": "Malware payload", "value": "b6645b7bdfd8916441a79003fce882bf5dc7614c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777226751, "uuid": "1d320153-5d81-4721-9922-8a018d6aff54", "comment": "Malware payload", "value": "6470dee6e17f2ba9740cd7fa424fa581c34fd81d1f24dd7e0fbf9c913a491d79a384495ddfdca3413b6fd9b4e40445c1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777226751, "uuid": "b783f311-0205-46aa-af57-df84c5f796ca", "value": "T1ACA70292DB6F1FCE3D281D4C045E7A5A4DC9AD333D22C4F5DA9F290B82389D506B192B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777226751, "uuid": "0354bccd-9e41-48c1-8743-0cd9828c1544", "value": "49152:zuRy4HJ+uzFgf5uz9Qwru5AR0gSNztW0SZs5CS9kC/kzD1HjbQcgBdN0srdl0Qvf:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777226751, "uuid": "79825f7f-b697-4b01-ac0d-5c7261548956", "value": 43784278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777226751, "uuid": "1786ab58-e5d9-4364-ba55-4d336818770d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777226751, "uuid": "074f7b3c-88ce-4849-bbef-50890b118a35", "value": "LARGES~1.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a842b44e-412d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777179977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179977, "uuid": "cb4677c6-28ad-4d7c-94f2-9f9465d54ccf", "comment": "Malware payload", "value": "0dbf1f0beea4e82b3d0c6901bca1f476", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179977, "uuid": "83899e17-e68d-4603-a37d-4ab09f404cd1", "comment": "Malware payload", "value": "e9d3ff0c11db2480e53e52a1e827f1bd18e03cfcade43a450d23a220ced066c1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179977, "uuid": "a64cacba-eb46-4fc4-8cc6-d66ee4c543d5", "comment": "Malware payload", "value": "05f6cdaed1467941a874cf0fd788255a8970608c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777179977, "uuid": "1aff700f-d764-493b-9659-af1371b37467", "comment": "Malware payload", "value": "7fb78ac215c18b4e662e2869a8db8ec05a0b8197a2e2f1421eb2981cb5b72b8de1cb0fb9155717f17421d5bb510ddf92", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777179977, "uuid": "0cd95bca-f8ff-4c7a-a7f9-345386638597", "value": "T14453A1BCAEA7021D703B88D1AED96593583D3797B20E6B8515A5A3F0071394EFC6CD0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777179977, "uuid": "ec010f6d-3b12-4554-b2ef-a61c81565486", "value": "384:RtSNiZ5ZjSyPx5p6uz2SmA2ARrsu3ASn0s2Bm/5hTm3viKiPIwQaChFv0/zRGzPk:RtIiZl6ZhsIwQRzv0/Gtym7Nc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777179977, "uuid": "45ef426c-e224-4206-8ff2-121d23265eb0", "value": 61230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777179977, "uuid": "5574c59e-9303-4d91-a26c-dcc8bea7ea12", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777179977, "uuid": "6e64e34c-af6c-46a2-8d6b-86de2d2df200", "value": "Setup.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521ba87f-41b0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777236097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236097, "uuid": "9a4d8c63-16b9-4aa4-b8e4-ce5c985ffc6c", "comment": "Malware payload (Mirai)", "value": "2081cdaf15bdd2a07927fe8a156cade8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236097, "uuid": "f0003528-b920-424c-8612-dc427d1d8f8f", "comment": "Malware payload (Mirai)", "value": "e9eab7bd40c25b482702f1aa3d9e13022dc5b3b647296d4bf86857575b94b2b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236097, "uuid": "e2cf0302-0526-4648-8823-8a2afffe5105", "comment": "Malware payload (Mirai)", "value": "e8e3cbc08a671138e5a78a9130f932a815632ba9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236097, "uuid": "7b01c284-4762-43fe-abc9-df4ad06d3527", "comment": "Malware payload (Mirai)", "value": "5c3da9b5870567dc1e118debabcab566535c38cd42f58dc911c0a46c23f921b7c1d103276e3f26bbb1feb5e7ce4a29a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236097, "uuid": "4ec9974d-072d-4188-88c6-0e6612f81675", "value": "T1A9833A47B98190FEC459D03847BF7537C923B4BE1239B2AB63D4AE262D09EE01F19746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236097, "uuid": "45a2acf5-6687-49b3-9870-fc9d2fe59fd2", "value": "1536:MqbN7IdAcsgxY+zKRqakCkj6Rv3U8GbdGrAyvQ9ol:TN74Acsgx9KJkCdRvAbdGrXQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777236097, "uuid": "7fc12b00-1377-410b-a051-b0b505bdc366", "value": 85904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777236097, "uuid": "8f004c3e-fe99-4b5a-bee9-c253a1927956", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236097, "uuid": "f6564e37-57a2-4178-a1c6-6c4ed91c7d62", "value": "windy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e129630c-4171-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777209278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209278, "uuid": "90be81df-bca6-4617-a7e3-5b5871b6122c", "comment": "Malware payload (Mirai)", "value": "3349e6ce308b585e90917d2f01f54eba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209278, "uuid": "0280deac-75ad-48c2-87b4-2713b7d82a2d", "comment": "Malware payload (Mirai)", "value": "eb009066bf2884792cf9d8dfc948b21f01dc3248f50281d18ca96120c318669c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209278, "uuid": "0640442e-d58b-41e8-8c31-4144c6b62012", "comment": "Malware payload (Mirai)", "value": "e0f94fd26149da62f2393ee9a338c475fc0616b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209278, "uuid": "21b3bda1-df6c-4c51-984d-8c2e7fbdf235", "comment": "Malware payload (Mirai)", "value": "d162b1f2f086046290ef0929f3b2aeddd4cf318806589cf6ecabf574bd10483679697447dc668c8438d37cf5ea9620bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209278, "uuid": "9cc43fda-5956-4a3c-95a1-75b12a0ebd5c", "value": "T194C35C1775D180FDC8DAC1B49FEAE226EA33B42D5138B21E27C86A671F4DE205F5D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209278, "uuid": "5c8ba43c-0bb2-44bf-9a72-f67faf24886b", "value": "1536:UHAFmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK3V:UgFmSmviqS1Bs0+Nd6lAqktNMxSNbmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209278, "uuid": "66b64531-44c1-4d77-a437-009c64bc2af4", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209278, "uuid": "ad6da7e3-cdbb-45ce-93bf-7da3f0359ee4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209278, "uuid": "d0071512-0697-4aed-9864-754878122264", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0872054a-41c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777245422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777245422, "uuid": "d19c9205-54d4-4c4c-a985-13fb46648ce9", "comment": "Malware payload", "value": "b0548d595daa196b9600b1fb4121515b", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777245422, "uuid": "5e2f034f-18ad-492c-856a-80343ff41aa6", "comment": "Malware payload", "value": "ebcf1fadc2acbb0914291c266b9db3abed5434e2d8564eaeffe852cffdc273b8", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777245422, "uuid": "f462b81f-dae1-4aa6-b99b-853a199dd8aa", "comment": "Malware payload", "value": "10677f8f746486564679c74b6661728fa749df53", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777245422, "uuid": "01395182-5702-4854-9f35-c10b1d35d158", "comment": "Malware payload", "value": "40ec333cf39df9b3b8c0e188c862dab58a08c9a780aebd15d5624c08e0fc9b2c5ce7e3bdba83f383b1163418f86a9d0d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777245422, "uuid": "260018e6-b1d6-412a-b7f1-8528f75e7f7d", "value": "T114070F3DCEE8423EC2B7C929D9CA4A17F85A091B231CFD4A64D773975527183BCA211E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777245422, "uuid": "6d9f5854-ae5f-401a-b563-537f1416c51b", "value": "3072:KfC8pbP3luExvrprCm9jVaQ01EaKk3zHrDcjWxYt5ZtvcPc5GtOivGN6/DFybCVJ:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777245422, "uuid": "eaa1d837-722f-44bd-8446-ff3d48244910", "value": 18292892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777245422, "uuid": "7fa2d608-c3f9-4d2d-a08d-38aebe03a116", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777245422, "uuid": "566d5b58-31e6-47ca-a925-34bb9bc0b79b", "value": "skgsd.