{ "Event": { "published": true, "date": "2026-10-05", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-10-05", "timestamp": 1791244982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "bfbf7ff7-2b6b-4aa6-97ba-c2ca830e69d9", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ceb3ff-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791190554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190554, "uuid": "0e3b39aa-d36b-4170-996a-04bd472a6cb4", "comment": "Malware payload (AgentTesla)", "value": "b8218dd5ae4379ddcdc2d3e086385033", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190554, "uuid": "b4d9b244-2894-4ecd-b5cc-9ceb07257976", "comment": "Malware payload (AgentTesla)", "value": "000c5eb2d2c402fabb4a8f2f4efc14e32d1c1f86a6533e0bf67413d13950b965", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190554, "uuid": "6e9b9240-6f1a-4d96-ad08-228b648eb7bb", "comment": "Malware payload (AgentTesla)", "value": "e82075f2600390827bf24234b21d4a5f7e82189c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190554, "uuid": "390ab673-3e17-4aa8-a719-95b82790a6df", "comment": "Malware payload (AgentTesla)", "value": "e40fb73df84508d2c38d945a12fa985a0ce660861b9f317c2a7bf8564ca8124d7746aeb80cbcc387b49f6ccfeea4a65c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190554, "uuid": "a718cf50-77e0-4882-b399-fa7269ecc72a", "value": "T1B2E5B37A1398D932B321AB4DA635D820548AB04338C5DB3532EDF215372CE5B739EAD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190554, "uuid": "399408a1-e871-4f1c-8df3-4e9359778e9f", "value": "98304:Y4A1Wkj1euttd/M8RR7SBsqjI384z1aAeRKsTOxTljJCS62u6j1Fo:Y4A1RZXFPajI3Fa1YljMS63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190554, "uuid": "0f09e927-b109-43df-aa2a-240fc7141df1", "value": 3266904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190554, "uuid": "df190826-e40a-4891-a220-5c937bb80f6b", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190554, "uuid": "644bace6-4b88-4570-ab03-7170db700820", "value": "SOA SEPT 2026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4014603-c0de-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791219789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219789, "uuid": "c7754828-a263-424d-91a0-d23263df5e41", "comment": "Malware payload (Mirai)", "value": "7cf0a1078ec02e83ac0cca445e695af2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219789, "uuid": "e5ed12d4-1fe2-4716-adf7-9ab427886c54", "comment": "Malware payload (Mirai)", "value": "00dce3f0aa7f31a7281e12da8a7d9bf3d427cdef43c7c917652ebebcf35aa7a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219789, "uuid": "8f5acfa9-644b-45d0-94d6-a9b909fa36dc", "comment": "Malware payload (Mirai)", "value": "5841926089b8ca15f5e040ec74d1f0ab7eba4e07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219789, "uuid": "dca9dbae-bdde-42a3-9c94-623ab9525489", "comment": "Malware payload (Mirai)", "value": "55a01d8b09f20754eea0471f60ed3c9f757a16c603a88b575f22b0a4831e490181bedc6b77411f78aa9c9e5078261cd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219789, "uuid": "8e4747de-2169-435f-a87c-ca5fb6c3493b", "value": "T193D45C66BC919B90C5D149BEFB6E437C72035B79E2EFB106DA045FA06BC98950F3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219789, "uuid": "1d3c98be-cc7b-4718-b6db-5fa5beb4298d", "value": "12288:4+RQ++jQ/B8RyuWQ8WOytkKfEiaYjN5kMRNsPiT:BZzQr1DpvRNsP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791219789, "uuid": "59bcd5ac-3fb8-4f56-9109-b88820a5a9d6", "value": 652572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791219789, "uuid": "0340053d-5091-4021-ab70-e6b5054ddc72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219789, "uuid": "c6a4cf85-ed15-42ee-8d68-a2d1758db603", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9cc398-c0ac-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791198280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791198280, "uuid": "15118d80-df74-4dc4-8834-2de745bd454e", "comment": "Malware payload", "value": "678f497b3a7b75103593d696a8e2c7db", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791198280, "uuid": "742f6944-6a0e-440e-bb91-01f74ff2d6a6", "comment": "Malware payload", "value": "01c644aa76c644e78f559f2b4b8d1580c2334d821c79e0de222da56d5a96ecaa", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791198280, "uuid": "7ca3cd80-6933-40c7-8ce0-38bf313ee113", "comment": "Malware payload", "value": "1829b60eea6a98c66d85889e82e740a235735a3b", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791198280, "uuid": "146a9fbd-068e-4e57-9680-0d2813c8e5f4", "comment": "Malware payload", "value": "12dd884555716d2b90cec29fe84a3cafbe457a482f5ff2d95f0f7e28f4c6b960794de6d5b1af85e922af1f65a49fe7f3", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791198280, "uuid": "c2419854-c421-4601-81ca-a47e52de36df", "value": "T19807D5037348419CD867E370C4B16E6522B03D9E8A347BBB9EE46EA45F163957FA9F00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791198280, "uuid": "ec1f70b7-97c5-48fb-93a1-2a130d944a7e", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791198280, "uuid": "7023c69b-b489-4b8d-881c-768bc05ab2b1", "value": "49152:x3jgtGW5dyrPVOrnFGrluruKAPUevnZtDOIlHtLVLrsZRJw3IwI8qSbJcGQ5nIIx:6dyDXP9NIkA5kj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791198280, "uuid": "3dbc52dd-160d-4f72-ac5f-e91c144d800d", "value": 17132912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791198280, "uuid": "6b5a8667-5802-484d-bc3d-4971e58df893", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791198280, "uuid": "893c5583-dc0f-4d95-afa2-d0fdab3716e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d116541-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (SliverFox)", "timestamp": 1791190383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190383, "uuid": "f487badb-ba76-4a74-adb5-a89ee2db9753", "comment": "Malware payload (SliverFox)", "value": "ef5ebe165dc61a588e448f5a045f545d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190383, "uuid": "69591fd2-75f7-40f4-bb49-38f9d5783792", "comment": "Malware payload (SliverFox)", "value": "01c6597a9d807338577300a4c861509021b161784c7997d70e4bd44d4da2c059", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190383, "uuid": "d4e78940-2557-4883-a77c-85f618f89474", "comment": "Malware payload (SliverFox)", "value": "fb7fc0a4b77adfe1388efd7d08e113ee6abc142e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190383, "uuid": "6f5dbfca-8182-4be3-aed5-7668ba2ad3df", "comment": "Malware payload (SliverFox)", "value": "860f252ee57c2a3dd78d041c4063bfcfb61623f3f98d185b7cc7128073839a8a068b4ac74376ae8a239ce9e046fa796a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190383, "uuid": "21b62c9b-0c8b-4c6b-af88-8740dff828ca", "value": "T1A4A5D03FB28B653EE06A5A367A76A210583F7A6165134C16D6F4C88CCF251B01E3F787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190383, "uuid": "4f594797-36bd-49b8-9645-cb87cb8bd71e", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190383, "uuid": "7bfe704e-7d63-4a70-b004-99705d09e41d", "value": "24576:GXVrSLScusMmOvjjhzvLOSUn8RiUd+Sh97V6K8pmFH7BPNQ3ArPkBJultjK1nEmI:puI2h4kfoSL3rdf/rVltjkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190383, "uuid": "71997859-14a6-4ad2-a5b4-1ea1ab009de5", "value": 2177613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190383, "uuid": "5679f092-520e-4984-8932-6c31e2a91da1", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190383, "uuid": "60bb2df1-df28-406f-b95f-a01c1b85597f", "value": "ef5ebe165dc61a588e448f5a045f545d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c428ec27-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791216407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216407, "uuid": "644d4e21-5d0c-4174-8b0b-87331238ae8d", "comment": "Malware payload", "value": "df02595a19a6ba6b76bfac45fab52ae0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216407, "uuid": "61f68f1b-d7d2-47d0-b635-bf8f56f68d4c", "comment": "Malware payload", "value": "023cee2b64df9f9b56229fe5cf24b953b650c8b4d34746c5fad44266fb4c96e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216407, "uuid": "fe3a7059-97a2-4eec-b92f-b6be331db4b1", "comment": "Malware payload", "value": "f337558c5f6fb60f4afa42015a143af962bf39ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216407, "uuid": "3c9ef966-2929-4644-b233-c4466a287994", "comment": "Malware payload", "value": "332165f86bcaf419610c14b0b635e1ae2f5e310afc19bf02d655b459749b799e6370c49a6b9603b3b21bb7e8eafe2f0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216407, "uuid": "637632d0-fdc6-4027-bcfb-0912e8ac651a", "value": "T15A746C22B6A16F12DDE80231D5A9925C03BAA20DF677E72B13012179DCD731793D3E9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216407, "uuid": "2e4f1239-72a2-454f-ab64-32621c65160d", "value": "6144:xzxAfirkcZCl/oMFHpOeSbT13oDy/ia25u:Ts2KpgJ4O6Vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216407, "uuid": "bae690f9-664f-4803-90a4-ecf43a9b878f", "value": 337409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216407, "uuid": "db53606d-183b-4899-827c-436220f80cad", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216407, "uuid": "c47fba2c-3ff3-4c21-bd04-9d4aa9275a78", "value": "Noogen.Validation_6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ffbb3e-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218710, "uuid": "e0d757f2-6d6e-4ece-a99f-a765b378f4e5", "comment": "Malware payload (Mirai)", "value": "7eb90c87185430d05d318e7afd0ae8b3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218710, "uuid": "4eca8426-296a-422a-b8c0-0d3d8cc8094b", "comment": "Malware payload (Mirai)", "value": "0299597a0ef79c75cbfb77335d86115ebff420543174211be7e8fa9a1d0f3e24", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218710, "uuid": "fda62c78-ae4c-4dc5-94f9-1ded29cab2a1", "comment": "Malware payload (Mirai)", "value": "fb331ed26d8a3c660005b2d190f6dcdc21fc7827", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218710, "uuid": "d3727508-5edc-42f1-b9cf-d066f893ff19", "comment": "Malware payload (Mirai)", "value": "24515139401702d9f7a8b44ba7841fada4ee9a542920fe599b15e94cc237f0cd7abd62cf8ed5c47c6988f886709500c4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218710, "uuid": "e3386c71-0351-4d76-8bb9-94bf96a68f2d", "value": "T13FC3E946BD418F13C5C321F7FBDE42987B166B6DD6FE7102A9257FA0334A4D60A3A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218710, "uuid": "8868477c-0322-46b4-89cf-3b460052a21c", "value": "1536:h6A5W32T1ALcG4VPaj7zDvw4onU0AvELZco6lPDwywFrZSkOvG31NDOxSu32dC:hKmT1e4sj/DvwCcLqfSi2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218710, "uuid": "d1d307a9-18cc-46ff-b6ca-65bbab2a4b3f", "value": 121588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218710, "uuid": "5bc68021-3d0f-489c-bd41-9d62ccee2bef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218710, "uuid": "ab7bce76-399a-4cb8-8b7d-74547183f20f", "value": "eclipse.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db2baa4-c0d7-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791216530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216530, "uuid": "63dc4f35-ff0a-467a-a4c6-c613b340c0a4", "comment": "Malware payload (RemcosRAT)", "value": "a4704f0e3a3ca3efc1078af02105d30f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216530, "uuid": "5f292b41-4a35-4caf-9512-1b509c126da4", "comment": "Malware payload (RemcosRAT)", "value": "034174f5266a4276cf29cfdb23fc3fa52699438ff60c8055b7df12c88341a49b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216530, "uuid": "c71d2060-27ee-4e85-a66f-a1560de7e2b5", "comment": "Malware payload (RemcosRAT)", "value": "6888baa9ec4188a3a11cf18a394e69e504743aa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216530, "uuid": "3fba2393-5841-43fb-8512-fd0057fa7f07", "comment": "Malware payload (RemcosRAT)", "value": "3d08b93ac3a20006132647d78c932c3a5cbf46363dccd8e33cd01904dfe5d24f15af87a78396d1211968728e41552962", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216530, "uuid": "6f20b32a-d478-4e3d-9a05-719bfcb08b7c", "value": "T1FDB4BF01B6F2C1B2DA7654300936E735CEBC7C21183699AB63D61D5BBD30191DB3ABB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216530, "uuid": "ea2418bb-f866-4ca6-9efd-99b81dfb7ae4", "value": "cd443d07fb22cc071cc33eee6cd16e2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216530, "uuid": "a9c83771-de68-47b9-9296-d492d1ddf8a0", "value": "12288:C97mmDmUefn1CvVkeClYRLwvcHk2c+IsPZOris:ClxDmRnkvVkhYHk2c+DZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216530, "uuid": "6c0069c7-1585-44d6-aa68-0fb492f80c4d", "value": 525312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216530, "uuid": "26aa60ec-8a29-4b64-ba20-0b6178b89acb", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216530, "uuid": "a5578c19-ba9c-458c-b1c2-73283afa1f98", "value": "remcos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b00ecb04-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791190603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190603, "uuid": "29cfaf7d-3ede-4211-85f3-d862453af938", "comment": "Malware payload (Formbook)", "value": "bc2eb154331ca20050e166bcb884358b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190603, "uuid": "6ca71a8f-079e-43c1-be7e-44dd84027d27", "comment": "Malware payload (Formbook)", "value": "03c2c65c8fc38236fb25e8222b7d47041a1aeb3697e3ea18f41e8f9b2b91ae85", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190603, "uuid": "de8d291c-7dc7-4002-a0d8-3437dc088c75", "comment": "Malware payload (Formbook)", "value": "9716e29f8d21a800208be15fd03d562f3072d7e0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190603, "uuid": "62f2efa6-709a-4013-b8bf-fb62b1ff3796", "comment": "Malware payload (Formbook)", "value": "2b5e308c2f071ee44e9146949bbd84cec282a75245dc046fe3a4b820abd5456d0aaeccb7b97a3ddaa29942789c508a87", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190603, "uuid": "9288dc54-b038-42a8-be5f-76c78dc1ec40", "value": "T18023FB444D81748423336B7ABB2AA8E5F77B0A6B0194490BB87C7494EFB1D18DEE4DF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190603, "uuid": "41d271f4-a603-4b29-8ffd-951ac0f99b13", "value": "768:OoT6s0rdUEVDLCi3yRB7eeh4bl3A69euqtZv9JPT+E3xTcxDp9wThIuq1bd1R/ey:OpUEVDLrW7I87+3yO0C7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190603, "uuid": "f45f33fd-67b1-4edf-a436-d5bbdf748ed0", "value": 49679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190603, "uuid": "44c7eb21-b019-4e85-9077-2ddcf25d09e7", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190603, "uuid": "62c55b24-e57c-4801-aa8c-7bab4a3d0c3a", "value": "ePL_051026_4850.