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd750996-415c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777200199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200199, "uuid": "292c779e-9315-4e20-b6b4-8e64461e08f0", "comment": "Malware payload (Mirai)", "value": "1b0e84dc7fead555bfcff467c8e4dd71", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200199, "uuid": "b4502d8e-2031-47c4-bc1a-90b7fd2595c6", "comment": "Malware payload (Mirai)", "value": "ebea3445ebf7d4184a75980a21a4d1e4e764117072180c6fcc213a285c0bf741", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200199, "uuid": "71281d01-efcd-4c8d-b5f2-3271c9d3a898", "comment": "Malware payload (Mirai)", "value": "fefd3432dd8218e2a9aea7157b01da7a2f756c5e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200199, "uuid": "3b1b6bb7-72ac-4f93-91ce-9bbfaf7f86a5", "comment": "Malware payload (Mirai)", "value": "f5c39f6054e2ad0a43979f45120f59fec1a2c903085db8729b3f7e68a49c36d81afd3b3c260693c3a3a018d79005abf0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200199, "uuid": "15919f74-9a19-4aa8-a7c0-4723e9ae656b", "value": "T14C53831AAF650FFBEC6BCD3745A91B49349C640A12E93B367934C818BA5B20F45E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200199, "uuid": "761f62ac-5454-414a-85ed-b97bc17572a6", "value": "1536:yGtQ8AKyjOz8lI/DXUAF/MSL3bKL2LZgsF8qD:yM6KyazQiDU5L2LB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777200199, "uuid": "51b559b4-522d-4c02-866d-89080471806e", "value": 64380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777200199, "uuid": "7ff74fcf-6410-48f9-9ed9-ed4ceab64696", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200199, "uuid": "0bb0b68a-4084-4ee6-88e5-7dbe5e2124fa", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce171e7-416e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777207956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777207956, "uuid": "0881f33a-b7ae-4f64-b268-dbc526ba9870", "comment": "Malware payload", "value": "b727c54a34a4c5f5c906f5ed0bfa2c61", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777207956, "uuid": "3d8daf22-4099-4cc6-bfa5-f385216fc082", "comment": "Malware payload", "value": "ec8a6367531c60f926012b4f2132f2dd05ab174e4221e65f1fcf6862b0740596", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777207956, "uuid": "b1215ef6-843b-4d87-9af2-1010243dfc31", "comment": "Malware payload", "value": "39b1d0ed5890e60198b1ac4fdba5ba7df8753d48", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777207956, "uuid": "7ce85813-8d78-42b1-97d8-8fecc54434c1", "comment": "Malware payload", "value": "ada5b999c889ad9fa3c3496b27afb73fc8c6816711cccbcb971292d442fc25f260585f41e1a8e9d6f87fa47dd744399f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777207956, "uuid": "a136bf7c-2cb0-4e76-9db7-b8934360e8f1", "value": "T105D4230625C09674E052D6FD2287F6F3FC17B0546EE4AA132B9211A1766E7332D2F7B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777207956, "uuid": "36ec90fb-9a15-408a-a6b4-143db19b2485", "value": "12288:Qcju7g0qMYmShODQ9+202PxW/k4x1RcgP3Qs1olO1yUdpswpI9n6LPqyR8IL:rsg0pqf9+n2Sk4x1R3Ao0Eps8jqyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777207956, "uuid": "1ab22c9f-799e-464c-848a-227216088f9b", "value": 634248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777207956, "uuid": "d2807e70-8932-492f-a1a9-04e64b08afd5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777207956, "uuid": "7833288b-b34d-4095-a16a-32cc9664ff58", "value": "iciv36xx0z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4d631f-41a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777233327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233327, "uuid": "c559d8f6-ecae-4684-8947-1d532523fbaf", "comment": "Malware payload (Mirai)", "value": "6e5b253089b9c87f482091b405e2f3d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233327, "uuid": "fc82a623-c2a8-4d34-9154-985b6163655f", "comment": "Malware payload (Mirai)", "value": "ed7052692220b1972b8c66636027a339d8e249caf44c5766f9fe6b1d5c48c9e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233327, "uuid": "ddc991da-64ad-4b27-b053-3269dcb9da28", "comment": "Malware payload (Mirai)", "value": "26ad45099c39dd60e7d202d5a0156b44bd478a76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233327, "uuid": "9210d77f-9589-4a2b-8be4-e1214fc91789", "comment": "Malware payload (Mirai)", "value": "9f50265f2fcca897038eedfaf2bd7d219fe2f94fc313792eed761a4641a23dece39a8d725beecd3507375da43ed5aa17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233327, "uuid": "f1e95b4c-8b32-4c3e-a3b7-89c822e7ba6d", "value": "T14213F1D8616AE4BDDD32913A42CC6BCBC6F76ED25E0B600C25E94EE44FF30D528364A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233327, "uuid": "e5340530-d11e-4ed8-aa6d-27d64fa05b00", "value": "768:mHsa5QDovTv4hh6NvOWcV3GI85VxHBRPqwSrSnCym5u04EnsK:da5ooLvUh61OxV3liVPRP7nTz2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233327, "uuid": "dbf761eb-0ebf-4f79-8db3-6a17efc7624f", "value": 42088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233327, "uuid": "e61f843d-11e3-4a51-b451-6aaf77e4cced", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233327, "uuid": "a4040954-e7bb-40a9-b1a3-b1568246c274", "value": "luxzz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437185de-418d-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkComet)", "timestamp": 1777221040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221040, "uuid": "8d58b91f-5622-4ecb-a317-7b904ebfdef8", "comment": "Malware payload (DarkComet)", "value": "c24b05b25c28e5e7a1231a62be80bc12", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false }, { "name": "XRedRAT", "colour": "#17F038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221040, "uuid": "47a25d81-959f-4882-97e7-91fc9da8eceb", "comment": "Malware payload (DarkComet)", "value": "ef3e41ec91f8be146c3588321f98be8d3db3933d3881112554898e7eefb8b017", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false }, { "name": "XRedRAT", "colour": "#17F038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221040, "uuid": "ddb000e3-8523-4afa-a1ad-04be1cd273b5", "comment": "Malware payload (DarkComet)", "value": "b7aa76ee644aea0d4453a2b0bd1385491ba5208b", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false }, { "name": "XRedRAT", "colour": "#17F038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221040, "uuid": "fe1f97e1-abf2-459c-91c4-d34133cf1b9d", "comment": "Malware payload (DarkComet)", "value": "8d9cf8a77623a4dc6449ab5100d3a384dda5cd662467587770af6ad39535f435030924612df3e1dc7472c3582a0a2312", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false }, { "name": "XRedRAT", "colour": "#17F038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221040, "uuid": "a5e29184-5763-45db-8e84-bd5a54cb4fa8", "value": "T161F6330CB7C025A6F5F79631C2539B269272F2071B3097DF4391442B6EA3AF51A7A7E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221040, "uuid": "9e1ff89c-dba9-4ce7-b6a1-3286f93760f1", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221040, "uuid": "d5120130-63c2-4cda-a1b8-42e823493c81", "value": "393216:dAZYacd0h/udnBG0+nReke612FAL47KfqLfEuECMc+8ADtAiatsh:mZvHudnh+nRey4KS7jECMIgtAiatsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777221040, "uuid": "faaf1b78-4197-452a-a70e-bc380697b33a", "value": 16358830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777221040, "uuid": "f6cfc0e7-7d26-4b36-8c3f-ab45979569fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221040, "uuid": "643a4493-1852-4982-9468-9402fdfcf773", "value": "XWorm v6.4 Edition.