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0c1861-c0b4-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791201525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791201525, "uuid": "54eccd45-c522-4879-807c-d7f8c08c9907", "comment": "Malware payload (Mirai)", "value": "e8ed75d272ae9e0b1ea6013c93549364", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791201525, "uuid": "e717c702-d8ca-40b4-a031-0fd35944a0ce", "comment": "Malware payload (Mirai)", "value": "0405294a4fa27c2d4466623b8549a339366e232dc3bf17e724975ef2cc200da9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791201525, "uuid": "aabca53e-4b80-44b3-aa7c-f6c96653b9ed", "comment": "Malware payload (Mirai)", "value": "cf689c5bd76f838287a242820ecd37096af58f5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791201525, "uuid": "a705db42-c839-42bf-8317-913f6bf84e99", "comment": "Malware payload (Mirai)", "value": "435437b78334ff7e4bb91fed84d00321c2a9237786a9d4ef8cb7a6592266a186a32876ab6ebbf7c61616716b21acfb01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791201525, "uuid": "2520fd0a-f8e2-43f8-8592-82242794227f", "value": "T19EE36CC2B783D1F1DD1246B53167EB369A33E93E411BEEC2D3B89C72A851460561B3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791201525, "uuid": "00237b80-7fec-4ecd-b154-567975be62e9", "value": "3072:Dbg/caBOK/y7a9BxjRJytJtSJ4CGjEcPnOG0DRyO697:DE/caBO/29BxjR+WWAcPA4f7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791201525, "uuid": "c2793450-04a7-417b-88eb-8680c6aaae9e", "value": 154412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791201525, "uuid": "2d9ca827-2faf-42e6-90d0-85f3a3541302", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791201525, "uuid": "34bda774-09b1-49dd-b225-4ce37dcf8316", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ab9080-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (ConnectWise)", "timestamp": 1791190525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190525, "uuid": "dd0fd749-4f9e-4cb9-81df-1012de90c79e", "comment": "Malware payload (ConnectWise)", "value": "fc6a98840bbe2ff4e3c818544a0961a7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190525, "uuid": "42adb088-cfd8-4cc0-94a4-0110b87aa7a0", "comment": "Malware payload (ConnectWise)", "value": "041619c550dd329d99cbb1b6f6bd5d3b06fcee2d26ddc0cecdbe45538182b0bd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190525, "uuid": "8e9dd8a2-765f-41f7-8977-222687084121", "comment": "Malware payload (ConnectWise)", "value": "1c0e1071242f8a351aac0bbea39930d69617ca64", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190525, "uuid": "2e63a5a1-a8e4-47cd-898f-342b47b96d63", "comment": "Malware payload (ConnectWise)", "value": "53acf16602d4b86eaa327598f20ec969bb456cddbca645b61ffa3fc01ce1163e9e059f877bfe40da9662d4a59443e933", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190525, "uuid": "0ce3944f-1f9a-4e5f-a75a-32f75f07a194", "value": "T1EB71DC2117F50308E3B76B39ADB7B5219873BD65FE32CFCE4090424E1962624D46AF2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190525, "uuid": "20b433df-b185-4374-a40b-60d2e75790bb", "value": "48:8ja+Zx28Yc0C8wVdsyAYiHYEC+m1cd00E2/XuH96BPozq4:8ja+YQ8w34YiHpC+iafudIPozq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190525, "uuid": "e50e720f-c1ec-48cb-bfe5-3062597b7ace", "value": 3592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190525, "uuid": "1c0f2439-eadd-4a8f-9de7-fc7a6a8ae693", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190525, "uuid": "2f65aaf4-06d3-4732-a628-ac12c5a06208", "value": "RFQ order list.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7828616-c08b-11f1-927a-4201ac107004", "comment": "Malware payload (Sliver)", "timestamp": 1791184173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791184173, "uuid": "c00553d2-42fc-4e7f-bb27-1165d4981405", "comment": "Malware payload (Sliver)", "value": "19a878708605994686c72a7dd3652d07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791184173, "uuid": "e6f08006-ce56-4f63-85ad-746ee12bd26e", "comment": "Malware payload (Sliver)", "value": "045e0dc95dbfa3ce9d457810c24751e95c8416762a4452e28ff29bde1c58f8f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791184173, "uuid": "265bb0d6-c0f8-475e-8925-4dcd4bfaaf46", "comment": "Malware payload (Sliver)", "value": "0b155f94bce42cde68d41230f5f59bd3fc46dbc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791184173, "uuid": "d85b6936-0626-4d54-ae96-c3ec29ed6b17", "comment": "Malware payload (Sliver)", "value": "cc85fe0c10fe8efd023cef34557a3a0cc6d5487a426246d0c2b59eb734b6d191d994b475d43e3f80704a8b82cf8c6d5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791184173, "uuid": "70fceb75-1a53-4b7d-829f-02badbc06bf1", "value": "T1E5835B0B229254F9C55FC274C1C7CB31AB32F86605307B1E2DA9E7312E25FA09F6EA45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791184173, "uuid": "05f5fdf8-c279-4b75-8a5d-cd4efa25ce24", "value": "574357db2a72a38a96c69f48b58e64cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791184173, "uuid": "30d22c78-7123-4be5-a7cf-76f622dbc1eb", "value": "1536:GDb8bX/S59Aa4Qj1wTGGSgCHXOvBO9L9scy+HAFkN8v1:GaS59j4c1DGSX3mKL9lyDkN8v1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791184173, "uuid": "62b0df6c-3c55-4f31-b69c-f294a24d31c5", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791184173, "uuid": "3810af60-4c03-48f7-b93a-976ba8b4f13d", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791184173, "uuid": "b9035230-0c03-4aff-b4df-95daab241802", "value": "045e0dc95dbfa3ce9d457810c24751e95c8416762a4452e28ff29bde1c58f8f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c498aa30-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791181618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181618, "uuid": "ded6d97a-9192-4652-855a-6aa748437b43", "comment": "Malware payload (Formbook)", "value": "7c35b3f6138a700714544a0146e3dad5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181618, "uuid": "462663d2-0e56-4d5e-bff1-ca0ea0b5c5b7", "comment": "Malware payload (Formbook)", "value": "04a6e7e0ebdb93b20b3de6905562665d5b884d9a9f45008d9634d506e6fc39b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181618, "uuid": "a7405397-8ed4-467f-bde3-55d5a37c8c0a", "comment": "Malware payload (Formbook)", "value": "b23f425b28934f37e6d3039ed5a24d5a2e144a46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181618, "uuid": "d51ea821-f9c1-44d6-82f0-8db67d8b9a3a", "comment": "Malware payload (Formbook)", "value": "e930ec63adf9ef359212b93b3fe3eedbc0677619eb4633345d418b257cca7a87c597eb4e706b88a418e472f0a6540fb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181618, "uuid": "fd9ee609-69b8-4ea1-a025-f1cc9bb8835e", "value": "T16F54120EABA3D42BD992C4B6F4011F471D9DDE70EA343056BB0816BDE7621953A3FB02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181618, "uuid": "c0b170d8-7c25-4820-a11a-7ea5a6e4d1f3", "value": "6144:qeR+oUqMHeZhPRwH9oevNYGx3AkMh/oNrJLiDH//F+BO:Bcs9CCkbRMii7sB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181618, "uuid": "27116149-5802-4b90-9f05-ca481e4e03d5", "value": 287744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181618, "uuid": "aca66479-47b0-49b0-ab15-0009506233be", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181618, "uuid": "5100d7d5-0334-4f39-bb79-6d200b2acb30", "value": "payload_shellcode.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c3f3cc-c09b-11f1-927a-4201ac107004", "comment": "Malware payload (GuLoader)", "timestamp": 1791190908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190908, "uuid": "6143a96c-34a1-4be0-8a23-73afa03fd293", "comment": "Malware payload (GuLoader)", "value": "28582f44cd8956ecacce2218dbb00563", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190908, "uuid": "29a1e324-c98b-4d30-8815-87ea511a80b7", "comment": "Malware payload (GuLoader)", "value": "057318ba4e6ef6981c06373d387f64ecb3669909bc157e3ac8a7fb388bc58403", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190908, "uuid": "74b6efbf-3c34-4cc6-b8ca-d34d6f9c4efc", "comment": "Malware payload (GuLoader)", "value": "286fabf4083efcafe0ca52934dc8a283f57a24ef", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190908, "uuid": "20f5e5cf-c2e3-4587-a1b4-611d0355c9ac", "comment": "Malware payload (GuLoader)", "value": "c8c64d8fd3be176ea80199a41f59237ead80de7b4dba858407609b506e34ec65cfe39086f8bd5b986fecd671a2418de7", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190908, "uuid": "a5cbb6c6-1d32-45b4-9098-a1ca1b08d129", "value": "T1C3A45C20ED34067A4F471B9DFCA50B62CABD8619422640F5F6DE070E61069FCE3FE669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190908, "uuid": "6b626610-6f0c-446e-8b0a-2ee854f20640", "value": "6144:RIndl9/0sbkhfYdGtzI0CmDSS6oLnof+RFuUQSrNM58H0pZO6sgf6sQdxjV4:RIndqQGt5C+jokcv55/pZlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190908, "uuid": "d93f0d25-75ed-46c0-996f-47df140ead28", "value": 452855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190908, "uuid": "e1709fab-bf3f-4f9f-b8f1-cf70b685482c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190908, "uuid": "60e62aaa-873b-4592-879b-4b44ef22353d", "value": "VERTRAG-pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1332337-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218925, "uuid": "f221d02b-62e1-43fa-aea1-f67b9716040a", "comment": "Malware payload (Mirai)", "value": "88b76b34a9cc3690efb54d8e0c1fed38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218925, "uuid": "d3aa8b55-c7d7-46b1-bd37-8f8d1fd4ea57", "comment": "Malware payload (Mirai)", "value": "060f76986257997b7783e4c4ed4ee3be47facdf7c6240ab87e7b533dc9be295e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218925, "uuid": "2c23765a-9b31-4fa2-9724-0f7f81a42fd9", "comment": "Malware payload (Mirai)", "value": "4f8906b60c857d2d5a09b2bfde7f78c61fb4e7e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218925, "uuid": "0dd18d95-6d9c-4ee0-8be5-450d313d2dfc", "comment": "Malware payload (Mirai)", "value": "1f635cd0d3d0b800b64133bb0d029e7277199fe7bba18ef8d9e85230cfb266f966a801717136468a14a243c2c2bcd8e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218925, "uuid": "5353c53a-0842-41a7-8b51-132efef23056", "value": "T198545C46EA405E13C4C527B9B6FF414933335774D3EBB2069A28AFB437877AA4E27601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218925, "uuid": "60da4fef-1d32-4c7c-9d5a-cce45294f469", "value": "6144:1bjWDUlVGBr8FlP97xCDRR7VaIMREaHweQsFWXaNtM/RWVBq:xWoDC8x7gRR7VafREaHwGbNW/YA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218925, "uuid": "74c662ce-e8f6-464d-b050-ad5fc5f09095", "value": 291891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218925, "uuid": "080519bc-db32-410e-a558-c6d67b5a57ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218925, "uuid": "7e287593-cef6-4526-84c0-639ba6828ad4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de5e5ea8-c05f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791165341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791165341, "uuid": "3531e93f-0d70-4ec4-8755-3b2617d3be9c", "comment": "Malware payload", "value": "40e405807927ccf8a73fa7289dae1dc3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hijack", "colour": "#D7C062", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791165341, "uuid": "b047b718-5636-4efe-9618-38eee6fe41a4", "comment": "Malware payload", "value": "062aca87d292a3f462c1aa7cd016d2daf52eeb7503d335fbca6807b77105688d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hijack", "colour": "#D7C062", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791165341, "uuid": "73a493b1-eac4-4685-9db5-11b1b0cc2b25", "comment": "Malware payload", "value": "61524836336dedaa6c59fee95fcf23c9d6ad0a8e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hijack", "colour": "#D7C062", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791165341, "uuid": "2bc23823-7fe4-4c04-b9c3-d78e09da5dc7", "comment": "Malware payload", "value": "2f0cab13c168a23cbfb9fe7d327c18466af31d7ac656f5d9e6549395f1760f239aa9dd2764ef708a5bf930ab7e6264e8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hijack", "colour": "#D7C062", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791165341, "uuid": "69938367-1a11-4c61-87c9-89d5a17be8b0", "value": "T18BE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791165341, "uuid": "a2ed9184-68d9-474a-95a7-ca16ff58a34b", "value": "58e683abec29a387daf56221678b4318", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791165341, "uuid": "f11f4c36-ab82-47da-a4a2-7dbc2e60de17", "value": "49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+/:P9m29xx3Tiqt06ox6+z2rNNrKo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791165341, "uuid": "8258167a-9837-4ea2-bf38-1d6f367ac92b", "value": 3255824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791165341, "uuid": "7efffb57-35a8-428d-a340-b773e009371a", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791165341, "uuid": "7cc6cb10-2a6c-4829-b605-e2fe2f74c5c1", "value": "062aca87d292a3f462c1aa7cd016d2daf52eeb7503d335fbca6807b77105688d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f9c0df-c0d7-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791216551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216551, "uuid": "82890f40-5c91-4de8-8734-a274599495d9", "comment": "Malware payload (Mirai)", "value": "7d51f94908553a00bdcd2c1e27ad189f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216551, "uuid": "1c6c9925-43de-43db-97f3-f787b8f41f06", "comment": "Malware payload (Mirai)", "value": "0632ff216d3230e1365721883414948d5db99d6671f9ef345a16a557e924cc11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216551, "uuid": "847022ba-8dd5-43b4-b25e-edb059d4f132", "comment": "Malware payload (Mirai)", "value": "2bfdf8f64ec352866a1987f354be44c70d647f79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216551, "uuid": "e8e3ee70-8246-4ae1-a563-464ad1cb5804", "comment": "Malware payload (Mirai)", "value": "429c28e47a713462e2addc20c02da918e76a07b208d55c4b35ca19bfd7d3d1222d36d1dd0b69cd7419b81ba03133b9cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216551, "uuid": "bddb432d-a2ce-41c2-ad77-d5617d507935", "value": "T175D46C16BD919B91C6D24ABBFBAE4368731757BDD2FF7006CA005F907BDA4810A3E241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216551, "uuid": "3a36d5df-0c91-40ef-8045-5b1dbf5e6886", "value": "12288:/rsQtJkrVk1BcbyclDYISJEvUkOcf/0X+HGAeOhAw+qOJKe:T9JkWcbyclDYISJEvK/+1A7qOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216551, "uuid": "6fd229da-0936-401c-a12e-e0c9e8c11baf", "value": 629512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216551, "uuid": "a36b4a41-67bf-444a-ba1b-b9e4a51a4e77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216551, "uuid": "481a348f-542a-477f-832d-d305a78f8a8f", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c145b4-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218710, "uuid": "283586ee-fbb8-4507-864d-207ac137047b", "comment": "Malware payload (Mirai)", "value": "015a14339ad57309b5fc7d99cd987fbc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218710, "uuid": "4aff0dfc-b465-4679-8e6e-ecc07ff5b46c", "comment": "Malware payload (Mirai)", "value": "067c60c61f9fcdbd37b13565ea99b09e31f2ce560aeccaf9b2ff4f16a195d292", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218710, "uuid": "071a9142-37a9-4ea5-9991-acf422d86bf5", "comment": "Malware payload (Mirai)", "value": "b58e0de466d63ffc1d67e8612c0a994d6f5ab70f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218710, "uuid": "ae52a04c-703e-4aa4-84d4-30432a91924b", "comment": "Malware payload (Mirai)", "value": "56f1562afd857f77018786949879fe0e0e1036d5fe096de6511963fb9d5bb869a06032834c78cd4e67f1a6a9d119a781", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218710, "uuid": "a911e153-93fe-4f39-902d-7cb013823755", "value": "T1DFC3E846BD518F13C5C321F7FBDE42987A166F6DD6FB31029924BFA0374A4D60A3A212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218710, "uuid": "413dcc4c-5860-43f7-8090-2b6537244b36", "value": "1536:i4OCds4kr3AUVv4VPwSv7A6ujOmlrpNPXc9FlMQwyw3UMNlZsol0huOUYqRvsZC:tq5r3l4mG06ulFMMqGsZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218710, "uuid": "93627bb1-ca80-4086-a0e2-287d6d60c9b7", "value": 125108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218710, "uuid": "61f26541-f711-4c9e-a78b-943a02dc9bc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218710, "uuid": "482a59ce-0c8d-4283-9f24-ddfe282ce501", "value": "eclipse.