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4656cac0-415c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777199999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777199999, "uuid": "3e69a4a4-8e08-4fbc-8acb-c7f91a1a56b2", "comment": "Malware payload (Mirai)", "value": "dfa6b1c84e524aa1343fca353015311d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777199999, "uuid": "c860e1ce-e92f-4438-8405-21706b0f5ab5", "comment": "Malware payload (Mirai)", "value": "ef48dd2be42973fde4cb2637e16d1b5f7e3cf56e27a55aef079b995f4a971edc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777199999, "uuid": "042a634b-8c82-4e7a-999b-08967b093154", "comment": "Malware payload (Mirai)", "value": "06eb4fc168e8a13c567924451db8144b7dee7073", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777199999, "uuid": "d0c6c523-284b-49b8-b961-1d2de37041eb", "comment": "Malware payload (Mirai)", "value": "52724cacc81771f3d8c68b3a8a2333cb174f436f96b4608829e010d5ef841eb75e627a5808d323dac23a42506587cc43", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777199999, "uuid": "6f76c3fa-a469-492d-b4ad-4036c9d25d18", "value": "T1DF231894B9829A16CAD0437BFE0E42DD3725A398E2DE3313DD225F6137CB92B0DA7151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777199999, "uuid": "9e058c83-2a25-457c-b9f6-fb7e5b531c41", "value": "768:UXYesyi5wPVQEkJVvOwxPFV4iRu6Jj3oSCA6gPj5+uB4Pl5Q1wL0xkbUFqBgEk9H:VZe4vrR476JdLPj5+uBalu1ObUoBEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777199999, "uuid": "1092dcc2-abc7-45e7-87a5-354e0c9b266c", "value": 47940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777199999, "uuid": "c0e77a6b-54a4-4ff6-b48a-472b27aff2ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777199999, "uuid": "92bb5883-5cd7-4d6f-a018-ddc1696ee0ba", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e9934a5-41c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777246828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246828, "uuid": "37e0f548-990f-44ca-bf28-b38f534c7cd1", "comment": "Malware payload (Mirai)", "value": "e41198d07008d18e1e9fc09b1692b7e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246828, "uuid": "2c2e3506-89de-4586-a9fc-44077c012f9d", "comment": "Malware payload (Mirai)", "value": "ef696081f75de76624c19d26955850a91ef7b8c1c21d82af74cadda188dac683", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246828, "uuid": "1c5bfb67-c4bf-47d3-b23f-c9fd6ce385b7", "comment": "Malware payload (Mirai)", "value": "1851c1987ee1970c1c4a2037f274b719bf35e3f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246828, "uuid": "1332b403-6ef8-4c8c-a1d3-fb2dda7aa63e", "comment": "Malware payload (Mirai)", "value": "e9e9e1537b090f67b173421134ed77b76b4a55303161f35e83d38b815f3d7c03ffa97782c6950a6f50295ec0a1218f42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246828, "uuid": "00007e8c-6128-4796-ab9b-866c8aadf17b", "value": "T18AE44B56F880DF62C5D1257AF65F8268731347B8C3DB720689199B383BD782F4B3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246828, "uuid": "77101038-707f-4de1-b8a4-3e39d40d7d4c", "value": "12288:24j/NEu9s3GQx96K1ZmTIKkN1UxrSTUgpkItF7F9gaaiPd4lqZ:REu9s2eVtKk1crIPDoaai14lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777246828, "uuid": "79cea4d9-dcfa-4d05-a8f4-23ffbb743147", "value": 667384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777246828, "uuid": "04e282f9-402e-41b6-be65-0bba39f97ca8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246828, "uuid": "63c398e8-ed73-460d-bf83-983e22f9150d", "value": "agent_armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ebe9ff0-41b4-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1777237863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237863, "uuid": "7499ffbd-3376-45a6-a71f-0de306216c59", "comment": "Malware payload (RatonRAT)", "value": "ac5841e8b08eab0c6691bfa81c7fac81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237863, "uuid": "080f2101-fd08-4f84-8097-e0458a5d4eb9", "comment": "Malware payload (RatonRAT)", "value": "f1eadb3d345839b46d7ccdfc156c52a770ec123b4e2b6cde97152be11241b3b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237863, "uuid": "44485ffb-29c9-4740-9eb0-66283fc13b41", "comment": "Malware payload (RatonRAT)", "value": "94dc67e8e69968f5f4fd02ecce21c40b08d0eb6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777237863, "uuid": "d22a1eaf-11db-4fa3-9b8a-1b0cb90376bc", "comment": "Malware payload (RatonRAT)", "value": "550a2d8d4651160cefb4c229e2084f6b99aa13a6bd0b86c904bcb4247fb438e3ec12a8146452ca55e4f7c0a77f6d8d8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237863, "uuid": "b17a019c-c640-4ffd-9e85-cb73df0e957d", "value": "T1B195F11C33F98A08F2AF4BF4E97185564771FE178C22DB6D59E579DE00B2F48A620B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237863, "uuid": "1bfe078d-2031-4018-93db-e8aa9d11b148", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237863, "uuid": "c6008e35-a88c-479d-b199-23bcfc2ac8ae", "value": "24576:9PI8CrmiaunV5vQ2ue52wWLt3QA2cWAnOEvSrtv94TP0lRRkxYcxMNnyFoBOkA6C:2iGWU5+5WD1sclR0BxMsaRw42yOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777237863, "uuid": "002a78d3-a66b-41f0-99c9-3c2689bd16d9", "value": 1933824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777237863, "uuid": "41e832f0-9143-4c80-9c8f-c6200629fe9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777237863, "uuid": "0869f249-13bb-4c5e-b6b1-3e2a2ab520c5", "value": "ratonClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e812f6af-41a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777233342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233342, "uuid": "e61d3955-ce68-4944-bc78-139178f392b6", "comment": "Malware payload (Mirai)", "value": "7d29cf40c2487cf8fd5ca79043397079", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233342, "uuid": "95fe146a-981c-4818-b3c3-c272bcaf4c27", "comment": "Malware payload (Mirai)", "value": "f2017b20e3b8874ca6faea957fdb138c150f70ab3ba95725c040e220409d719e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233342, "uuid": "dbaf6bad-48fc-4c69-8bc2-1251cd0f14fe", "comment": "Malware payload (Mirai)", "value": "ad66ac3e3cd5149daee8b9c5af118749c02942bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233342, "uuid": "39b417cc-cc67-4a72-b67b-d3aa9301ca4a", "comment": "Malware payload (Mirai)", "value": "4ff628ffb7f630d66d7f5626b22790fb00bc22cd4b5ec6c0ab175164f20e421eb16a63e630654fdf7188ac5c91e4ee41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233342, "uuid": "7076da3a-3fc3-49a5-ad20-dcff75eba426", "value": "T119230270F48042B2FA31EC71846D0A11FF97689A2329E58BD04B2F7256F48277A59B74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233342, "uuid": "0aa25afa-2412-4570-bd3e-5e48fd802564", "value": "768:i9kiBVrBtliBtG7pcv3gQJ494kjvl7kzl6XLF7vmoCfhLDhfPStHku89ry2xT/ff:i9HrBniBteCPJJ49VFkp67F7v7CFhfKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233342, "uuid": "84e5bfd8-28ca-4bca-954d-3bd2c62da124", "value": 48352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233342, "uuid": "ecaf8fb6-2cb3-461f-a1a0-8f07ed51d98f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233342, "uuid": "26bbaf01-f357-4aa4-b2ea-0ecc868e735a", "value": "luxzz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501ed713-41b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777236952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236952, "uuid": "36ebd7b0-fc42-48b6-955d-1d62ba82a4f8", "comment": "Malware payload (Mirai)", "value": "6167421934a041c80063a0c82c493fc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236952, "uuid": "5b604fc0-91f3-4f18-981a-92e4f4f0da3a", "comment": "Malware payload (Mirai)", "value": "f2ab3aaaf45108702482161755fa34fc96949c2d434a3b641a6f2c42076e8370", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236952, "uuid": "d458db21-14ad-4322-8a91-c2d2a314c74e", "comment": "Malware payload (Mirai)", "value": "cf2abef3de9d178c6d13ad14c8921522ae6ca517", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236952, "uuid": "b1dc1985-bf00-45b4-aa9c-fb2628945cd9", "comment": "Malware payload (Mirai)", "value": "f3d55a2fab5f3678ab64bd33a148fb1cfcda1a82934e23a4f34a2d798118ceddb2d541c978cf618c8f8d04424e0a4f8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236952, "uuid": "20bb5468-dea0-4487-939a-abd34cfb9bbc", "value": "T1C1935C22B9791A2BC8E4947B11F75376F1F2478A20A8871F7D710E8EBF246D026477B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236952, "uuid": "88a42f2c-51ba-4329-b173-49c7e8a51747", "value": "1536:EB8TSuzjOL5DsNWjQ/rVTAWSkhce7etdyYm5rwmPbo9SNtRnY:t5fwaCzyYOrljNnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777236952, "uuid": "17ee6ded-6850-4a39-a792-b9121ccbdea6", "value": 94120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777236952, "uuid": "91bef9b0-7ae3-4e33-9fa9-c64c93808c43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236952, "uuid": "add0d259-b039-41d6-829f-6315d04cd895", "value": "023782pler.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7d83f5-41c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777244387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244387, "uuid": "c1882f72-0306-4ef8-8f37-802a3954bd81", "comment": "Malware payload (Mirai)", "value": "13caf48b4c5e023d110116ca92838bb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244387, "uuid": "b275bb52-d211-48c4-b853-068942bd61da", "comment": "Malware payload (Mirai)", "value": "f2f4a196bcc2c5959563a3cea11e5615973c586be612103da1937eef07e91f6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244387, "uuid": "4454ff5d-d812-42b8-8320-04717fd615d4", "comment": "Malware payload (Mirai)", "value": "df2aa8cee386724b96c3e5cfb0e0ca5bcf3f2a70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777244387, "uuid": "c9f42a16-f407-45d6-a697-50d9dc5af0db", "comment": "Malware payload (Mirai)", "value": "07de9c61d1d9175b2a515a171a2932a6fca9670e1e3e91093e71d04dda53a1393e6c35d280f57acb95f1ac527468c280", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777244387, "uuid": "659ec542-59fb-4c56-ac0a-2ee3f8f82d6e", "value": "T1CE157D89E7C7D4E1F55301F5068FD7B60534A2264003F6F6EB8C9A76B472B522A1B32E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777244387, "uuid": "d253eb8a-1924-46b7-b7be-6bb5012571ba", "value": "24576:+Ft/GbgYhmxhs2dthijnTMYiPzEumr4lvM1kkUmEx7fAhkJSJ:+2bphmxhbb8BiPE4lDIhk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777244387, "uuid": "3680c44e-2af3-41eb-ac35-c7a970c398c3", "value": 933136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777244387, "uuid": "f2ad25a0-d980-4eff-b195-0c96ddb4ad6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777244387, "uuid": "4457b72d-ac02-48aa-9910-45bed4622fee", "value": "agent_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8df5ad-4117-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777170593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777170593, "uuid": "c05d0cc6-a8ba-47cd-983c-294009c115b9", "comment": "Malware payload", "value": "5d1208ad479e0b72ad2eebf849bee0d4", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777170593, "uuid": "0f3b87a4-9a78-47f7-8ebf-d1459c6416c0", "comment": "Malware payload", "value": "f3cc95f13557763ff23c2b7537a1708f0bb37ba4dcad7107debd9a911dbfe268", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777170593, "uuid": "1527e0c9-364e-4b3a-ae9c-c26740261826", "comment": "Malware payload", "value": "912138d93e657bb9d3c69cf2764cc809ee6cd730", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777170593, "uuid": "ac306adc-26cd-415d-938f-6bcfda609762", "comment": "Malware payload", "value": "468437a28e7941ef3d38b03046d2f22a5a9e03d0d753d010de9f5747485edd70c94bbd78281869bc03a065e1eedaeffe", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777170593, "uuid": "53e4f77d-2948-4359-9ef0-61969f040d87", "value": "T1D03191912BE91204F2F77F457E7E84684A3B3C25DE31CB4C42A5194E06F2E60C866F7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777170593, "uuid": "613db2f2-3a8a-43dc-aa08-fa13ef1f0ecb", "value": "48:lkLzqRowIX6nVxVYyeMDra37vOPmfqHX4AfMHt:Qz8owIX6VxbDrarGPmSHVfMHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777170593, "uuid": "a60497bb-f851-4f71-991b-9a87220ce8f0", "value": 1620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777170593, "uuid": "a63b6e45-713d-4868-85f1-99dda9830d51", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777170593, "uuid": "88cb811d-7174-4339-b75f-ddab5d9cc778", "value": "tmp1E22.tmp.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5232b61-415c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777200239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200239, "uuid": "1f6fe583-994f-4324-bb40-61bf27b88652", "comment": "Malware payload (Mirai)", "value": "8df9469d147ead70996acd8c99feccb5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200239, "uuid": "fca5e2f9-5c96-46b3-9148-d4349460eb76", "comment": "Malware payload (Mirai)", "value": "f44a1ba5fcb4a478430c8148dd1f197d56959e58a16058096f8c88710942ac26", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200239, "uuid": "0b23dee4-e268-4739-9b1d-9289ecb71fca", "comment": "Malware payload (Mirai)", "value": "983bee03217be833cff7407166f39bc685290def", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200239, "uuid": "71aff688-b1cd-4ac0-9cbe-c684c4b4c545", "comment": "Malware payload (Mirai)", "value": "312d5dfd6b628e4a129f6d6fdd25170fb9575d965dca555bcde6a45f62ab2b97fa0844c21fd51c3a2a3663eb46f402c6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200239, "uuid": "9821482a-d6fe-4d0c-bdd9-ae86809e3958", "value": "T183131742B3180547D1631EB0353F47E1E7ABAE8122E4F288760F9B4DC171E77A946E9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200239, "uuid": "2b7c6f0b-763f-417a-a56a-2a8fc654f8e0", "value": "768:TuZQBal6xzFogyxBvDMjccDP1UqI9XFPTMey6/janpyvsM73V+Otauo:T0UFogW5DMj3DyqWPwey3nYx73V+uaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777200239, "uuid": "5484c241-9a26-45f9-b91a-dd1c7c5cbda4", "value": 44168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777200239, "uuid": "e469b935-3da7-4084-a80c-f83fdb882460", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200239, "uuid": "4789d16d-5936-453a-901a-c95948662b20", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59dee072-4161-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777202180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777202180, "uuid": "101f8cbb-e6ca-4f6d-a64a-430ae6817c16", "comment": "Malware payload", "value": "7601ef1fcde7f8986a1257c442f9ffd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777202180, "uuid": "55c905fc-b439-44e4-888a-1a47b21e2002", "comment": "Malware payload", "value": "f4a7dab709cc0a7bed72bc5d55aaa9f9d504759ca14ab542491e05284e02c503", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777202180, "uuid": "50424614-b46a-4c04-9a85-2315791f9558", "comment": "Malware payload", "value": "ea3323a8be0e1444bff7c38ba4670278867e9dce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777202180, "uuid": "ed3cbe5c-efdd-4f4d-ba7c-7bac45e23e00", "comment": "Malware payload", "value": "57ce847032976755c311a1cef720042b4d3c8b46e1fe0feb79bb490d869c30383d27f88f4c3a827e600f564bc336c4f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777202180, "uuid": "532acb64-5d9d-4a1f-9f42-4a65837ddd57", "value": "T1EE46BEC0E52ED025EDE1723DA4D3551BDBB86F602221F4E725E8ED2BC10B585FC6AC29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777202180, "uuid": "6d725625-9d95-4b32-9de4-84f89bb1f493", "value": "d4d8a548490910c2e9bccf34d2b22d32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777202180, "uuid": "8cb92406-eac1-4858-8628-5656df51b7a3", "value": "49152:jFm/ZhGYUi+/BDsXLtjxBMNJEsBMnk5Q/TS9QwXOcBwVQ:hrv6btxB4akJ6xc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777202180, "uuid": "93b8e74b-5249-4b40-89c1-7de70d8e6c11", "value": 