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff4caf8b-c0d9-11f1-927a-4201ac107004", "comment": "Malware payload (ConnectWise)", "timestamp": 1791217794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791217794, "uuid": "4605d217-9baf-4993-a674-8f7935c1eb8a", "comment": "Malware payload (ConnectWise)", "value": "6384a37947e61cf136a039dd948e325b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791217794, "uuid": "e9804eb4-a3a1-47f9-bb65-aae7b39b3276", "comment": "Malware payload (ConnectWise)", "value": "068973019438fd8817ae22b5f264e67bbb5c5675b11b5e7c24f7c954fc92835f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791217794, "uuid": "6b829172-1bd5-4492-ba53-f7b571b162a0", "comment": "Malware payload (ConnectWise)", "value": "7a041dc94e52e1a51a0e12dd81df95d3e66c36b5", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791217794, "uuid": "8bf77990-ef0f-42b4-b171-60ece5768e92", "comment": "Malware payload (ConnectWise)", "value": "e0e12b952bbf929e453e479c5e645f8973aff4eea786daae3dd8d5e7f767ec4722330cba66acca0aee11d25c03a001d2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791217794, "uuid": "58990977-bb98-4682-8133-cf6aa726387f", "value": "T1F546E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791217794, "uuid": "5164e98c-569c-4847-96ce-4fc1e29c6eb7", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791217794, "uuid": "daea6a83-59b9-4119-a7e0-3efe9ee87ed5", "value": "98304:pzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlt:phfefPtHxcp9ym3nltDUJV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791217794, "uuid": "ce873bc0-90b8-44f3-9853-6f24d30f7de0", "value": 5678184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791217794, "uuid": "f968f28d-0b10-4db6-bfc3-7939ea1da700", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791217794, "uuid": "82131f91-f806-476e-8d33-a214890954f3", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0abdf81-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181987, "uuid": "aefba9fb-b73a-4003-ad52-cf0ee90b5204", "comment": "Malware payload (Mirai)", "value": "250a6110ccd28f793d425df190ea58eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181987, "uuid": "24f82937-8ae0-4adb-84e7-6e94e4c0ab53", "comment": "Malware payload (Mirai)", "value": "06a67cf4ca7a6c02f06e206a93ccbcb1373c04069cd0e8e124316b3969e60815", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181987, "uuid": "bbc85dab-e65d-4e29-9baf-b94da9c68a57", "comment": "Malware payload (Mirai)", "value": "50b48aeb4fc2b5c74e589fc36edb33a7fd0f7d48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181987, "uuid": "af4c3ab7-54c0-432a-aafc-6a24d9b3eb26", "comment": "Malware payload (Mirai)", "value": "bd7ed3a4a1305dd1a0489a6d8c395c2250173d48146626e3f926f3e1582c851657deadb7a3948163bf15dbcb1e89de8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181987, "uuid": "de0a97ce-6009-40fe-bd51-5c3076b3d5bc", "value": "T149564B07ECA555E9D1ADE63086729262BA727C486B3123D33F50F3282F77BD06A79710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181987, "uuid": "72d33509-d9fd-4ecb-835a-37317022b7a2", "value": "49152:H1TU0+mCVvAA89Rw7Sa970kR+9wA0Z9c+sykbcv9+C9WHwTWWslAgFzM3VYfCPK6:HhRC7RD6+pySfWH89gFcIeEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181987, "uuid": "fe87934a-6f28-4ea1-b65f-207d9c48b5fe", "value": 6348984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181987, "uuid": "44aecbd4-9d3b-4681-80ed-03eec0787403", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181987, "uuid": "ebf637e9-ea24-4d07-9f5c-898af17e7cd0", "value": "nyx_bot_linux_amd64_exec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab9293c-c055-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791160932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791160932, "uuid": "14dee228-61e8-4a1e-9b00-722e417ad87c", "comment": "Malware payload", "value": "8f0bcf59bd10c28b439a7469c092e73f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791160932, "uuid": "364b55b2-1bd6-47ad-86dd-53c5407e7dee", "comment": "Malware payload", "value": "06f7f11cfc2c401875f2f9aef30e2176ad3520d0d309c88361b2202ad67099a2", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791160932, "uuid": "8afedc15-8ee2-42ec-967d-aa4acfdbcc1e", "comment": "Malware payload", "value": "2ed9c4f3eeb0853c0b47808a054c0895ab9ea829", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791160932, "uuid": "c41175f6-dc02-429c-84a6-8266886b6de7", "comment": "Malware payload", "value": "a25f816a85339d04140c1602b4ab7bca066509d13ef48261ee08260cdc9555ed63d1389bca8716a67c2c1a49def85635", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791160932, "uuid": "a17dcab3-3c94-409c-9aeb-316ad84790b9", "value": "T12442185CAED1A2B0EA1707DEB7AF24690228A0C72009C484F94CDDE87F06BDD4A57B57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791160932, "uuid": "59688bae-08a8-4e45-9a01-2530de03d336", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzNbqFtCgSiRUM:sXX+/DV7k/3IFtPRUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791160932, "uuid": "3ca85be1-3d07-4b9e-8eba-93b4f223406f", "value": 12033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791160932, "uuid": "14cc0d37-40b9-4b16-97d9-76c06cd8ee20", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791160932, "uuid": "5ce6b067-d444-4743-8013-3bf72e7b4ff0", "value": "temp.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc279ee-c0a0-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791192987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192987, "uuid": "efc83435-0f58-49dd-9bcb-0930a3293917", "comment": "Malware payload (Formbook)", "value": "60b764168d5b4bcf58f4447a10f423a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192987, "uuid": "c1c04368-eca9-4e7c-b358-b4b056abf98a", "comment": "Malware payload (Formbook)", "value": "0761a56193a5ce6cc03b4fa36c77b80dcc43dd638c5232f32cae5eb2f5727ced", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192987, "uuid": "832f3351-a468-4dd4-ae97-087268bc237c", "comment": "Malware payload (Formbook)", "value": "7aedbf413ac8b83f1f1856891ec49c3cd98338d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192987, "uuid": "334ba447-4c2f-42a9-8154-471756153db3", "comment": "Malware payload (Formbook)", "value": "b5464ce4f6391ed8df70f88aae8e2f9299dcba4ee90baac9da8128c19032c3f7e0f34cd4dece1e4d5269ab80a4500433", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192987, "uuid": "dd668100-bae2-470a-9f03-71db44134872", "value": "T13B15F158335ECE02C4A58BF01930F3B94BB4AD99A421C3174EE6FCEB793675069192D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192987, "uuid": "8b4f03ad-5127-4a4b-80b5-408a954daf80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192987, "uuid": "2bd4be2e-0666-49e9-863d-07bcce55f90b", "value": "12288:YHdmsj7n4P0UoRycsm9xn29KdMygnLLBH6ChLyeEN54LkvG+FybID6yaPf/jzEq:Zuz32UMygLh5hOBgLMG+cb+6yaPf/Uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791192987, "uuid": "43c8f06a-5ab0-4d32-8992-9d2fd3a25f6b", "value": 935936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791192987, "uuid": "26e49d40-ce87-4d01-9e33-586712c3a935", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192987, "uuid": "57ecb4bf-763c-40a2-803d-e7e48a277459", "value": "Quotation Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fb9a84-c0b7-11f1-927a-4201ac107004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1791202904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791202904, "uuid": "18a4b8d0-0e92-4c5e-a03e-e53394d16f65", "comment": "Malware payload (SnakeKeylogger)", "value": "9ee44d041be23fc85607bc46ca008fa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791202904, "uuid": "0a763de6-7cc9-4411-803c-8b9dcbeb5826", "comment": "Malware payload (SnakeKeylogger)", "value": "0926f6f79fcac8bc7e1e1e7027743a37662a1db79464fd24dc12c6c199ddee21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791202904, "uuid": "c073215c-6553-45a5-b6a2-ac45894a345e", "comment": "Malware payload (SnakeKeylogger)", "value": "33d9a5c3b1aad50da303ebb5121d057a65059241", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791202904, "uuid": "29a0ca04-bce3-45db-b129-bd7392339d61", "comment": "Malware payload (SnakeKeylogger)", "value": "3b7d4f140e9902abcd3cdaeee25b0911c394d222676755732ca13fef64b70d52e6ae05a46236712c230dc4c6d5bf4405", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791202904, "uuid": "f0ebf593-44f6-4dfb-97c1-9b3a215b209f", "value": "T126F40258222EDD06D59107F40D70F3B916A86FE9E920C3178EFEFDEB783A2157910296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791202904, "uuid": "aeefd675-fcd6-47e3-bebf-5742cdc3ea80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791202904, "uuid": "8e6c0ca4-ae13-47b5-b716-bc4124cb8357", "value": "12288:Sw7n4P0QuyHHOndYSqvzKIGLI8gDAmD+EN2C/oLyrhXH8MuDdQVxKr7k:7cuSHOnqSqv+QDAmD+EN2Aom2zdQe3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791202904, "uuid": "af68c5e9-e596-4988-b3f0-0fedcd5af65a", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791202904, "uuid": "ebb3f84d-a11a-413e-841f-4dca43bbd8af", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791202904, "uuid": "0e0c8e97-5073-4d64-be2b-0399db9fc550", "value": "Teklif Talebi 1540-0092RFQ26_202606100623256209 .bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf3e63c-c0dd-11f1-927a-4201ac107004", "comment": "Malware payload (XWorm)", "timestamp": 1791219403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219403, "uuid": "e2cdfb92-86ab-4e0a-9b40-6b64be3b338c", "comment": "Malware payload (XWorm)", "value": "d997ded86ad5ad150c2370d278f14c8f", "object_relation": "md5", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219403, "uuid": "475aee7a-4a77-47b2-931d-af9722409615", "comment": "Malware payload (XWorm)", "value": "09ff52a546c7517951367e6df955d8ea14a1089deb0cfd44f942537da8e8baac", "object_relation": "sha256", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219403, "uuid": "52376b8d-075d-4e09-827e-a659e20a16b3", "comment": "Malware payload (XWorm)", "value": "cb04255ba4cba6b6a1259fff289d10b90a9ac8b4", "object_relation": "sha1", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219403, "uuid": "773b1c53-0cf7-4094-842a-1045bda7796e", "comment": "Malware payload (XWorm)", "value": "50da4fba742c16385b49e4777f9d6489e7868397c7385c76dc9a545e400a779c17457c0190d3d20386d32a3b8eb48e50", "object_relation": "sha3-384", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219403, "uuid": "4da43b6a-1a02-445b-8565-3457e396e10d", "value": "T1D9D37D8EFD1525B95A0751AA9CED444F7BF85033889864D0BE0D12D80F635FAA3E4FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219403, "uuid": "321e5bd3-7d2a-44cd-bf60-9a980b1f5a68", "value": "1536:6fjhr9CSa/ClCiEeQ3yoTM801y/mCDr+j2ZXvtfE/8vtYJ1Uuk7VpRT/pz87WJlY:6fqSa/Cl4yRmfEs3uk5Tujjuoue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791219403, "uuid": "042337ca-1204-4c6a-a633-ae28bd763333", "value": 140726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791219403, "uuid": "6b1fc5e1-f24d-4496-8eec-06fbb3ce49c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219403, "uuid": "39cb9e2e-081f-4e99-9d89-5608d7885158", "value": "sostener1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86896330-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218880, "uuid": "b7585038-7081-47e2-a0bd-d5e94c9cc1dc", "comment": "Malware payload (Mirai)", "value": "189228b47a4821765433dc695e9d78a2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218880, "uuid": "3faebe42-2744-4371-b3ec-bad6e4ea9ddf", "comment": "Malware payload (Mirai)", "value": "0a5f1c48da9661be1f9dad6de1a68f3868c3ef0767dd7aefef2f1f1c7aa2f865", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218880, "uuid": "4e82d880-2a5f-4490-a41d-ee9b87cfaad6", "comment": "Malware payload (Mirai)", "value": "d40cc4ce02dfa3a8004ceac6173710c0b090680c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218880, "uuid": "8e8472bc-e973-4fc8-89f7-ad7720e2ad10", "comment": "Malware payload (Mirai)", "value": "d7b49ce52828bf12fe2dce220a6f33eeaffce5236ce9d337eef7301cce7613d7bcdfeb51d9bbeb352ccf5a5290d68316", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218880, "uuid": "86025f88-a76c-4451-91fd-8d2b7e421939", "value": "T1F7A3023EF631278BD1A9DABC50DCAE6D5DA79084720A46FA270C4395AD08C0E1D5CADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218880, "uuid": "981a70be-71d8-41eb-9e64-5cb428ac2daf", "value": "3072:f+GbV2hNdv20e9888x4WyNNgJYECmBK1hR:f+GcP20eMGcYEPI1hR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218880, "uuid": "69e4dea7-f19d-4cf2-8051-263768406cf9", "value": 103880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218880, "uuid": "eb04faae-dbb6-4f3b-a1c1-7df874a94008", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218880, "uuid": "fc4edb19-6449-4572-baee-66e02eec6a87", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "543458c6-c06c-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791170692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170692, "uuid": "d7463d7b-21a6-40ef-b900-ff57d241d13d", "comment": "Malware payload (Mirai)", "value": "e83733b322a605a96a68d386046e2fb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170692, "uuid": "6b18a0a2-69e5-448b-b36d-b3257557fb83", "comment": "Malware payload (Mirai)", "value": "0b44e0e5640696e069413aebe9ba4c1f116f51b79277e27a9827addb5a3b5b74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170692, "uuid": "ba5d0840-4d76-49c9-924d-8998706d8f3d", "comment": "Malware payload (Mirai)", "value": "94c7395bc5a16b4a3abcc2af3a12244507ee00c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170692, "uuid": "4ae7e8f7-b8db-4f65-8f0e-8b07b3064779", "comment": "Malware payload (Mirai)", "value": "aeeb2ecc2503389c0d9480edce42668cabafe0ad0e50b742aa7f6a24f44270c6062bf77392cbbac9f5d7709cdaeb9120", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170692, "uuid": "b7e65e18-2796-4a1c-9274-b395e305488d", "value": "T14F344A47A9E08FBBC146AF7165B35A34071BE8161F4B0F9BA539E5B4524B8CDF00AB34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170692, "uuid": "9e0e5ca5-f412-4417-af77-63e99f080e11", "value": "6144:OQyJ+S0f4yuKHYnB9lSRh0YmvjPwYLqz0hxmyGklpO:OQlS0Qyu/B/q+3vjPwYLqz0hxmyGklpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791170692, "uuid": "0526b2d7-bf18-49a7-b72a-1a606f1275b6", "value": 231217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791170692, "uuid": "8d53624a-6490-487c-8fd1-37941b30cf33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170692, "uuid": "3ee6bb24-68b5-41cd-8575-9bfed835b72e", "value": "0b44e0e5640696e0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe56bfb-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Vidar)", "timestamp": 1791182093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182093, "uuid": "e1bc76d1-6f59-4ffd-be30-54c4e94ad9f9", "comment": "Malware payload (Vidar)", "value": "3d46be69791ad3e49fcf1a708ec8417a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182093, "uuid": "3f9bf94b-6829-4a72-b940-329d4b6da00e", "comment": "Malware payload (Vidar)", "value": "0b4e63a6488eb8c648abfa376bcaa46eb1596628ced030180441b678d314a935", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182093, "uuid": "08f4af27-da00-4257-972f-de7d1ecb4fe5", "comment": "Malware payload (Vidar)", "value": "55fb933f7e3aa509e19f495f2b1e17c006770d76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182093, "uuid": "e3ef6b6a-07d6-405a-bbf9-90ffbb56aac8", "comment": "Malware payload (Vidar)", "value": "ca9343d543e526f69e95bb84bafc43e27564b91bbd941d27386366879173ab81615a79962e634eded18accc9fd36a1d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182093, "uuid": "3c3f957e-808e-4be0-b0fe-ffd01ce94b20", "value": "T1A9767B0BAE8591A9D469E734C9766110A274FC49DB3233E37E50FAB05F623C1AE79F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182093, "uuid": "aad97c6d-98e2-4915-8567-ce40df6ae8fe", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182093, "uuid": "eaff3488-d2e8-463f-8b9f-89209b02ec97", "value": "49152:KvrVVbrL6TfDCPMe9q2A3x9EDD6OhVgDIWymGuh+gxml48jPr/6OUrcnLSkdDutk:K/jG0DDL6ZAD76ojpkq/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791182093, "uuid": "a02c3588-49c6-44c5-8319-fb08d90b5273", "value": 7382400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791182093, "uuid": "89bbecbc-3955-4df1-b4df-e48529dfa34b", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182093, "uuid": "ca1782bb-5da3-4423-9bed-a2e9a77a4b22", "value": "0b4e63a6488eb8c648abfa376bcaa46eb1596628ced030180441b678d314a935.