5470720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777202180, "uuid": "3be8f323-0827-4a4d-b0eb-64ce54c1651d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777202180, "uuid": "d11bd3cc-d5d5-4e8d-ad07-92d27f1f6562", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff00c14-4171-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777209250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209250, "uuid": "1c9af654-9879-4931-8f72-cd34d8dd9c38", "comment": "Malware payload (Mirai)", "value": "9b24e6dc096d7e69089e13f5d204b005", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209250, "uuid": "3bd57462-17ce-421f-bd23-e0a2955fb53a", "comment": "Malware payload (Mirai)", "value": "f4dd308afa59f568c311567b607d2f4aada56fe51b73d0476af6d2fd329a7c0d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209250, "uuid": "d09e4edb-0dec-433a-9a8b-773fed4e7787", "comment": "Malware payload (Mirai)", "value": "d5666f1f77710a8fc93f5f226856152f6daadf70", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209250, "uuid": "84379e03-f12a-4967-82e3-8e9b4708a557", "comment": "Malware payload (Mirai)", "value": "49c66ce7f13799c95e95e1be2e886dc6aa1495be7c2fb2b4455b72dac693f59b67090f1e9fef4ab852a9aa9638a78a82", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209250, "uuid": "5e3c8163-5c4c-47c3-953e-a34eebdbcd37", "value": "T1B332C517A7BBAE1BC4D037770193072162E99F916024472FBD0D1C8E6E9B3412D3EBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209250, "uuid": "9c7deedf-7288-45e2-b058-8586c29b2527", "value": "192:xvrOR1CQOsz1NxfAzMH9iG0GhWaDpU/O7Q89AGSyb/qeif:xvrbCzfaM2GwIU/kwGScUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209250, "uuid": "b5380ce6-9ab7-48c2-98fb-3d284fe2aec3", "value": 11024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209250, "uuid": "7c539251-307a-4e23-a8d1-b0cbacfcb28f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209250, "uuid": "17e8037f-4872-40ca-b354-3e4ed25b9e20", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "861f4fca-4172-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777209555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209555, "uuid": "789b684c-83b0-428f-9aad-a597287e1fa4", "comment": "Malware payload (Gafgyt)", "value": "c3c55561cc50df44ff4178b41518ddc5", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209555, "uuid": "3d405705-bdf8-4595-8217-550a5df8e882", "comment": "Malware payload (Gafgyt)", "value": "f6faf5e24fcf99b12d4c16d3435a5adf35e8af5c7f52db733afb40797289205a", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209555, "uuid": "a20e2d43-3654-41fd-8154-2bc79756ee18", "comment": "Malware payload (Gafgyt)", "value": "5106a1a1f3329771e03e6ba4ab1332ccf83558b1", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209555, "uuid": "efae633d-81f8-42f1-adf8-3386ea922c49", "comment": "Malware payload (Gafgyt)", "value": "7015310514446d9da6825baa3ca764cbb7758d45c9571ecccf4d285a57ea364ca307f9ae8ee7f3c67b4b85cc0731a97e", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209555, "uuid": "d3113341-583d-4c24-a327-b8ed1a3538ff", "value": "T186443956BD419F17C5C262BBFB9E839837166B78C6EF3102D9246F60378A49F0D3A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209555, "uuid": "3ab7ce2c-0e3a-4a67-8c1a-0d585173bd49", "value": "6144:OiRvY4QpAmdZL2s1fNlwkLZm8OA4vGXH9gX0qjPMAeJ:OQIbfNlNXOA4e3mX3heJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209555, "uuid": "29a285a8-53c1-4a11-b632-d7534810cabe", "value": 267296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209555, "uuid": "d3ce5879-80c1-479d-b4e7-4f0700951a0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209555, "uuid": "f0da4161-ed04-4cba-adb6-a82213ecc244", "value": "redis-conteinerd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d980ed5-41b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777236921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236921, "uuid": "5b14eae6-7d00-4355-99db-f2bdfaa16525", "comment": "Malware payload (Mirai)", "value": "a535a32090c3fe61f7fdacaabf069e2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236921, "uuid": "212b150e-96f3-4e88-b1cc-c5a7077e23bb", "comment": "Malware payload (Mirai)", "value": "f70b99c1a8060becda612c899812227ecce30a80a9de09c0a790a31c11652775", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236921, "uuid": "3d9478ef-c858-4752-88f0-2e1a897e8075", "comment": "Malware payload (Mirai)", "value": "29d6fd04970e3dad6950e98e45f00e3b1c780703", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777236921, "uuid": "f7797503-376d-4db3-a18d-19828c287edd", "comment": "Malware payload (Mirai)", "value": "f47c7abbfcf917da532976354bf51f105e7a59b2d424fe658ab5125b273d29dc6894e7df067dc5b24ed44832e3a2c3ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236921, "uuid": "84789fe6-b68f-4dc1-96c5-3ee8bff59b74", "value": "T19903E13DC6432CA7E97AD9311D5AAAE1B3661BBF3279CE9261CCAF71107B079301418C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236921, "uuid": "b20c8513-16dc-4c10-a5c2-ea93aff52376", "value": "768:3PnmN0QMZLMR7rD8SYkwjK/15uV/lV8dxJ3YBHne42O4mPF54uVcqgw09Y:3PnJ9w1r4fevuxlV8t3YBHe4WMD4u+qZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777236921, "uuid": "58e1e954-847e-422d-a128-e34b9decae83", "value": 40956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777236921, "uuid": "fc09ef02-1d99-432e-939f-00ab4ca3e1ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777236921, "uuid": "95287e1e-81eb-413d-88fa-1f231c460347", "value": "023782pler.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "139163ff-41a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777232556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232556, "uuid": "6d77b0fa-670f-4036-9073-3a689b391b86", "comment": "Malware payload (Mirai)", "value": "450ce2fd3f04b4c2779d8daab25e6c06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232556, "uuid": "2f774fb3-b8a1-417d-8dfd-8f7161cf00a7", "comment": "Malware payload (Mirai)", "value": "f71b9c73b05234ea6f05d7be8aa38271156ebe2adbcadda647ef30d961dd29cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232556, "uuid": "b81fe17c-0f9b-472b-b7cd-385ad33aab52", "comment": "Malware payload (Mirai)", "value": "2cc3870f1e953a2f12d5e3dd9d04df12bca85ecb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777232556, "uuid": "40827cd8-e7c2-438a-a548-85aaa265e7ab", "comment": "Malware payload (Mirai)", "value": "eeb7a4f54a4e95e744f7255cb0aa34d4cbdb1b68217a0f4c3c94da1328cc1901b8a777403d5b67bb26e88302b4242a9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232556, "uuid": "d97e92f2-318d-4cdb-85d4-d785ee81e0ed", "value": "T1A5D3F948F951972AC3E373BAFB4D468E36231FD8A3DA31358E309BA023C17D52975925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232556, "uuid": "78a82c41-4703-4826-83af-2015c5efc2cb", "value": "1536:ninpEzfpTvQ+h0Pzx1dWxsoc9Jmd95mg2iYbqVanWC761VRMCBiAX8PjDg7D/V57:2Spk4sJ495mg1Yb8anSX8PjsfV99sMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777232556, "uuid": "42d23714-5702-4427-bdd1-416ab54b783e", "value": 131700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777232556, "uuid": "f3eee1a7-9f55-4a99-abda-507cb8c905fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777232556, "uuid": "3a3c41c3-0d1e-41b5-9f04-de4dfbf08b51", "value": "shabak.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3f9d7d-41c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777246856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246856, "uuid": "af06be76-0e7f-4e7a-a0de-1703d3be2cea", "comment": "Malware payload (Mirai)", "value": "46d48942057c477d0d4e72a5500e793f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246856, "uuid": "b805281e-8069-40ed-9aa0-5a94c239129a", "comment": "Malware payload (Mirai)", "value": "f8806bbbdb7ffabbec4a1144869dc7cd87deeedb54b7994eca09c215d7e92d52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246856, "uuid": "e75a8c82-2268-45e4-acce-fb5e424ce340", "comment": "Malware payload (Mirai)", "value": "63366af21677d0eb9054c9e4e86fa18b0e81820f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246856, "uuid": "cd3bf6e6-547c-4eb6-8dbe-ca4b96e41cf7", "comment": "Malware payload (Mirai)", "value": "59db4bc83dc1b928f3a9fe60dabac72b3b8261000d32de0ce260996996bb158475fe3b14f23ac3776c59e6e50a19e2cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246856, "uuid": "1166c77e-b7ea-4711-aa8f-a54347855071", "value": "T18CF33C467D51CA23C6D127BAB7AF4198373167A8D3D73302AE187F742B8669E1E37201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246856, "uuid": "b254ba6c-f1aa-4656-bc7a-a1c7b2aa38b4", "value": "3072:qMe6Zli5ZemH9Ucr6cpr2hzqgfB2gXpllZLh/XdVyL2:tZc5LbL2VXpr1h/3yL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777246856, "uuid": "526f38f9-cbda-400e-b46e-86a33af7b1ee", "value": 167218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777246856, "uuid": "d649e119-6026-4ff3-959c-2fbd7a51a2d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246856, "uuid": "c6472168-6238-4905-b78e-aa9c91dc8e15", "value": "Yboats.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2135e459-41aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777233438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233438, "uuid": "11584d8c-1014-4c92-9d2e-602dad51c9b8", "comment": "Malware payload (Mirai)", "value": "57fe8d7bcf138f39dcc69b2944e9a9fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233438, "uuid": "f7dad3f9-081e-447f-ba5a-726b20626c97", "comment": "Malware payload (Mirai)", "value": "f94377e3e4a4bb4deef2b7efc0e07a31caee18769853fb54793b67d1a5ee3e6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233438, "uuid": "2b961772-6152-4bb6-9b06-1ed78d53b0ae", "comment": "Malware payload (Mirai)", "value": "ed03603fb619382f30ab0d4e3e7309da5c2da67d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233438, "uuid": "0037165f-fe30-43a8-913f-0c7496f8bb96", "comment": "Malware payload (Mirai)", "value": "75622ea0360336b5c3a54e023bc25773952f8db7a9dfb24cd0ee7552e5fab68365851effb13f0395debc17a0f18c341d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233438, "uuid": "56ac597f-75d9-49c0-9482-8f68287b0c26", "value": "T11E837DC5EAC3C8F5ED2209351272BB275AB2D03E2268EA83C3A5D975EC135C0F556B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233438, "uuid": "9853b216-6ad3-4995-bc12-0cd5c184c517", "value": "1536:1WOLMM5Md2foNG7eHO23tAjw19KHVdxYQ5eBP:rLxMdiJ7oOEti+9IYQQBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233438, "uuid": "7a34cbd9-c1b4-48be-a724-51f3691bab8a", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233438, "uuid": "75865ff3-337c-4562-a36e-c59a16e780fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233438, "uuid": "668a1464-7076-4d19-b6dc-5ac1934643c9", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cebe04ea-4171-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777209248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209248, "uuid": "698bb858-205f-443f-bb8e-c75f871a1afa", "comment": "Malware payload (Mirai)", "value": "3780e9cb10765b18696d941e92252749", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209248, "uuid": "cff71587-22d1-4c11-b457-8aebb5731c1c", "comment": "Malware payload (Mirai)", "value": "f972f06b4266baa3893341d36e430b37b069c8d01c0c551b883bdfb44d1b3405", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209248, "uuid": "5b616f49-1a65-42ec-89b8-0c7357440493", "comment": "Malware payload (Mirai)", "value": "27315c733fb35ad359d8310bcc10cb0d9179633a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777209248, "uuid": "31ca4df8-ae7d-4c61-aca1-06fb7b96665e", "comment": "Malware payload (Mirai)", "value": "868f2ffe2418a3282df7e5e95b492b7c5af0f3f5d8b413c3564da7330fa365ebfbe04c58b845d15b84402eecc005e4e6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209248, "uuid": "6b42c8a0-270b-4018-9364-8db2c13ca7ad", "value": "T1A9B30945FC505B17C6C652BBFB4E428D7B2A1768D3FE720399256F30378B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209248, "uuid": "dbfb1031-f448-45f9-b7a7-cbb8764ed954", "value": "1536:jUK9yqnU8vGRz4VA4j6T9y28Ty6O5FtZpqQcZlCtwywXvqcVuafhPeA45Zvk:QixnUHz4Z+5ypkn3E8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777209248, "uuid": "f4d31673-64a9-44ed-88c2-b2889704dc1c", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777209248, "uuid": "beda2ec7-0fc2-4345-b69c-66053f364e06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777209248, "uuid": "8bcebe6d-5848-427e-a1b2-a338426870bc", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a33fba0-418d-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1777221132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221132, "uuid": "3fdbea82-3813-4788-b363-f8d13853b06e", "comment": "Malware payload (ValleyRAT)", "value": "59f3ac42964e54f6f150f0ad6e70c538", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.aaa", "colour": "#884164", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221132, "uuid": "8a53e0f7-276a-4518-b17e-750f59a4f81c", "comment": "Malware payload (ValleyRAT)", "value": "f9b59bc02214ad721121068b2a38719871c239a80f9e78ec0e5bed59fb6bce0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.aaa", "colour": "#884164", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221132, "uuid": "e7bb2a8c-3f79-473d-8739-6b9a6f9269c4", "comment": "Malware payload (ValleyRAT)", "value": "dff7b11d1d2e7c0140545af9bf70be74654e150d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.aaa", "colour": "#884164", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777221132, "uuid": "3f99a67f-64b8-41c0-b5cd-b02ad129d54d", "comment": "Malware payload (ValleyRAT)", "value": "4ff1c816fcfae2ad54373516a50261a7c46695321b1929c925d07375268e091c7f944c519321b3e43b1fd4b1be58aeb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.aaa", "colour": "#884164", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221132, "uuid": "27fd3c80-8f8d-4867-8b15-d1fe733a27cd", "value": "T18C08333FF1576B26D13D807B29E7E6242C3B4A7B69824E13B6F4D4899F80025783C697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221132, "uuid": "02a27cea-ec31-4359-9a4c-c130810aa304", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221132, "uuid": "31a07612-6fb5-48d9-85e8-d58fb6900749", "value": "1572864:i7Btv5hPZ8idvI+iLvlUUOwsqAU0bsDupCSnokWwECu+EH:i7Btvq/JdUUOFUysCISnontCuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777221132, "uuid": "2ff18d69-e235-41c4-a14d-2b4eee7ea1a1", "value": 84304803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777221132, "uuid": "870b3c99-416f-40f6-8dbc-c403742acb3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777221132, "uuid": "f10371b6-0ec0-4fe5-9176-885bf2135741", "value": "\u6e05\u7eaf\u751c\u7f8e\u7f8e\u5973\u5927\u5b66\u751f\u7684\u81ea\u62cd \u7a7f\u4e0ajk\u5f88\u8bf1\u4ebarR15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fc57f0-410b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777165295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165295, "uuid": "712aebf1-3543-4669-bfde-2258d163e858", "comment": "Malware payload (Mirai)", "value": "22d72d140dfd605751f2aae30ab211e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165295, "uuid": "7a64f7a5-d610-4ab5-8bd3-a96f5c599088", "comment": "Malware payload (Mirai)", "value": "fa58dba2bfe6c3c437312ed91331ff96e67c46234816289878342dcd42a54b94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165295, "uuid": "0129eedd-77c8-4e5b-a84d-603a79261888", "comment": "Malware