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27f8c2d-c097-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791189346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189346, "uuid": "8c972087-9ea7-4e00-8d73-53d0a39c54c9", "comment": "Malware payload", "value": "df7466f2da31e476fc7790d9a9bb2501", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189346, "uuid": "86d03ed1-0df1-40d6-ba20-422f12836c52", "comment": "Malware payload", "value": "0b58738856618fa4111e42132f80bf60536a0162ec9c983713e23f356ec0305c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189346, "uuid": "8f685886-6771-486b-803a-617963eb8070", "comment": "Malware payload", "value": "8e31d73144a9f5a8d6f09672e3e0d79a7b527ac2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189346, "uuid": "1bfa18e3-039c-426b-a9e4-2e7494668e67", "comment": "Malware payload", "value": "47b8eeb50bb8b100b0392e89a726e337707175327a2737154f3c62da499b58bd8c7a8af7a448ba87fe8630e283ff87f3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189346, "uuid": "84d2f398-f6f0-4162-822c-5cbd81e2aa17", "value": "T147B313E73699E296071B68086C63E586F8179D8D3CFFCC0D35A7111CB5344A2BA5F2E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189346, "uuid": "789cb53b-25a4-42fc-a517-eabf697bf319", "value": "1536:fRJH2iccQ2NO3z9FthRwbADtf0M3gGCSBJEBnpmKtT3zixa+m/CGSzdREst7Zc6g:ubxKOfhryNpSoizTdVRMEKU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791189346, "uuid": "99f6a7ec-b0ef-4784-ad5f-882db42dbb5d", "value": 113408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791189346, "uuid": "833756ba-a701-4cfc-9ccf-c16e6ccf8122", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189346, "uuid": "a8fd70a0-23ad-4c81-9109-bec7deffb1f9", "value": "26796378cf9a86c8635d554909e9b58c940decd8ffe3525471de778d7cc414d2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33aba87-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791216486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216486, "uuid": "755d9302-8ee1-4061-a29e-99d1ba400a6b", "comment": "Malware payload (Formbook)", "value": "95e32a3d60558c896f50ff50684fe125", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216486, "uuid": "0a132c41-46a2-4312-8f33-84262051bc7e", "comment": "Malware payload (Formbook)", "value": "0b81936f0bc1aaf3d55932e910e8a1cdbd80f276e59f80690a80f8f9e6550a93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216486, "uuid": "f739fe55-a535-48cc-9941-4821a36486e8", "comment": "Malware payload (Formbook)", "value": "b01b883c5126c1c9f2a4cc7108545e243033c06a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216486, "uuid": "17d0ef07-d62e-4222-bfd9-9c14b6b6a070", "comment": "Malware payload (Formbook)", "value": "c2bdcefce869ed1b0dce676857fb1c9e6fb4eb9f7d139dfb115be745eb5ecc02c79c34e43bad7cc2a9d2465ecfbdd95f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216486, "uuid": "9b29dfad-ee3c-4e95-8ed4-93c9dff861d2", "value": "T12354233DFB55123BE096D270ADC564AA3CA4623780EB731FB582CA49C19D8DD3E18B13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216486, "uuid": "463faa65-9420-49cf-bb53-054f6351369b", "value": "6144:4535dJF42CbkYsg+FH5PdYgyaW0HXh8BpdqDXp0LIGla7Q8aJLcIewH:45PF42ScB5PdvfL+4CLIgEI2bw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216486, "uuid": "23abd497-b401-4b5d-9025-0e108a67a97b", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216486, "uuid": "fbf5dc84-22b9-4888-a714-050efd368b63", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216486, "uuid": "06afea1a-5ac4-42a4-bc69-0121e3a0f827", "value": "probable_Formbook_3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "835553ca-c09b-11f1-927a-4201ac107004", "comment": "Malware payload (GuLoader)", "timestamp": 1791190958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190958, "uuid": "ecfbace7-298f-4b50-ac7a-aabce9686f49", "comment": "Malware payload (GuLoader)", "value": "b2f6b8ca6a1095be14bd7f2493c54b9a", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190958, "uuid": "609744fe-d8f2-4832-b924-2eb8a73b15fc", "comment": "Malware payload (GuLoader)", "value": "0be1143f9849bc18e140c3442fe88d200411ef79f996d6c043468b6632534317", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190958, "uuid": "ab781e09-aec9-4f6a-b5bf-852bf92aa1ac", "comment": "Malware payload (GuLoader)", "value": "cd5974c0a4308c4d86a8e1001c9471a13facd31c", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190958, "uuid": "5c1c463c-b01d-4a9a-bfb4-3868ff942b55", "comment": "Malware payload (GuLoader)", "value": "df8c761fa6dfbe7d9b5216b7aa97b769d0f4bc7369777e49cb8fa4d9ab64f835e7c94b742189ae64a9e283e35ac703ff", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190958, "uuid": "8a64e020-ea8d-4f9c-8548-f36d1cd1113d", "value": "T1A2536DA0FF2406594E472BF6FC954662CA7CC215522680B5FFED230DD0036ACE7BE669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190958, "uuid": "0e8dd786-1c64-41ac-9275-c59b9b88c7d1", "value": "1536:JG8NAsexrRszsLQ1KS+KfYjOH88iGeY2dT/VTx:FexRszsLQ1wjhAeY2dT/VTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190958, "uuid": "3cadf788-26e3-4147-a2e8-c4ae75d9c1fe", "value": 66515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190958, "uuid": "79d359c8-825e-4d2c-b292-20a899068b3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190958, "uuid": "f9ef2a3f-6a5e-41ea-8258-df6fd162accf", "value": "CONTRACT DRAFT-EGP-25006-SG1-SLO-GS-0349.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b4b206-c0f8-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791230955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791230955, "uuid": "fbe54b91-2891-4026-b9ad-04c4d141f2fd", "comment": "Malware payload", "value": "01e07f4ea9caf3a57e26c7d1c0afbf64", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791230955, "uuid": "a5f9ecb1-1baa-4cab-90f1-927dd719addc", "comment": "Malware payload", "value": "0c148e70cf9cb72e35899c3bd3834fe09efd2a00974a3de5a8764ccb2278f7bb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791230955, "uuid": "0b33e617-3fe6-4d91-bede-cd006a4ffa2a", "comment": "Malware payload", "value": "089481ead17e40f9dcb6811c2853a968a77f8c38", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791230955, "uuid": "8639e44d-81bf-4059-a1b3-2cc83457cd1c", "comment": "Malware payload", "value": "b4e4e8176ab9d851111ff749dfeeafeee346b9f71daf70190ab00ad08a0925bea613abbce7ffc50a3a29604b19520136", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791230955, "uuid": "23019d06-03fe-4367-84fe-1c19fac7bb48", "value": "T18AB5332695377DC3F31231A576830217CCB5A2FE6F2E652364C98B7D22A3659225F833", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791230955, "uuid": "dd2f8ed1-bb3c-41f1-963e-982a63dbc91e", "value": "49152:eQ2npqIyfB4bD5fuAtgFDR2k0LoVnwoYdM9hEZO8pc5PyBfP0QlG2:eQ2nEBJM5fuqgF1MdM9yZO/5PyBUQlh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791230955, "uuid": "e245749c-979e-4651-826a-da9341e3b7be", "value": 2471260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791230955, "uuid": "8660b806-a416-48b9-9c3e-f63ef05ccd9a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791230955, "uuid": "2207e542-fbae-4366-a161-50902ad1e245", "value": "aidenoiser_res.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a333edf-c0e8-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791223826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223826, "uuid": "490e9902-5cdd-4bf5-9e02-b138a7bf6f2e", "comment": "Malware payload (Mirai)", "value": "b37c9fb52fbb3fcd3af5aa5de779612a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223826, "uuid": "30f03b6c-7564-44d9-91af-f9796bf22324", "comment": "Malware payload (Mirai)", "value": "0c17f2bca0396d73233d6f3b30b549a7e5a25e2b618ecdf5827a056bf145bf20", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223826, "uuid": "5e8474fc-3280-4bbd-8b50-12d2f17918dd", "comment": "Malware payload (Mirai)", "value": "4d4c85908b4b41ce1b90c236144814467b8a306e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223826, "uuid": "fd2dec9d-e7f0-4806-9f5a-6f1c6b73f116", "comment": "Malware payload (Mirai)", "value": "25b14124b44d675134cb90db8f3f028db44b0401b2c52abfbc1d3efd01cfa8bcf7082025f7d2cbab4a0ebf1bc7c20d9e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223826, "uuid": "eacad1d3-0919-45e4-83a7-344195cf64f8", "value": "T1FF41C2C7115383342DD5AD3FF16649D47A44E4B36EEB1E84568738EA864EF4438F0E52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223826, "uuid": "785f3409-602c-4db3-9b10-a27d2804041f", "value": "24:vPOSeaIOS/NCoOSrnOS+jOSRbOSAOScOSfOSqCQN9Ol:vPR4R/jRrnR+jRJRARcRfRqNN9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791223826, "uuid": "2d07bc57-83a8-4315-b340-e61cc26b0c88", "value": 2133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791223826, "uuid": "48cdad1c-150e-4fa7-9092-513c78920ca4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223826, "uuid": "4ce151b5-a511-4f7e-bb15-ddf4e627e24a", "value": "87sbhas6as.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f81a02-c0a0-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791192920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192920, "uuid": "915fae0c-e842-4991-a35b-3a57e3684930", "comment": "Malware payload (RemcosRAT)", "value": "18a90565b3b764c19b7a876d9a7fcf85", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192920, "uuid": "9df8c0c1-3c0a-4791-a244-e7b908876f68", "comment": "Malware payload (RemcosRAT)", "value": "0c55296904b2e395f3adbc99256954e81360c007e87b5be72fe989bc9ef2a505", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192920, "uuid": "c24e53ba-7c93-4b19-9719-3a11e7c123b2", "comment": "Malware payload (RemcosRAT)", "value": "0b985b8353c2fe8504230c2bff84fc9a987018bd", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192920, "uuid": "ab0ae10d-254b-4656-81c4-8f80c3cc337a", "comment": "Malware payload (RemcosRAT)", "value": "294c90c528ebede01af1edee4cbe85537cc3280cbe37e4b9ba611097004bcffc48c7e1721935891c10e0d333a8f1c976", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192920, "uuid": "ba5eaffa-725d-42b6-af5c-5faca83b251b", "value": "T10B736B0B3B7D1114ACFAA6CCE87CA4EB0626E31507BFF1FF11B2652D959D84989C0792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192920, "uuid": "6ebdf947-d2ad-4d34-8833-7bb2356bb990", "value": "192:uEAyyHjZnRupEl3wVmh5dK/Kl/jYKlBUKlqdJQ:NWjupqOI5dK/Kl/8KlSKl2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791192920, "uuid": "3929193c-b610-4bee-b13c-229b1aa445c7", "value": 73960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791192920, "uuid": "34d6bb7a-7572-41f6-a7b9-6d10c8d9a4f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192920, "uuid": "73754e3f-b241-45c7-bdec-05d5df3f58f6", "value": "\u041a\u043e\u043c\u0435\u0440\u0446\u0438\u0458\u0430\u043b\u043d\u0430 \u0431\u0430\u043d\u043a\u0430_\u043f\u043b\u0430\u045c\u0430\u045a\u0435.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0394e17c-c0d7-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791216513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216513, "uuid": "b45d395b-aeb5-41ec-a644-20b49d002d6d", "comment": "Malware payload (Formbook)", "value": "19c91fe72a4e7aa7b59d84baf6ce9383", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216513, "uuid": "ccf47e39-566f-4a9e-a0cb-41ae587d03c2", "comment": "Malware payload (Formbook)", "value": "0ccda5fb8da309f4ca1af9510db9bbcbf8d91c6a12758f2ff05bfc885d46e764", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216513, "uuid": "e41a1666-1462-4eaa-bf14-04218a3e6c68", "comment": "Malware payload (Formbook)", "value": "672187a0dbc9f2314ffb8b34f9601fb29b2eb1d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216513, "uuid": "7bf5dc16-b78d-42c4-ab2e-88f7b6fdb702", "comment": "Malware payload (Formbook)", "value": "1fb0786f1e8535671a677909c433cb7581a8c908851344ea283bae282252f8f33f946bc1f70877e2caae3a4dd60836b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216513, "uuid": "02e341a6-4d11-4c46-8d9e-ed682a046144", "value": "T18F54224356A7A22EE60128B52F97875F89758533A56F0117B3CC7FDF46C0AE04A9F306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216513, "uuid": "7a07f3c2-a856-4c11-b331-17f07f2f3ef4", "value": "6144:fjSaT7QOz58kdctbDAm2ocZwGJ6OqDg3Hx7:znPz58wUMm2oc/6OqDg3Hx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216513, "uuid": "ac2ac805-7166-4197-b83a-85a24064c0b7", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216513, "uuid": "2acf4e3d-5f35-4b7f-b910-2b90e2d6dfd9", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216513, "uuid": "103e5752-65bb-443c-80f5-b075a51fc0c6", "value": "probable_Formbook_5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2eaa04-c0c9-11f1-927a-4201ac107004", "comment": "Malware payload (SilentNet)", "timestamp": 1791210922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791210922, "uuid": "4ad43de9-ecdc-4023-901f-a296da2d8550", "comment": "Malware payload (SilentNet)", "value": "ff0bd8fe01eee0e41687c32abdfd988f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791210922, "uuid": "423f98c5-ac2f-4350-9522-f7d61e0266c3", "comment": "Malware payload (SilentNet)", "value": "0e3b068ae7ad28307f71521c86bc412e3eb7d5c9648e57afe30d8fee72d54081", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791210922, "uuid": "858c337f-a3ee-4cce-8466-bd28530977bc", "comment": "Malware payload (SilentNet)", "value": "29541c0d579d5992d22f85393374a5cc9909b543", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791210922, "uuid": "01ab2ade-5994-445e-846b-2008eecf5f87", "comment": "Malware payload (SilentNet)", "value": "c8446e008038f5f425958667a43bcdba4c7a4d09dc4b99da632499e9ae1e6eace46a4c3f20f30b9ec2923eae2f8d17cd", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791210922, "uuid": "b8bb8c95-a929-4354-8438-474852edc9ee", "value": "T167840106844BD42CEEA36234A2718F41A6083AB5726F137FA37C1ED46DC69CB5B507BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791210922, "uuid": "1f59da71-32cd-4c73-a38c-e09c2cf52eb0", "value": "6144:bSAYfqyttUcOreG3UcOreG0a+2K88lECK3Rul55+DPkMAJINVXx4CbhEeTx597R:mAYfqyttga8gafj2Z8ljek0DkMAJIdTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791210922, "uuid": "1273669f-f4d8-4d76-b8dd-3ea431e02a3b", "value": 381323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791210922, "uuid": "4988b245-f69b-4e22-99d2-f67109a88c30", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791210922, "uuid": "bcc58f5f-c376-4c9c-9914-e9b78fd66251", "value": "1791124818494-be5073d9-a31c-4676-8d64-c62002c6aa6d.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8a0c72-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185876, "uuid": "5a1e6499-4c33-441c-bf43-b1d6ecb98fb7", "comment": "Malware payload", "value": "1ab55b6b09f4aaf1135ed453e2ae1239", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185876, "uuid": "6894fa6c-6942-4f6d-b547-0aa057497382", "comment": "Malware payload", "value": "0e3fb927fd4c0f68ea3d562e89db991839bf2cf3a64edb7d248003ade593c83f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185876, "uuid": "081ef544-f7d7-472c-a428-3fb300f467de", "comment": "Malware payload", "value": "800f86d0c1c6bc3f264c4e28782647a9d2f5f72e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185876, "uuid": "9c10ccbb-7953-4e2c-8046-fa25e2df7abf", "comment": "Malware payload", "value": "0cea978d9e017ead134d36b5277cd90ad222f1b0291e9e6ace9c24a449323aff454cb1eef15567483aeaaa97f60dec37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185876, "uuid": "538f889d-d565-46cd-813d-0347beb782ad", "value": "T1DF052345BCD2D250F7E12AB1C9A883DAE311D84256F1D49077143BDFBFF35AAAA0284D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185876, "uuid": "e3bf0012-ea93-4cb5-a981-e129228a1c34", "value": "24576:n9rUFOcmZWkTnp5qOQvCTLKtikwcPzJTglT:nlUF0ZWkTp5qOQvCn+UMTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185876, "uuid": "471b89a8-7738-4a70-9cc1-75cea7bf96ea", "value": 839600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185876, "uuid": "925972fd-f471-4f24-a607-e2e260f5e3e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185876, "uuid": "220446ca-dd60-4ff3-8ed1-59ce3db80e8f", "value": "go_bot.arm.bak", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97de9620-c063-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791166940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791166940, "uuid": "dc4bcfa0-8335-4042-b563-d82bb313edaa", "comment": "Malware payload", "value": "f2de00de1930300f394722fd91f0243b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791166940, "uuid": "3674a8fd-9c75-4c96-8105-e6ba11f1f3d7", "comment": "Malware payload", "value": "0ea91c691e0e6cabb40dbe214b536081c9b4ca2012927fea88fb40b33bfd42df", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791166940, "uuid": "bdf767fa-49fe-44cc-89e0-45bc0b7d09d5", "comment": "Malware payload", "value": "9c422428e33a05c009dfa02f5496e757f1bf15cf", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791166940, "uuid": "938dd677-81a3-4df1-b3a6-79ae0df6351f", "comment": "Malware payload", "value": "515a2dd041a64949675c72864811e589827b0df13fb7185cad3861e845ef584f2a68804d3631d8c9bd7e9d19c8243bed", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791166940, "uuid": "021f21bf-22c1-4c54-a1d1-31cc7fd42eac", "value": "T15D421A5CAED1B2B0EA1703DE77AF28690228A0C7600DC484F94CDEE47F46BDD4A56B57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791166940, "uuid": "a9d86f28-eff1-48ae-ab17-34238bb6b074", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzPbqFtCQSxjRUM:sXX+/DV7k/3mFtuRUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791166940, "uuid": "de19bb58-fb7d-47ec-9f36-9a4e33149da4", "value": 12110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791166940, "uuid": "334f990d-cfc7-4c49-8d6b-bd38fdaa8a70", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791166940, "uuid": "94b1906a-fa7f-4f63-80bf-676396e790b8", "value": "fuck_niggers_39.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e10e2677-c0df-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791220321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220321, "uuid": "225b693b-1c11-4189-ab44-31e7e5231a77", "comment": "Malware payload (RemcosRAT)", "value": "f889ccaa19334c659e065ae83943a663", "object_relation": "md5", "Tag": [ { "name": "dropped-by-remcos", "colour": "#5D7FF7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Remotehost", "colour": "#74154D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220321, "uuid": "f43d9bce-c346-4a4e-a4c7-71e27971b3cf", "comment": "Malware payload (RemcosRAT)", "value": "0ef01158702b3eca6702800a4264baa9d0b92b6e638470991edaa284ccf8e8c7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-remcos", "colour": "#5D7FF7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Remotehost", "colour": "#74154D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220321, "uuid": "56bc1fde-cdad-4768-a88c-57cf8f47a807", "comment": "Malware payload (RemcosRAT)", "value": "d570380db958147bf58540579c62d2ff62d4e6fa", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-remcos", "colour": "#5D7FF7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Remotehost", "colour": "#74154D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220321, "uuid": "9a7f2b31-0bbd-469f-8b92-f70570863c0e", "comment": "Malware payload (RemcosRAT)", "value": "4832b5cb223d29f27af92507725f9f720f9f972d10049d933c15d6198dfa96d392bd04a0c43a8b7f27e86ecceb824af5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-remcos", "colour": "#5D7FF7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Remotehost", "colour": "#74154D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220321, "uuid": "d328eb7f-46ef-47e1-95ba-1183e02d0c5d", "value": "T152F5F15185C03FE8DF79961840FD962EE3B10A9B4C2D694ABB3FBD45AFB7500920718B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220321, "uuid": "807b8584-7bf0-483d-88ff-5fba2d786f3a", "value": "49152:KZkyhTbaa55MHrzgsUQGYCyhkWvpVDqf0oLYVgF:G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220321, "uuid": "47b91575-10f7-45ec-bfae-e33b4aac2812", "value": 3451936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220321, "uuid": "b2974fb3-844b-4c0b-afcf-f43d302791f2", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220321, "uuid": "39414af9-1b24-4427-990b-96f8f374d130", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1a50cf-c0ef-11f1-927a-4201ac107004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1791227082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791227082, "uuid": "7f665922-c479-4b9a-8e6a-a8d6f76762ff", "comment": "Malware payload (AsyncRAT)", "value": "d9e3aad9d528c2cbcf57362306e6b5df", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791227082, "uuid": "f9cd58de-5280-47eb-b9c0-061cde85c452", "comment": "Malware payload (AsyncRAT)", "value": "0fecb72b1e5b1fc4f5a00fec90beb85b22b6ec9be8139dd4cdf448087decefd5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791227082, "uuid": "323d791f-04c6-4602-bafb-e6ef94a65d14", "comment": "Malware payload (AsyncRAT)", "value": "c51dca474e7874c4b1056499e4df10dfec3d5afe", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791227082, "uuid": "30b1333e-c819-41be-9834-b0ce3e2fc85a", "comment": "Malware payload (AsyncRAT)", "value": "e8b6f1d3611c19d5583ac8bbd3d4b80349bdaef6a2e3cbf389dc830ed0abdc82fa56792629eca77aa4074a0366430387", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791227082, "uuid": "0b35b4a2-4dc1-4861-90e5-232c706bbc24", "value": "T133233C0037E9822BF27E5F78ACF22245867BF6672613D54E2CC441D75A23FC256425FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791227082, "uuid": "506cb55d-e26f-4475-aa4f-ba56f58171f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791227082, "uuid": "26c17ff9-c1bf-4d07-b86e-f7c29d921ad8", "value": "768:suwpFTAY3IQWUe9jqmo2qLfcVj+gyILCYOPIdepvotG0bgRmei1F7jojoMpeYx22:suwpFTA4/2EOKILCY3d5Xbgk919oHRCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791227082, "uuid": "b0f0b5a5-60ed-4f15-9da0-d4aa905ec567", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791227082, "uuid": "1656b191-3493-4dcc-ba2c-0f4497c1a576", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791227082, "uuid": "6f488564-2fa2-4cb5-9f57-f75c83bdb9b3", "value": "0fecb72b1e5b1fc4f5a00fec90beb85b22b6ec9be8139dd4cdf448087decefd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22aef23c-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791218713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218713, "uuid": "a02a0da4-ecd7-4010-8759-684d6362b527", "comment": "Malware payload", "value": "b9651c8adbede708342c7d95298f6e20", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218713, "uuid": "5c3b1c16-aedc-43a3-be1d-7ef705b253a6", "comment": "Malware payload", "value": "10c05440f5ac450039eb2ac7003576166aaeab181414648553d494666ba4049b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218713, "uuid": "9870c1c1-a017-431d-84fe-66a7f0b567a8", "comment": "Malware payload", "value": "20b488516a980e41e9dcb654f713dc0064599927", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218713, "uuid": "51cffd00-7acc-4d25-87b9-3373dc2c1c56", "comment": "Malware payload", "value": "b20c3bfeff8a28b0fb292eb5be83d8d3bff943187e8115fe6d78389419faca6236cb0f451f8fe578ff4da2c9ac56158b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218713, "uuid": "01a00277-4eeb-4b9e-b1dd-8035ddad937b", "value": "T1E8C30802770D4F43E1633DF03B3B2BE0979BFD5229A4A680741EBEC992719B21545EAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218713, "uuid": "b4f8defb-2a73-4a9b-986b-3b268f73b8ef", "value": "1536:tWqFO+qGnTGIKOxciaekBEkDiEOH5WeBbtO6LvAYC+SjJyXQvaOjq7N/w:t7FO+YIKOxeGNEOZWeBLMY31w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218713, "uuid": "45d09f0b-e877-4e6f-b5e9-5760783cc781", "value": 127632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218713, "uuid": "7c5f5865-43a7-4ed3-ab1e-abd78a876fd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218713, "uuid": "11af4484-4ae4-4558-a6fe-abc1a04b77d1", "value": "eclipse.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e2285b-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791216359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216359, "uuid": "a88e2483-9496-4146-a5df-d35486f73b86", "comment": "Malware payload", "value": "9acdb74454e46edbb37462965e7d3890", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216359, "uuid": "b7721674-2a31-4a35-81e3-2709a4828de2", "comment": "Malware payload", "value": "1110e336ab960ecf4816b870a8e622f302dcfd765968d7de6045325c5960b1d4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216359, "uuid": "d12be57e-d88b-414e-b7ec-3730b2994d24", "comment": "Malware payload", "value": "353aab4cdff7b6edb06bc99332c0d6ac40082b4e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216359, "uuid": "a8954c3d-3b02-4dcb-9c2d-cf07dbb45dca", "comment": "Malware payload", "value": "210fc2bbd6ed584152f3e22edb9d19f75cb75cc8fcba6de0855c7a5be6f9007c9c2e635965fc61244f5a7ad3ae9f55ae", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216359, "uuid": "7f16f1dd-d6ef-4e27-a8c7-b127399ef4aa", "value": "T1BCB49E6462A35E30E36D8AF790F9844003BAC63C9EBFFB25510F47BC9C12356A717966", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216359, "uuid": "baf6759e-8052-4ebc-b4c6-a1b746b8bb6c", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216359, "uuid": "739c1949-83f4-4cf7-82b4-4a23c655c7ac", "value": "6144:G0sAi40nb1lu6nKaWniClJs/LeB8VguJ7vet77WOdQu9rsh81wi+xHycWDetPEe6:bIljKRniClJieEJ72dz9rshdxHyHeSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216359, "uuid": "07994bf5-3bca-4f77-a73a-1f7c8da041c9", "value": 535041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216359, "uuid": "aa9f17f3-9ee0-4de2-8523-778890264280", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216359, "uuid": "5ea528f6-7e05-42ff-9886-4600ef8b0d5e", "value": "Noogen.Validation_2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a9647f-c0de-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791219550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219550, "uuid": "8f0f84ee-3bd2-4832-a51a-d25f9a669d24", "comment": "Malware payload", "value": "caef32b7cf853d5b8b7780ecdaf3b374", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219550, "uuid": "7e9e8f9f-5215-45bc-9347-fa4271709374", "comment": "Malware payload", "value": "11864181656911767ed61479ff5d2d54e592fc825cead7463eb096635903ce8b", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219550, "uuid": "4ceeb098-07ea-457c-963e-c6bb718f570d", "comment": "Malware payload", "value": "22e740285a4a41fbbcb22cbca4884c3ac58c63f0", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219550, "uuid": "0911397f-f503-47f5-a769-616815ff248f", "comment": "Malware payload", "value": "6e2cf8a489814f0080dd29a342489cc6f306d055f4dda60f6175cf8694dbb84c5a841191883bd19153b3be6a01dd6edc", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219550, "uuid": "e62eedff-084f-4877-9488-63aa39506eeb", "value": "T1E3D6123BA14BA43DE42A163AB9729160547BEE60E4124C0796E4FC4EFF350B0DD3E697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219550, "uuid": "afe4e2d7-a5f4-4e23-9043-a1e23400ab42", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219550, "uuid": "0fd45ed4-a183-44d6-9bb0-97fe4ac65db9", "value": "98304:h5OsKsU8J2u1fIIGAK14be8lQ18fomhQD3MZq5Uzfuq7SCSQ5BtrvNNN6b:bsx8/wIGAKGbe8lQ18AAQD+RfKQ5r1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791219550, "uuid": "c2d4e5c9-32b7-48b4-b116-b50a618e3b17", "value": 12961882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791219550, "uuid": "bb736656-e649-4704-b289-575eb519af9d", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219550, "uuid": "2238b0f9-5f3d-45bc-a0af-3a1402835229", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03406433-c0e3-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791221666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221666, "uuid": "350562b8-f417-4ee2-83b8-ddce921fa48a", "comment": "Malware payload", "value": "212d6f0d9e544c346f8dae39d0acd06d", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221666, "uuid": "60a201fd-ee0f-4145-a835-dc55319377d7", "comment": "Malware payload", "value": "11e50f88499ead9da9d4b0b6c062651181f28df1bf1078c5d69bdf55a836b370", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221666, "uuid": "a8883ef4-891d-432a-84c8-620d30d35b5f", "comment": "Malware payload", "value": "5b84c04a9c2f24d7eb911b452b1d4db045db0f82", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221666, "uuid": "9e570085-302d-4233-97ce-c2f38b132b53", "comment": "Malware