payload (Mirai)", "value": "002d1d35146c182ac9a276ee1229b30ca769f302", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777165295, "uuid": "10b68d6b-c343-4b05-b6c5-966ef22c3e19", "comment": "Malware payload (Mirai)", "value": "ff337304b293338d0bdc95e2c0c107f50623af5999f92dbdc2b71dd7f031cb67a66f1ba41f3e4718b3941e3bf107987b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165295, "uuid": "a6744c7c-84d0-4fe9-ad98-65d8d86ba03e", "value": "T1FA042A46FC809F27C6D2167BFB4E428D37261768D3EE720399215F25378A95B0E7B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165295, "uuid": "43e87802-0705-4f1d-a8a6-9a139f2cbefb", "value": "1536:SL0OCngLs3uLbO0JSf0xiBZB20TOFPvGT1D63IPwkrlADJMYaKPNi8ITP9lsM1aZ:S6gy0J5tmt64VA6+PcrJlPM4eoxANhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777165295, "uuid": "d75328a2-e6be-4a91-9a68-ec3c98a69c78", "value": 184976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777165295, "uuid": "0bb440ae-20fb-4719-9cd6-211036b28f59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777165295, "uuid": "fe268fab-b543-40b1-bcee-1b15575cf7f6", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55db6fe0-41c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777246840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246840, "uuid": "8368f32a-c577-47b5-ac74-31697131a597", "comment": "Malware payload (Mirai)", "value": "0e222a78a1962ba7d15232efd0b5f954", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246840, "uuid": "f70f8eda-bcec-4c04-b4a8-e0d84f39107f", "comment": "Malware payload (Mirai)", "value": "fba24989b4e06f4e9ceea864b1271fd6e6759cecd3d086195c8cbb63a082e89b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246840, "uuid": "73b7b3e9-86f5-43a7-9ec2-a51bed1f778f", "comment": "Malware payload (Mirai)", "value": "6726644728f7f256c616a87bf4b2ea880751175f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777246840, "uuid": "ca807bde-8e35-4849-87fb-63333d84f822", "comment": "Malware payload (Mirai)", "value": "fdcf75b192ac67ded4fc5e3938a47aaef90e54fbc82cfa897206a6ec90ff36a91dac55347a9b98cf815ce5ea3d91e5f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246840, "uuid": "b7bad419-d7cd-4e1d-9686-825ab930e3fe", "value": "T18FE35B027B184B87E4534DB419BF1BF053AEFD5026B26285F54EFE9D5231EB62809B8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246840, "uuid": "08080c4f-8ed8-4563-ba6b-cb94ab8d4b02", "value": "1536:Wb0hZXfEwBRjKIOxz54HYV493dFK+UHDa80rYOGs4+9Ui+fIvC+gr/BTdUXEvP4n:TEw+zi3BTaUYLni+fI6+SyUvy7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777246840, "uuid": "40de90a6-437c-4f31-bdeb-d63391223d45", "value": 146828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777246840, "uuid": "b47c5e54-83b2-4b65-a540-2d7da559bff9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777246840, "uuid": "4a54f521-7405-410f-9efa-cbd0ba19a733", "value": "Yboats.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7efe6eb-41a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777233369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233369, "uuid": "1c9f1761-3733-4141-8370-0c9940234a2f", "comment": "Malware payload (Mirai)", "value": "46d575625657dd2362eab445230c4024", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233369, "uuid": "c042ee22-589e-49f1-a590-9340a7180e73", "comment": "Malware payload (Mirai)", "value": "fcd36da75ec940f421b843d8cc85e949d43b46718e596d485e2548979f5fe0ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233369, "uuid": "ef045d52-d425-4514-8b03-fbc71a3f8eb0", "comment": "Malware payload (Mirai)", "value": "148ff4c74518c1735c80b451e72c27d724eda107", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233369, "uuid": "d690b682-319d-4ea2-9c8e-bb44298b9b06", "comment": "Malware payload (Mirai)", "value": "3d94c7e8e8b9a4615c363b0cfb828383773f6a71809a55fcf582b91afb0eba870c3db31b808ba4caa6557e09f97cf04e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233369, "uuid": "542352b2-be33-4816-8c77-fce9e3f0a967", "value": "T1223302C97F51C78CC92DAE318023E9CF64150DB3786B65FAC668C812542FC7A287ED89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233369, "uuid": "f1749868-4da4-4f9b-89b6-8d3aef9e810b", "value": "1536:/NRtXYi7OE32oRKM2PAcOYUJM89VoolUlE9lDQ:Vr7fmocrPAceiaVBUlEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233369, "uuid": "dc610d0b-f5b4-47d9-ad8b-8b56ef4dc921", "value": 50304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233369, "uuid": "18169802-c1b5-487f-bb16-1b174a08429c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233369, "uuid": "83802253-574d-4031-ae9f-c88f4c848970", "value": "luxzz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7602728-415c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777200189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200189, "uuid": "e509fde3-b7ca-4a0b-a689-4f06fa89ffbf", "comment": "Malware payload (Mirai)", "value": "f45647827f076facf8c0e942a3cd37ca", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200189, "uuid": "e173b099-1fc8-409d-8251-a6533aa0afc9", "comment": "Malware payload (Mirai)", "value": "fcdf088bda5fc8af705ecaea2c8e37f4575005548f3798847401d2a220d64dab", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200189, "uuid": "7650d7d8-b7df-498e-9821-753c0318af3c", "comment": "Malware payload (Mirai)", "value": "893ab203f92d1f7e33279f155c7d014b376d3260", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777200189, "uuid": "59b437f1-3651-45d2-92b0-25cb839402b2", "comment": "Malware payload (Mirai)", "value": "6c732fa46350f57cdb534d1501ec8bba0cedfaed3a541cc54237dd9a672491cb2e6ff66bb88d3e03d2bbe353cfaca3d9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200189, "uuid": "6018afe4-eadb-4951-8a34-15b2862d5815", "value": "T1FF1339C59A43C0F1EC1112F110779B519FB2A436AA79FB47E7A93A32FC02B1196173AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200189, "uuid": "b0546e5a-3092-4eab-a926-1d9438b01776", "value": "768:x73jOIDzzrq7WiEu+RiUjrekEx63a7x2Yq1z7yvEdTpKMxn:FjOAzwvEuP4akEgwjkWItKKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777200189, "uuid": "d5dc9d53-e6f8-496c-af40-6613724b1de5", "value": 41840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777200189, "uuid": "220cfd36-e152-4aa9-ad24-520ff4441d81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777200189, "uuid": "da758c59-3dbf-474b-8859-7e969130030d", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82fface4-41a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777231884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777231884, "uuid": "3b236792-e66b-494d-bda7-f9c1f1667d12", "comment": "Malware payload", "value": "0ad7ef909095d2f954acf97f2003ceff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777231884, "uuid": "41deb2ab-c6b8-4ce7-aed6-dd0bc52c09f5", "comment": "Malware payload", "value": "fe011785248f0b81d9b6cb501bd76b5f56cb29da8800510a6bb35c90b6cd3c14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777231884, "uuid": "ea8321b1-9a2b-4c1e-8e0b-53b560f677f0", "comment": "Malware payload", "value": "ab00e32149c1a5f27d141090512fde3163fbb5d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777231884, "uuid": "34ea5b2c-de75-4af9-8259-3f66ef23821d", "comment": "Malware payload", "value": "bc42fe144960bdda3cf5b52fec0729834374ddc3c87be48a70948aad2d919a0282dbda75477deb48b4f5e9e2f5961536", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777231884, "uuid": "f3743cba-7e47-443e-8f73-3f82c460ddb6", "value": "T1A1756D43E2A324ECC96BC134866BA773BA31F8645135BFBB8594D7302F13E902759B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777231884, "uuid": "2768c324-5f2c-40c5-9ef9-f9cad7324ad1", "value": "00d60e2c1f4b2631c11bb0ac3ba74ec7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777231884, "uuid": "2c8c1fd5-d439-45a5-8c91-a947e6fcb7fb", "value": "24576:0kiNcdV+3XBYFu03zs80lJcLU/oxquq82z5P/w/FDFCygp+Op5O8S:fiNAV+3RYFuWsx1eq821wRInp5O8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777231884, "uuid": "1c5ed9e9-1d10-407c-a547-aca31f093c77", "value": 