payload", "value": "7dc77e4639edbe978a6131b1d1b4dc87fb60f8e31f170b6344308fbac0a3533b39f8cee12d0057c41e35007eba2f8463", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221666, "uuid": "1fe09d80-9e5f-41d9-b086-be8b77d56bba", "value": "T189D4F5233FA5DD98C1187D3A69F18737B7368E250D4605237E123F339A71DA8EB92684", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221666, "uuid": "1a0853b4-92fa-4185-811f-8bca2e2cf589", "value": "8e509efc29aa3364c399f520e8cefdac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221666, "uuid": "9a973a3b-2834-4dd8-b410-f23bcbe28a1f", "value": "6144:kraXZLrtHteAO/MkeIdtuE5dqkBfyboyZV:kmpHepjqkBfybZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791221666, "uuid": "d545c434-8d4b-46e5-af88-e1fe3093e1e8", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791221666, "uuid": "6ce2dde1-3cd7-4e01-bfe0-191440d286a6", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221666, "uuid": "71934847-9437-4c16-87d3-e5e33c7a861e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152fea4e-c113-11f1-927a-4201ac107004", "comment": "Malware payload (WannaCry)", "timestamp": 1791242312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242312, "uuid": "433b0ddb-5a8b-4d6f-a550-b6997e335446", "comment": "Malware payload (WannaCry)", "value": "0b1d61164780dbce2d235762afa79c24", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242312, "uuid": "451e8bc5-7577-4b64-b410-1490d53b7a91", "comment": "Malware payload (WannaCry)", "value": "128a84a95534c6fa359c34d636a23926fb1679ba7e9586db1988185b8bbc4c07", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242312, "uuid": "473f7827-30a3-45fe-b5a9-6ac9abc60bd7", "comment": "Malware payload (WannaCry)", "value": "1b0907d931a6afd1aebd0cf0c07ae3d361a49faa", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242312, "uuid": "17ca13d3-659c-41ec-a5b3-9e7baf060d16", "comment": "Malware payload (WannaCry)", "value": "88553fc17660993362afffbb1fb010307ba8740ff46fbbbf02b8c7c2ecafeb16e2b3e305303b5b182a5fc89a29ddc409", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242312, "uuid": "20e55bcd-0b61-4394-9df8-a53940138c4c", "value": "T1EE363354A1AC66BCE0A10EF51027CB25A77B3D14A6BB962F4790415F0C73F5EAEE0F09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242312, "uuid": "490339f1-6296-4d25-a0f2-a57bdf605057", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242312, "uuid": "045b0217-3108-4f85-a7c0-eb14512fdf9f", "value": "98304:TDqPoBhz1aRxcSUDk36SAEdhvxWaC593R8yAVp2H:TDqPe1Cxcxk3ZAEUaCzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791242312, "uuid": "6939f7ae-7a39-4c9a-8f6e-4e2a7e235e69", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791242312, "uuid": "ffb88225-3882-4da9-b434-326e0f48bf9e", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242312, "uuid": "01621f24-9201-462a-ac31-22497ecc5763", "value": "mbupload-0vnlh1tg.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52252bd-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791190665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190665, "uuid": "506972dc-0a36-4210-b7a6-e9c15cfdd5e7", "comment": "Malware payload (Formbook)", "value": "2b06974e3264687f1837786b8e79c604", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190665, "uuid": "52b253f0-b9eb-4fd5-8eb7-e62591c6680a", "comment": "Malware payload (Formbook)", "value": "133d7c605a3a184da4752b3dff5627f85ca20e4a238357e9e0b71653ed055334", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190665, "uuid": "dd251dec-a2c0-4a8a-bf30-1c74efe6c155", "comment": "Malware payload (Formbook)", "value": "0fa546e68ac7af8828cae9fc899e7154016150c1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190665, "uuid": "02e8f7b3-e622-48be-8ae3-141d0dbed682", "comment": "Malware payload (Formbook)", "value": "f2df03052917f05c71cd8ac125cf0ac592d20e0d1db3fe6946ed629e89b19a1140c0bfa8ba1f293b4fa93406647d8c90", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190665, "uuid": "67c2744a-1529-411d-964b-73ed29e3910b", "value": "T1FBA5F15088C03FE4EB7A561840FD652DE3B1069B482E6D4ABB3FBD459FB7904D2071AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190665, "uuid": "47cddfdc-2f6b-4fcf-84b8-f868907284a8", "value": "24576:hAb5rAPbHnG2X79Srna+hKW311AQjG/P1AJADmdi7YZw/97m23x9Bpp:hAb4jXyriWJAj1Tp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190665, "uuid": "c8f8e972-e0b8-4f6a-98ca-c67fecfd5b1e", "value": 2093812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190665, "uuid": "30713d12-17aa-4e76-b30f-ef23cc7f8604", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190665, "uuid": "dbddee26-3dba-46af-b59b-fc059ef7be9c", "value": "RFQ 07283 Image.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798582d8-c083-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791180633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791180633, "uuid": "b032d9b6-2a25-42d1-8aa6-7f89296cbbf3", "comment": "Malware payload", "value": "a864d29d857a24c79cff0537da15efe3", "object_relation": "md5", "Tag": [ { "name": "ConfuserEX", "colour": "#9AE1AC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791180633, "uuid": "c4de13a0-f94b-434b-a900-04790a33591b", "comment": "Malware payload", "value": "13add98d1fb45bc64b2bcc839920447cbe09cb0d71a3d56aeb28cb5d3162327e", "object_relation": "sha256", "Tag": [ { "name": "ConfuserEX", "colour": "#9AE1AC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791180633, "uuid": "be67b9c7-fe37-4783-85e4-2cc1f9f718a7", "comment": "Malware payload", "value": "45265dcebbed21201339b37211ed7d5f91e8239a", "object_relation": "sha1", "Tag": [ { "name": "ConfuserEX", "colour": "#9AE1AC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791180633, "uuid": "4a8bad50-2f3a-4f95-82c2-909675185095", "comment": "Malware payload", "value": "c7bb2dddb425b4e779fb1a2343373c84c1e6968f66d51d94dbfb91e09f79db561a5252b48df8ccc3fb800fa38c0891cf", "object_relation": "sha3-384", "Tag": [ { "name": "ConfuserEX", "colour": "#9AE1AC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791180633, "uuid": "47dee726-2aed-4366-a209-ef02d8645c4a", "value": "T18B43DA8C765076DFC85BC876CAA81C68EA60747B831BD243A46316ED9E0D99BCF150F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791180633, "uuid": "7446ee23-3238-4d73-baef-757ccb0600c5", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791180633, "uuid": "161ce688-080d-445c-9272-80785681f35c", "value": "768:MTT1+0m1PyFGEsVGXYVfz3XuOjiJcqVWQn4E3zUrtRij+wc9LBl:K40m1eReezCqB4eyy8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791180633, "uuid": "c59029da-8818-4e40-bd99-9f8694faf9e0", "value": 59904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791180633, "uuid": "b5f5d2b4-2dfc-40a9-8cd7-9786ef2723e8", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791180633, "uuid": "a7981ea5-1532-431a-84c4-76775052e21e", "value": "13add98d1fb45bc64b2bcc839920447cbe09cb0d71a3d56aeb28cb5d3162327e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791b4ee9-c0ef-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791227018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791227018, "uuid": "8274eb20-cc37-49e2-9f64-d6671dcba45c", "comment": "Malware payload (Mirai)", "value": "d33ed5ca239e4182800c54a410c68d5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791227018, "uuid": "e093c91a-e9b3-4dc5-a283-c6e0ac3a26f2", "comment": "Malware payload (Mirai)", "value": "13f62c9351ee097cee678bac41866293e1ca7ef4130a651e173dc751cabdfa0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791227018, "uuid": "cc5124aa-1e50-479f-89d3-5eae13b82fa3", "comment": "Malware payload (Mirai)", "value": "a62daac86a47b73cc7a47e6111761a33f50c48ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791227018, "uuid": "d0776e45-b47a-45d4-9ced-42e122e7855f", "comment": "Malware payload (Mirai)", "value": "2cc98cdcd855a9e694825f86ab5b24eb507eb6fcca79f7f640c8d286d773cadb9b96b21762ee3302cf4f76ace8e7e0d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791227018, "uuid": "aaaf4b7c-bbe1-4b3d-93a6-35970201a951", "value": "T1B4E3D5FFE7271A23C0C51071D1E30233A4B9D77838A9D797A8D3EC692E1AA8435157DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791227018, "uuid": "f478ca69-67c4-4628-ad3e-6d2f6c0837de", "value": "3072:P1UHOdaOMPjN9CT18YqkDPhBIZ4UbhTr5:POR3IqkDPhBIZ4UbhTr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791227018, "uuid": "581be1b1-f436-4cf1-9eee-b93de3eb13b1", "value": 155299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791227018, "uuid": "942779f3-a5c5-4902-8c42-6eb7708edbbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791227018, "uuid": "9492ea2d-6c88-4a33-a445-b530eebdca82", "value": "systemd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad02be6f-c08f-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791185874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185874, "uuid": "51d11fd6-2669-4044-bee3-aab1f8007681", "comment": "Malware payload (Mirai)", "value": "2ce0458e9e593c6e3fbc0ed44f2535d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185874, "uuid": "14e97b59-d500-4baa-962b-5c639feb89df", "comment": "Malware payload (Mirai)", "value": "143126dadf84d74c3f693666f4bd1dea51da435fcfd8eff42fdce956ac9eb7d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185874, "uuid": "7f9ac897-7f4d-44d9-be68-5464ea623811", "comment": "Malware payload (Mirai)", "value": "334d4a64b14120f5cb5093fc1a7118d8eeb81ecb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185874, "uuid": "98a64a4b-716d-457c-bc0f-b97188cdaf6d", "comment": "Malware payload (Mirai)", "value": "b30924ce59e4d6a15f7cb65421b95fa3f3f6023dc7aee9a4a7640af946624d4231ec364a9b083a14e84a3cd3161dc35a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185874, "uuid": "729b4e0e-1476-4095-aafd-5e322addb925", "value": "T152434A89EA93D1F2F08742710367E7AF9B34DC3A4010DA9AE7593E31ECB1686455A72C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185874, "uuid": "485a0739-cebe-4c97-8e28-fb628e6e87bc", "value": "768:Qtjk0c74AeHYFkjVIpcUlxuXaxlXK0SENZ5x2h14097hRTMZ//SbzErIv:eVc7cEpccSaSzwZ5nohRT6//Sbor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185874, "uuid": "a3147e02-e887-483f-b4a0-f7f108fb2c5b", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185874, "uuid": "66934231-967d-4856-bcfd-86bf5dc16d3f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185874, "uuid": "0f2fad49-1565-4bd9-bd3f-1d2fbe8a2a1a", "value": "bot.386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4bf2d01-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791216381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216381, "uuid": "f98b0b38-4f28-44da-945a-8f69194cc8b2", "comment": "Malware payload", "value": "33786a015d45fe4a6f31c748cd097450", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216381, "uuid": "6b2b84ee-f52d-4c88-b66f-888fd5d5ddcf", "comment": "Malware payload", "value": "143b7dbf88d21179849902f0c8339ae920fc7fe68810dead10dbed10a66a947b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216381, "uuid": "0e1a0233-cc97-42d7-8c12-b78c37905087", "comment": "Malware payload", "value": "4f2423886cf07a5327d021707a6115e5066b80d8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216381, "uuid": "61defb2f-4527-4668-8e7d-aa958ccd79c0", "comment": "Malware payload", "value": "aa6265c0dc5c843ce18163b303c363eb51ae68ec14ece344f8bb536130e5b059c457667a0dcb29fd63b5ac149ac00c31", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216381, "uuid": "de33c3ab-0b5b-4bdf-ad72-f0b74d3b2f3c", "value": "T15BB49F6061E31E71E2AD4AF794A98444037AC27C9ABFFF26545F47BCAC03346A213D67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216381, "uuid": "2043e3ed-4846-42e1-af51-020e12617843", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216381, "uuid": "21d4b1f0-875d-4035-ad3f-0be1a35a468f", "value": "6144:LMxO8c6nu6TrQYVhUmGrSfhl1cMxgSsClW/vpwoF7FPuBsW/rBhEy0ewMga8QBD1:LmbTQgxGOZq0W/vpwoPPyrdlwI8QF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216381, "uuid": "2618cbaf-2bbe-4db4-a7b0-6688d7fab405", "value": 540161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216381, "uuid": "5d68d60c-41fc-43a7-a127-55c6553b5a32", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216381, "uuid": "c4531135-120a-48d0-a688-f95619a3f7b1", "value": "Noogen.Validation_4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd753be3-c0e8-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791224180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224180, "uuid": "f5f7a992-326e-43e7-8a98-81025c672a77", "comment": "Malware payload (Mirai)", "value": "18d3d1f72eb74e85eb98502ad84d40a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224180, "uuid": "c975e61a-4c85-49e0-8e0c-e71700620bac", "comment": "Malware payload (Mirai)", "value": "15097ecaf29a106e53447afe3586c0ab44c87d405abf85aba8f5d8c19b8000dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224180, "uuid": "1641da12-feca-4ee7-94f5-3e346b5215d7", "comment": "Malware payload (Mirai)", "value": "9d726f8d27ae729811c51eaee8d8e8927e242623", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224180, "uuid": "f8adf394-3087-46ab-8c64-2c9209715eea", "comment": "Malware payload (Mirai)", "value": "d0c89343db4f205b182d39763beb100df0c5637830ebe21eb97ac349d7b386d3047c242fd75808510d5323083f132e88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224180, "uuid": "0abac272-2477-438c-9df9-ac538a32200d", "value": "T1DB242A49FC91CB22C6D126BBFB2E428D732753A8D2EE71029D246F7427CB55A0E3B145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224180, "uuid": "e577ebc9-4859-4ff6-b5e4-f52dcb4f0d50", "value": "6144:sow3QVtDrx7Vh6Ty4698L6vRk764dATUQ+5PMFatm:sokIfx7Vh6Tl698Lh64dAg5kFatm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791224180, "uuid": "8a2272c9-80b9-4b58-9d8e-2e3b624f2773", "value": 224024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791224180, "uuid": "ff612fe1-9414-4231-bce3-96e86289403e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224180, "uuid": "07600d68-a3cb-44ff-9c24-4effc4c44d91", "value": "xnxnxnxnxnxnxnxnarmv5lxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f91c31c0-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791190726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190726, "uuid": "65c43210-63a9-440c-8c6b-be66e13b5d0e", "comment": "Malware payload (Formbook)", "value": "af63e00778c43278300d73a8778eecac", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190726, "uuid": "61a253e4-ca84-4b2c-8b29-fb200c464183", "comment": "Malware payload (Formbook)", "value": "152fba31825e5531c40abb01bba888113b8090988fb3b032136c2eac796b00bb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190726, "uuid": "0df52443-9881-4dbc-b376-af57912efb83", "comment": "Malware payload (Formbook)", "value": "559e36a7f7c10f23e7f35bbc1ddb11d1e8bee538", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190726, "uuid": "35b14826-1a7b-421b-b63d-0e860cbbda3f", "comment": "Malware payload (Formbook)", "value": "0410b040eef1c933417d855826d3a20a35fd8acc0428a1cb9b6ddc795f84b9b249a2a6c885d0b55961a8ccf2e55a303d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190726, "uuid": "be7e5588-76a1-4740-843e-c6e38501d29d", "value": "T167F57D3C8084FAD2B2E9363AC709659726E170273DD1DB7277EDB9691349F423387A24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190726, "uuid": "1d3e1aa3-a4b2-4d61-ba16-2393d7a72a2d", "value": "98304:5z7QX3r3IjrnU4mVYsXJzoGavXDLA7+qKenHTmd1bG6L+hqzHn8V:5A3DIfGVYoJzoGavXwX6L5nA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190726, "uuid": "54b9021a-a0a7-4e69-8341-eaff67e32969", "value": 3322630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190726, "uuid": "abb17db2-d941-4f9e-8e9d-feda2b5d9087", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190726, "uuid": "75896317-8eae-4bfe-bad6-67d2e713a025", "value": "PO - DSM943567.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d73b1855-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181649, "uuid": "91f3074f-862a-4bb6-be85-39a08ae69b58", "comment": "Malware payload (Mirai)", "value": "34ac735aa75df9998af623f1f43158d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181649, "uuid": "08d543a4-c791-4a4f-900a-1fee21c2a3c5", "comment": "Malware payload (Mirai)", "value": "156d86e2d075a24f3e7f851fb067f87d5d64efadf45a15ba2c192eb24a5e5781", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181649, "uuid": "8eabef0a-4595-42c7-a847-4332de8fa46c", "comment": "Malware payload (Mirai)", "value": "305978c1d8e118991348521709ba3cc4ae1bdc45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181649, "uuid": "7b17dcdd-b1d1-4c2b-8ed4-39c685981279", "comment": "Malware payload (Mirai)", "value": "e062bdc7a79c8a551c4f1782da3878f46d6c9a1db675bb3bdd1077e6f2f8b00ee787b95e02a5b6de059cdeee778cca8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181649, "uuid": "dd7f4de6-4b9a-4103-91b6-1d6c251199e3", "value": "T153B2F195E6EB2BC3D391D336E07C5A4DE2721AC00747440A5009B68F93EB60E4BFB7A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181649, "uuid": "7ecf9c86-d82e-4e9e-a185-ec576c633615", "value": "768:H/QOC0Yhn6ROHWFjicwNqFOXnNBxcdn7Ccn:H/nihneFzwBNBaPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181649, "uuid": "27058808-621b-4c2c-a763-19c1b424c6a9", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181649, "uuid": "3b08a3aa-85df-4390-9eea-e6c2341f8b6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181649, "uuid": "da537911-12d8-41a1-be31-4c34ab87360f", "value": "87sbhas6as.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41283968-c0ef-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791226924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791226924, "uuid": "5d9ac800-77de-42b3-9650-4f075230a615", "comment": "Malware payload", "value": "1b404e73a69a67d013fa7724b94c3d4c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791226924, "uuid": "8cd86607-5397-4f86-b9e7-da8c2e95ee4d", "comment": "Malware payload", "value": "15ec23f21d4e3742652166bb40e73b404d230fc6db828d6b7d088aa44f067f41", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791226924, "uuid": "4ce30bf9-6b2e-4325-b37e-77e89a0b34ed", "comment": "Malware payload", "value": "ee10c154fcb4e83ab9866dae18e7057f57880e91", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791226924, "uuid": "9eb92477-7d80-40f7-80af-e9841845e437", "comment": "Malware payload", "value": "d1f316ecaccbab2230c4cbbe031e26708bd4c83d966ab88d5cb63fd14861f958258151845e1ca177fa9c122aba46ece3", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791226924, "uuid": "3185d97a-727f-4f97-93bc-77e1085bf4d7", "value": "T1E4463324D9BD267DD4632330D4860E277B8E23C4AD016E2F2FB418BA0D476C66FC5B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791226924, "uuid": "eb919a74-2d52-45db-9c71-04cca0a0c59f", "value": "98304:jQX66vQGWc8IQYrc16j5E0iG6oEiUyqtka0fyLmm800Dx+KyksqYGA:Q6MQ/+QR16j5E0bjDQUG80S8KMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791226924, "uuid": "4a56ee3f-5648-4e4d-9876-5d49c01ebbe6", "value": 5636677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791226924, "uuid": "5b40eae0-32ec-41ec-bb2d-d341ee203073", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791226924, "uuid": "bc40faee-b690-4bea-8eae-9989ff918f41", "value": "KRYPTON client cracked.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539d8ace-c0e9-11f1-927a-4201ac107004", "comment": "Malware payload (OverlordRAT)", "timestamp": 1791224378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224378, "uuid": "13e794ef-835c-48ca-b53b-66214a844a1a", "comment": "Malware payload (OverlordRAT)", "value": "1bd738355e034bf5cd53495feb862e2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "overlord", "colour": "#08D60A", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224378, "uuid": "9eed1919-3fe4-4295-9d7f-0d45925e65bd", "comment": "Malware payload (OverlordRAT)", "value": "160f9349178e8169411d385e3ed0bc0cae494d302af225428bcdb10bc9eab84a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "overlord", "colour": "#08D60A", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224378, "uuid": "fc9b291e-35eb-469a-9cd4-a6979737309f", "comment": "Malware payload (OverlordRAT)", "value": "2b6cbf3b86bebe2e1d49b37bf9615188ed2251e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "overlord", "colour": "#08D60A", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224378, "uuid": "7fee9a8f-8f54-495c-b1dd-8aa3fa0ed895", "comment": "Malware payload (OverlordRAT)", "value": "f942ea77d8e82485f06dc2b7a77a94b4fa96b8f7744ebc19e97f61f9af85d59f83e25511957bc69e30aa8d845f61baa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "overlord", "colour": "#08D60A", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224378, "uuid": "a9602cdb-ed6d-42c1-8e43-9087088f6d48", "value": "T11BB63A07EDA554E9C0AED23489669223BBB17C480B3477D72F90F6246F36BE06DB9704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224378, "uuid": "a5947b61-6155-470a-a67a-8ba164f2923a", "value": "e2bf3ea500ed6add4b896d96c842dc0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224378, "uuid": "0a343b59-c032-4443-85e5-e0252884f552", "value": "98304:4zfsVrxncKTQo369t2dm6AEyE9XLUUsmRsDs4jMxptos9+:4QVxuo36+IIyDshtBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791224378, "uuid": "9bec4f31-e9e6-4879-a522-0d855d14b689", "value": 10874880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791224378, "uuid": "213b52a1-70bd-474d-9a66-978f8b96d7d2", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224378, "uuid": "24be63c7-5f2e-441a-8a39-e0188558befa", "value": "svhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b5a4cb-c0e8-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791223823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223823, "uuid": "bab7f3bb-99ae-45cb-9a47-bc0b07d7df3e", "comment": "Malware payload (Mirai)", "value": "c8efe0ffa46ab31b572360f661e2dcc2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223823, "uuid": "c572ab0f-a239-45b5-8a34-6b8fdd6a9748", "comment": "Malware payload (Mirai)", "value": "161ac8612a2e09172f2c7d7a4f893600440585bb087fd5b0f270f1c11284bc1f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223823, "uuid": "64efd1ee-fd12-4ca3-8609-4d3635e351f0", "comment": "Malware payload (Mirai)", "value": "8f8f3330edb662c9f17ff8b04e590a5024b0a2fa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223823, "uuid": "70fa6a2e-09ed-4bda-9630-d0771bd6c351", "comment": "Malware payload (Mirai)", "value": "c7de9a158bd060daeaa6298234a17a1de2a990d44dd5e706b06ec2ffc2efb9c8e238454ba97a7f3864734e3e4288b5ff", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223823, "uuid": "c3bc42e7-1d42-40d1-8cdd-0c96340a2afe", "value": "T1014182CE0182723369A98E1E7DE9CE0631A4D0E6D8DE3D10EDDC7CA9C5CCE68B040B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223823, "uuid": "275131dc-7cb3-4982-9a15-0ec92a7a2c34", "value": "48:vp1WpHMHBQpHoOHWhKypjFjF2Mcpjmj/Spj7j2PpjsjlwpKupHZHG9p25:vmLlyTcBSLlkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791223823, "uuid": "c12c67e8-d247-4e30-afb4-161e5cce2745", "value": 1923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791223823, "uuid": "45acfa82-d37a-44e0-9003-2cd786944146", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223823, "uuid": "b56d2218-1366-4f79-818c-149926d383b5", "value": "Hilix.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856ec82c-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791218878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218878, "uuid": "d8004f7a-39ae-4b0b-8c71-da4f917315f7", "comment": "Malware payload", "value": "d7f7a3ffc5b9cd190812e5abacddcfda", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218878, "uuid": "775e6598-c56e-4303-96e3-20be66ded302", "comment": "Malware payload", "value": "161cb134a94c771862175cc3414017ec6707c831ea112da7422c32608496f44c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218878, "uuid": "7f90839c-09e5-4ca5-8976-0b6e19770366", "comment": "Malware payload", "value": "78b1d4eed72276ff5376d1b85ecbdf471406a53f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218878, "uuid": "55a1d6d8-4ab8-40b4-b996-b74eea6efc26", "comment": "Malware payload", "value": "ee2dfb467058e82c7ed3a76233f965f892c38f93331ade79dfdbb138bc430298b50a043da0a28652ae0812807a5c0f9a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218878, "uuid": "3d8a5786-292f-4ffa-ad26-e10b224db83b", "value": "T16943F24E2D208B0BC1A4747AC3E6990D3E4F74FD55C7EC21D608A8977771DA17CA948A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218878, "uuid": "ba16bd20-cecd-4603-8f13-ea7823c0488e", "value": "1536:yroVVbnFMILnpESRRLLfwLcUVauq6l34vzIGUhpReaa8G:tVbnLnpd3nfccyl0z9UhpRea2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218878, "uuid": "febd7cc5-6110-4ef7-9d7e-4f1134687eff", "value": 57696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218878, "uuid": "829eb244-271f-450b-8cf2-7f9fd653b567", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218878, "uuid": "18d84c72-7591-461d-812f-f5858bb8bf66", "value": "android-arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db741d1-c097-11f1-927a-4201ac107004", "comment": "Malware payload (QuasarRAT)", "timestamp": 1791189284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189284, "uuid": "966e6ec4-fd9e-44ce-bdea-e1a878c96184", "comment": "Malware payload (QuasarRAT)", "value": "36cf6285b152d569a123b34f6a08d892", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189284, "uuid": "8eebccfe-14f3-46b4-9ef6-ad558c310e0b", "comment": "Malware payload (QuasarRAT)", "value": "16c90a2348c565940e936cbdb37014e539d0533acc47700c81c4f281a91f9535", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189284, "uuid": "cdb6f8e5-ede4-42dc-9580-5a250c9b35b1", "comment": "Malware payload (QuasarRAT)", "value": "efbd76e4dbff0ad6829758fcafe26ce911722322", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189284, "uuid": "7f02e80d-0f59-4e18-a99d-0370dbb21ddd", "comment": "Malware payload (QuasarRAT)", "value": "04b48136dbe3ff0e4199756a0f15bb185527d3d6f3e964767501bc839d317d0d99f4b9f958502b5a9e68752c3e118851", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189284, "uuid": "a0e2a407-3264-4587-8372-27727ae1ea27", "value": "T15864F10472D89CE8C27A13B55B95CFB84B73E9531352C39C1E0287656BE8E811F2F6B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189284, "uuid": "b83b5585-cdfa-4434-ac03-0c62cd14617b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189284, "uuid": "3a4b5179-4d36-4b16-98a6-b31fe812646c", "value": "6144:6ftTrTDZsKZsBy4OtJjxpadNqnkOUDmofkz7h0NjWKcnNHSxM6w:6lTrTdsOsBRMtdCWKcnRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791189284, "uuid": "4112415f-edde-4c1c-bffb-45e592edf5d9", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791189284, "uuid": "58fe98df-5cb1-4771-b5b7-7b3634824452", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189284, "uuid": "bf9ffadf-a165-47a0-95a0-1a6a9dde0242", "value": "36cf6285b152d569a123b34f6a08d892.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec749896-c0bd-11f1-927a-4201ac107004", "comment": "Malware payload (GhostRAT)", "timestamp": 1791205737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205737, "uuid": "38c849a3-1cf3-4405-aa05-648f8460dbba", "comment": "Malware payload (GhostRAT)", "value": "8eea5ce83063c6a91067d37fefaaed2c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "GhostRat", "colour": "#66C979", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205737, "uuid": "6971d1b0-a4a2-4681-bae1-f0abc7074c17", "comment": "Malware payload (GhostRAT)", "value": "173192ec576111adbc0c228f75244cf627513c95ca1709036e9850f0cdb7c90b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "GhostRat", "colour": "#66C979", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205737, "uuid": "b4d1a351-cf04-475d-8309-783a7a1610cd", "comment": "Malware payload (GhostRAT)", "value": "511ee156796b0abeda09c2a33c635807c593f522", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "GhostRat", "colour": "#66C979", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205737, "uuid": "df056fa1-9c4f-4402-8943-c0231ed08b5c", "comment": "Malware payload (GhostRAT)", "value": "fb1c9d1c5394dfbc7855bd4a34c9d8e134f72392667d9eb8b69bd6611576b9fb72ad5e4a958cf1acdecc73a481afcf1d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "GhostRat", "colour": "#66C979", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205737, "uuid": "53ed31f7-aa2e-466b-8b81-eb5a2432fd3b", "value": "T1CFC5CE89BB59962FC8BB15330DEA923122478D478E839B437844376C78776E80F59FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205737, "uuid": "438b227c-a61a-46f7-bde1-34f36f17782e", "value": "49152:MP8ERhSVl/tAJouKmgWj2y3UPyxEWeyYeb6CM4jaEyYO:M5RolFAJt2y3U6xEWMebZZjnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791205737, "uuid": "8b028e00-e860-462b-8877-b5868ccc997f", "value": 2569523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791205737, "uuid": "b2e965d6-dfed-43a5-b5ca-d7fe00ead267", "value": "application/vnd.android.package-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205737, "uuid": "3617b516-d4bc-4e2e-a1c8-1cf806b671ba", "value": "_cartao protegido.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28c38de-c0de-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791219786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219786, "uuid": "cc6a1b98-3315-4c3e-94ea-50b871c23be5", "comment": "Malware payload (Mirai)", "value": "9466b3cc76cdff59586aceafd0e3ea88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219786, "uuid": "34cd9d58-81fe-44aa-969e-9b82d08f1cfc", "comment": "Malware payload (Mirai)", "value": "174f30a64d1212415e407dd27082c4c2eb341176197e0438917b85b5856b6900", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219786, "uuid": "1a05ce29-65cc-443e-a526-9f19a0f7d7b8", "comment": "Malware payload (Mirai)", "value": "27607c27233f4e29f34aad109083994a1bfa2ec6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219786, "uuid": "716fdd97-185b-44e3-b1ba-f96ac015c0b3", "comment": "Malware payload (Mirai)", "value": "f75efcd98c6eab67c8b5ba0b347f244f8e6faa556dd55912eec474ac5f0309e6af6937bf4ca08e001bffc39f37e9187c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219786, "uuid": "d14cecd9-9bfa-437c-b315-db1aaba12570", "value": "T183A312A025A08BC5FC00DDF53B8394FC0B9D642C809D766CB866EFB5725EB47BA42147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219786, "uuid": "f0ed9ded-cef2-428c-8281-9b1fb49e24d7", "value": "1536:yLNPWIwIjHjkl8oERij7ILIl4R1ckD8yuG0hRZ+++pueH8hivq3P871ce0GTT1wK:YN+IHKbGivaIl4bhDVWbZzw/8PZ0FwhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791219786, "uuid": "6004b181-70ee-42f0-b78b-8e58fa8c8a34", "value": 99396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791219786, "uuid": "4400f352-9bbc-41d6-bdbb-52eb0d787c9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219786, "uuid": "37b5cf7f-0548-4ecf-a88a-a8a8125017bd", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc715965-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181631, "uuid": "e33c034b-9d80-4fc7-a7ef-3084f0bb6afa", "comment": "Malware payload (Mirai)", "value": "d102687fb8b40d5574caa656294be206", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181631, "uuid": "3081e927-8796-4a8a-8d50-4853de986eb5", "comment": "Malware payload (Mirai)", "value": "17acfd0785f958954a8f3f730f5628f952e2bfc04c0ea9acbcec4fc856577584", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181631, "uuid": "9c54a233-d2f8-4ddf-8ebd-48b2349b3849", "comment": "Malware payload (Mirai)", "value": "c5b1385a65db52fe53604943e3634f0addf598b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181631, "uuid": "27a46c35-c4d1-4302-a07e-3a597645086c", "comment": "Malware payload (Mirai)", "value": "33487fd5169a1af65e2a22750c096adaa202bbdcdf1a8691dfb39962d5b8ce3e0a719e465d735fc14a6cf370faa82ee8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181631, "uuid": "dba59d70-5f7b-4d73-a237-ac14c27105e3", "value": "T17953017172C24266967527B39C29400F259B6F79B1FE9787377DA38839D8187F324E02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181631, "uuid": "b9ba0256-5b2a-415d-ae5c-171951f50837", "value": "1536:rYsmeAqRNBBthB8MqErNBflG3eFrc8tJC:C6PAmflc0c6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181631, "uuid": "b1428b61-22e8-4d91-90f3-e9fc87a78942", "value": 65644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181631, "uuid": "7ceff5dd-7be9-4480-b55b-0508c57326f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181631, "uuid": "fe4372d4-727c-4368-bb30-55e12176c169", "value": "wife.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7009414-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185863, "uuid": "62983df8-e758-46f2-8cf3-12802d54c8b2", "comment": "Malware payload", "value": "727501fb208fc42c4e37c74eea8595d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185863, "uuid": "a69a968d-3f8c-4b6e-ab89-6877afa09252", "comment": "Malware payload", "value": "17ed0fcc15f7ab70b586a5427dc28dc604f60d1967d8133f43706ec782f7f55d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185863, "uuid": "7d625c3a-988a-4433-b3a5-486c26734333", "comment": "Malware payload", "value": "a59aaf45e6cab9481a092351bd6e2db2cf9483a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185863, "uuid": "be7a9672-139d-4dd1-acc8-302f4f1b4c07", "comment": "Malware payload", "value": "26366be782196455ec50cdfa476463b2dd342fc7678f5cd9eb34f246d8a2267b32202887e2cba653e9e8295b8c2d698e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185863, "uuid": "98dbd8a5-e7f8-4c56-8541-87a51cacbc76", "value": "T1C8F21982B7508F26C265C13109F78B52EBE61EE517E29146A72CF9106F3275CA81FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185863, "uuid": "843d8579-2601-4132-a0a3-7279f0a9b6eb", "value": "768:zpg9w2q7iBpbQle/WsM90uBRtJ4//YErbz5:dYwkpbuHWWg//vrbz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185863, "uuid": "525b06d1-e352-4a69-bab9-17466f029717", "value": 34484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185863, "uuid": "71526ea9-b691-485f-a6f8-5f1d83759bef", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185863, "uuid": "697791ff-27ac-4080-aead-798ccc6839d9", "value": "dldr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54e26b9-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181619, "uuid": "2611c128-ad37-4bfc-95e0-bebde701c2c7", "comment": "Malware payload (Mirai)", "value": "aeb81db19e4340d601e33735e7b628f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181619, "uuid": "0a26880e-3034-45e9-81e9-27b40f86af44", "comment": "Malware payload (Mirai)", "value": "17edebfefe365317243dd113e67298a2f235ca0caee138f15dff5dc840190e5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181619, "uuid": "8ff7816d-846a-48fb-842d-98cf61eccb3f", "comment": "Malware payload (Mirai)", "value": "6d42c81c1fe378a1ad1cf24a92265cf03ad29e49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181619, "uuid": "aa727060-3711-4768-aa5b-673d617b964d", "comment": "Malware payload (Mirai)", "value": "37dd6178d3a09378cfca9afdeae9d48e9eb32626a5c5bd6e3eab7d9f96de196146961ba1a6d707517fd9653dc185983b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181619, "uuid": "d581d106-f995-421d-b70f-0882efd7c8d0", "value": "T13E738C33C82AAD24DA4941F470B0CFB84B63A510C29B5FFA55A9C67A8083EDCF5453F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181619, "uuid": "50a6e46b-0332-4223-9f85-d4fc47da2549", "value": "1536:QsmgnxV5R+myhk3oxpKdQRAa5hlpJChwNaEajGI4:Xm4xgphwoxQ+xhlpJ7kfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181619, "uuid": "533f974c-6d9f-4622-aea3-7a1cf7d76a24", "value": 79716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181619, "uuid": "b62ab827-e0bf-45a8-8873-2e599a10a05d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181619, "uuid": "719a7f7f-e5bc-4d3f-bd2c-b4d1db0fdc24", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23415b0f-c0ec-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791225586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791225586, "uuid": "eb4db8de-e931-4d8d-b251-e97bd1898642", "comment": "Malware payload", "value": "2fd7efaa438ab0cec77229545621231a", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791225586, "uuid": "c866f68b-075b-4a81-9b3e-f815d0d414ec", "comment": "Malware payload", "value": "180fa874b663c5ec99b5c67fff5c48f6213e1019df54b13d85dc60074f0af512", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791225586, "uuid": "413602db-5ad4-48fc-a437-c04f184c58d2", "comment": "Malware payload", "value": "0fca999c1e30d58e4f296d721e947941a49c0b9a", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791225586, "uuid": "ad7010ba-8908-4249-82b3-9321e94357e1", "comment": "Malware payload", "value": "99a9f6e267b20a90711cfa928d5fa16a9ef1b4859a9d774d614496b11c6518da49b7a83cfe38573997d7bfcddb8cc576", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791225586, "uuid": "c4d36905-891c-4bcf-8288-7e061168d177", "value": "T1BF42185CAED1B2A0FA1707DEB7AF24690228A0C7200DC484F94CDDE87F06BDD4A57B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791225586, "uuid": "ba6407a6-b047-4964-9c51-ba0f8d2a911e", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzNbqFtCnSozRUM:sXX+/DV7k/3IFtCRUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791225586, "uuid": "5a68bfe0-2c27-4fac-953e-2aa93e625ea2", "value": 12120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791225586, "uuid": "62ab0352-2d54-4288-b34c-06a76ca62c62", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791225586, "uuid": "06f26075-8819-44c2-b6cf-01c41fbc50f0", "value": "temp.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5ae26f-c0c3-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791208151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208151, "uuid": "2313d045-a5fd-476c-87b2-f71749d7aaaf", "comment": "Malware payload (Mirai)", "value": "e8a4f0aa49a5bf13a61aac6da02cfd9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208151, "uuid": "31d4736e-c677-4734-a78f-0b0cca4e00c8", "comment": "Malware payload (Mirai)", "value": "182787f260397382bdff65d9937ff947a7ccbf9f693717536ed022e3f505be38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208151, "uuid": "f0a2d47c-0d2b-45dc-9401-37752e4e6c11", "comment": "Malware payload (Mirai)", "value": "a9b9eb4e7a6e3e789ed14ad2cf3db084ba5ba235", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208151, "uuid": "f7bf6d32-3dcc-4cc9-8cd5-baf98d5d2db5", "comment": "Malware payload (Mirai)", "value": "a219a98348f5c4c5830753c85a8f38567d4d5a8f3c9d751f2adf1d5e7303ccf67f37f71e3ac140e23ba9032da3080658", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208151, "uuid": "50062128-2448-4b37-941f-910f1138e12c", "value": "T1E6C32ACDE642C1F7D8431AB1E257A66B46207A39491ECE45F3DBFCB897228C871057E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208151, "uuid": "7cf2abd5-9a6a-4767-9ab3-9f5441c6bd96", "value": "3072:M4hwdsCSqoXDyjdWub+j2pb+2ZFILEDnyo5XE8hGEn:M1dsC7kDPml+2j+EDnyo5XE8hGEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791208151, "uuid": "18608061-f5b9-4f8f-8fea-7b36b9d22323", "value": 119084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791208151, "uuid": "bbaaf632-008f-46aa-8155-1fc20d47973e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208151, "uuid": "cc37018c-aa92-4150-8d34-187b7a919a2f", "value": "182787f260397382bdff65d9937ff947a7ccbf9f693717536ed022e3f505be38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9992a3d5-c0e0-11f1-927a-4201ac107004", "comment": "Malware payload (Vidar)", "timestamp": 1791220630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220630, "uuid": "277a8169-a741-4d0c-8e0b-1239829d5de6", "comment": "Malware payload (Vidar)", "value": "74de2ab5ff79006b0f18deb133a791a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220630, "uuid": "b8172a66-2c49-4454-8d6f-ead1696acd70", "comment": "Malware payload (Vidar)", "value": "1a256fa228d60488917a5a67bbbfeac9c08c178bd34c48e9c7e22c18b2a7b369", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220630, "uuid": "343f1c7e-7984-4b7e-afb2-51850eb9f67f", "comment": "Malware payload (Vidar)", "value": "d322ad528e0efd9a2428b9730d0b5f9ca7437519", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220630, "uuid": "34903817-b414-48b3-9c7e-b253966cf12a", "comment": "Malware payload (Vidar)", "value": "31acae1453381375a6c6f4495a5829425172246751e863d5d7109d4457d3c1308844650abf4d24cfc98156cbb9dc7d9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220630, "uuid": "16f85a38-ab93-4952-8678-d56d622f9d96", "value": "T16327E6073348009CC95BD27184B05E6913B13DAE8535BBBA5FE9AEA46F037967F68F04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220630, "uuid": "a14d77a7-7384-4620-aeb3-af60817794ff", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220630, "uuid": "a11f359e-7c60-429b-b32a-9bf7a5b35890", "value": "393216:8LnSdZGJnn3c/BWaSwB0o5dR35t7bpo2JcUEb8QKXQm:8LWGJnn3c/BWaSwB0o5dR35t7bpo2Jc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220630, "uuid": "676e46db-0677-47fe-b582-40c6438d9a8e", "value": 20377456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220630, "uuid": "3d80be7d-1b36-4cab-96fd-68cb9ad33807", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220630, "uuid": "fac5dac8-4208-4252-90b9-193bb0fd0ea9", "value": "1a256fa228d60488917a5a67bbbfeac9c08c178bd34c48e9c7e22c18b2a7b369.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62e2d75-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185889, "uuid": "0a3ae108-0d83-42a8-a914-94e36d61859e", "comment": "Malware payload", "value": "ba35debdf0a291471d4cfcbc50bd1337", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185889, "uuid": "a94b466c-0a37-4fb1-889a-bd7ed584a9e1", "comment": "Malware payload", "value": "1b031da3f6b8b3cd85d01f49837007ee8b1072c114ad2b07f59cd2e807c7ee14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185889, "uuid": "254d3798-0a2c-4e6f-906b-99dd32075a19", "comment": "Malware payload", "value": "9e67072987c03cab298a560dd3638a93e90e636d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185889, "uuid": "75d0d8c8-5b67-4af7-aa61-df9708a84bb4", "comment": "Malware payload", "value": "63c047814953d7945993884c7b8b7888f5bf90bf8ec1688651f586a1cd131fd484cfa883ae10d5217d0d3920ed727561", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185889, "uuid": "0791de03-0d89-4af8-9143-44467f46f83e", "value": "T15DD4238187206B7AC62FA8ED9E95235DB85B8B3FA09785D7F035E077802F60756790CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185889, "uuid": "a1ba49a8-a0fe-4d1d-8a1b-1d4d13374d4a", "value": "12288:IOPfWphoo6rcBY4fw4rqcZdeoR542bJzWrUP2qgn0hXwYHIHCOG5CUWyP1TviES:IIWphIcBh/Hh59JzwUPQswYoHC9C2Zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185889, "uuid": "41145d41-d72d-4c8f-a219-8ebc8b9aa06a", "value": 620320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185889, "uuid": "710ef3bf-ea4f-4a23-837f-64a51dbc4f01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185889, "uuid": "10d8988e-66fd-4261-947c-41a08626edd9", "value": "mb.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59b21f7-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (STRRAT)", "timestamp": 1791190720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190720, "uuid": "9ceb1f42-dc11-4041-b6ea-d0bda4672f84", "comment": "Malware payload (STRRAT)", "value": "09f3a2019a1ca1a441fb980117704978", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190720, "uuid": "172980d0-c782-471c-9537-92fe60441386", "comment": "Malware payload (STRRAT)", "value": "1bbc7565794c90387f04ebda4f720ff71fc21a436679b577b3793807bada9c3a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190720, "uuid": "20a7064c-1364-4f3c-b330-65760573bd0b", "comment": "Malware payload (STRRAT)", "value": "4c42c25225fd5518dc1499e1a6ee266e8a3f5271", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190720, "uuid": "de25cfc3-761a-48c9-9822-3f887002b8ca", "comment": "Malware payload (STRRAT)", "value": "2f68b86bb8f895e8686be22b5df1b2acae5ce6318458ac04d0e01ad5ec9c4c838e592fa3f4c71f562aa2e3feb2223e0b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190720, "uuid": "3fed3f8a-75bf-4a5c-bd5e-1a2dca8e15ae", "value": "T12D051055B36A098B1B0B9E34341A1D637BB80B60EFCC49C49657EE998C5EFC70359E0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190720, "uuid": "28dfd31b-179f-4066-a900-9ce52b4bd193", "value": "3072:OJErxebXbT/VoDiayiTw+Al+pvR1eF7sLvtIVdKZE6MtcUQMJysy2vEqTPICSnrg:0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190720, "uuid": "5fe73ed4-b06e-4b3a-8c3c-ac2de5ee96c4", "value": 848934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190720, "uuid": "ffd6197e-bbbd-4925-b205-5d51ccd5f7c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190720, "uuid": "a0f2472e-b9ac-4c9a-a5a1-605348a223fd", "value": "Invitation to tender. RFQ 2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd625225-c0bd-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791205658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205658, "uuid": "d5fd0808-6e5d-4ade-a19a-9cf55691dd50", "comment": "Malware payload", "value": "08e1decd362e9cd559fbf18fe30aaf38", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205658, "uuid": "d12a5949-e945-473a-b160-0fbe5af9ef62", "comment": "Malware payload", "value": "1bd7047740a40e48aff1df37b06ad2c1612e6c50aaaf395a16aed180cf4c296d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205658, "uuid": "c3fe49a7-8fa2-407a-808d-1f586a7434f8", "comment": "Malware payload", "value": "dea48c075a142152ac9647552db072a5d01c98e2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205658, "uuid": "fb5c8962-3297-49aa-9906-5c9464c48a3b", "comment": "Malware payload", "value": "c5cd0e8ca620b2da47cf200a84894fcf856ee371845eff3986394af3bdecc24ade2f7887f1958903f73764d58f6aec2a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205658, "uuid": "d0aabb05-676e-4ba1-ba84-1bb29e6e7404", "value": "T1C6B63319F42E9C15EAA5313C7F09125738363CADA320C122A636833AFFD77D6D95A361", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205658, "uuid": "f7f7b8fc-1a8e-4b2a-9417-a42336ea59a7", "value": "196608:SH/kojPiTlxIC9aT5BsNLGomV6HXwou6cR0SLLJFcyvpqEM2T/WDsGv:sM5pxX9aTTsNqoT/ty0O7hPXT/AsGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791205658, "uuid": "d3f350ca-9040-489b-9cb6-96c8e1ce3598", "value": 11112932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791205658, "uuid": "476a60c2-f8ba