1687491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777231884, "uuid": "ecf37e0d-6e9b-4c2a-bb60-128614b9f414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777231884, "uuid": "cadb3bf4-bd5c-4c9a-a39f-0c6e0c60a132", "value": "SecuriteInfo.com.Variant.Tedy.893733.16455421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a97fee-4189-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777219383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777219383, "uuid": "c70427fd-8544-4aa6-8549-876dcc563360", "comment": "Malware payload (Mirai)", "value": "8e9c079b7848787884d3ffa6c4073aec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777219383, "uuid": "ffc462ac-8a9e-4dc4-8f96-eb2aa6e5166f", "comment": "Malware payload (Mirai)", "value": "fe66336b3c27575028fad800be8b9dbd760aee7956bbf8b06165d5dd52b2b5f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777219383, "uuid": "70218118-4fff-47af-95d1-590a98e4cc08", "comment": "Malware payload (Mirai)", "value": "51e90065aca7defbc9b2aac44ecdfd2c26e8c596", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777219383, "uuid": "b7749508-b910-4aea-8f73-d7ca051d2f71", "comment": "Malware payload (Mirai)", "value": "a0f7f257ed17542069b08755fdc1d2dbf1dde7178191f092db09960e5ccee5a5782a4d1c74d8632c6e632d949586bd44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777219383, "uuid": "18c60677-e144-424c-a48b-354ee9c1a8c9", "value": "T176158D2EB2B3B5BCE00BC03457DBCAA15535F07522212DBB26C4DA353D6ADE11369B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777219383, "uuid": "7b707364-9f7a-4d3a-b1d5-1ff1490976ac", "value": "12288:Pe0MlaNgenARxBcId4HDowN3+SOlmE/GCOw3WUpcubh5y1qoqBzayUHjAdPHX:G0yaNgeARxQTObAsTpcO5yOsjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777219383, "uuid": "c539321c-0cf2-4243-a7a3-4be9ad69548d", "value": 957256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777219383, "uuid": "26fa6cec-ebb1-45c2-9e0a-dfd4ad7e16ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777219383, "uuid": "f50a0d5e-52be-44b8-ad41-f7af81d8f7dc", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6dfe39-411d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777173247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173247, "uuid": "5c3d975e-eac5-42b1-abfe-14e9edb12328", "comment": "Malware payload (Mirai)", "value": "a4222724bc76fac74add24862d71965c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173247, "uuid": "415b5fcf-4a28-480f-9369-ed98d64c4e9c", "comment": "Malware payload (Mirai)", "value": "fee25ba3579b250a0af55ce389c029d339c99e212bdc34ac19e96d1573a409a3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173247, "uuid": "0315210b-6239-44a1-81f7-2339de4ff170", "comment": "Malware payload (Mirai)", "value": "da82883872ffcf863b74975d7b184c0b9e7da47e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173247, "uuid": "6521466a-7f6f-4da4-88b1-697a648b9551", "comment": "Malware payload (Mirai)", "value": "ea0dfe6593dc95685bdb10f5f51083ffa7e53800245aa2868b4502c4c0a67e7d8fefab6db689cf948de6b53fb766e795", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173247, "uuid": "ce1cefca-a956-4e03-9afa-7a4ce4f21614", "value": "T105A2C018C3C86FF4EEAE5A34AD92D1D13BB58E9732D6E8B365DE5B112502007B349DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173247, "uuid": "a556392e-8abd-4b24-a502-ac4b56a47741", "value": "384:9/JywWc84Tp2YshxqlDqK6Y4+Bq6qoP7nO3Ynaf2ayM4uVcqgw05VxJG:9RxsSVsMDhX/BxqoP7Weaf2ap4uVcqg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777173247, "uuid": "14f24ede-663e-4607-a02c-96fa93b74d46", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777173247, "uuid": "5c222c22-5e27-4dd1-80a0-2826bef8e005", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173247, "uuid": "5d6dacb5-f794-4e5a-8bf7-f7e51b626b0f", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902f3dbe-411d-11f1-a769-42010a9c0008", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1777173065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173065, "uuid": "84de1d8a-275b-45a9-a812-eea5c57b5c73", "comment": "Malware payload (AveMariaRAT)", "value": "5a6bb320a4a30593ad7bea664e30dddc", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173065, "uuid": "899b7fd5-6e07-47e6-b572-8ab7dd71a31d", "comment": "Malware payload (AveMariaRAT)", "value": "fee959ff12e4ac5df67164ed83565a768d1286263bed759a32dcbe668ef6390f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173065, "uuid": "425ba852-0bc8-4894-b60b-bc05fa469f9b", "comment": "Malware payload (AveMariaRAT)", "value": "9ed959b538a81c3e07409f8351851c83a5076ada", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777173065, "uuid": "8479acb4-6769-4977-96c7-28fea8a0d7eb", "comment": "Malware payload (AveMariaRAT)", "value": "8dadeb5a81e841a8d881f28d029fa94a3d1160b76f18c9a6b40af4bd03754b37f2096c4c432a159b6e73e80c3b101cb5", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173065, "uuid": "d9a5eb65-752c-4623-aca5-400f113fc86b", "value": "T1A2E37C327BE188B9E6F6013109F53F398BBDF53111208AAB63905A468D37ACDE955783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173065, "uuid": "69458ca0-5992-4402-ad77-0fcfee7444e5", "value": "b9494f92817e4dfbe294ad842e8f1988", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173065, "uuid": "a7d7ab85-37ad-441c-a291-ab44ee5492ae", "value": "3072:4NLOpnhTdOw9YAJOzIY9gVl01T2ENipdDg0z5:4NLYdT97JSIFl0QENqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777173065, "uuid": "110dd8ee-ccc2-4be8-99c1-4b983408b8bf", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777173065, "uuid": "91832e0f-ae7b-4390-89ec-cc038e84f02c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777173065, "uuid": "b9d25e8e-9423-4a67-b2db-d86ea126937c", "value": "yxovtb.za.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16274845-41aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777233419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233419, "uuid": "3575a7ba-c45f-4e37-bfa6-6f2edfa55cdf", "comment": "Malware payload (Mirai)", "value": "2a13c209238b72b213b001ce2f57efa6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233419, "uuid": "8f76aaac-fb89-4170-9250-6fa8e98313ef", "comment": "Malware payload (Mirai)", "value": "fefafa1febb5026e8e4bd110e1b753db25f3ea7152ff33f419f5338073411848", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233419, "uuid": "e78ac616-ff5a-4860-99e5-adff15f84cb6", "comment": "Malware payload (Mirai)", "value": "df782e21dfa042ee0b568c539b9de49298b0d386", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777233419, "uuid": "ce34ab46-024b-4b5d-b998-1afd31d10d3e", "comment": "Malware payload (Mirai)", "value": "ccf6d3dc37d7d0af3356974778d4a1b2b0e466dbcaef4b3c57c24c20cae33379ce84a2a6f50a2338b74e8c5e2debe07e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233419, "uuid": "1709a9a9-9f93-47fc-b7a6-59daf9d63661", "value": "T18C933B45FC919A12C6D5137BFB2E228E372663A4E2DE3203DE156F22338659B0D7B741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233419, "uuid": "30bd88e7-4b6c-49dc-92f0-689d9ea92307", "value": "1536:lOV4HFG59DYFVayhwnb8pPRLQ0YeKXffd6bqmv1v:lOV4HO9E/VBpPVQ0+Pk1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777233419, "uuid": "d4ed3523-6bcf-4c5b-9b80-3b8a77819147", "value": 92248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777233419, "uuid": "acf0c01d-53b1-4978-a296-ac32521362af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777233419, "uuid": "071be4a1-70ac-4fdb-aef4-2b3a401ccf59", "value": "luxzz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }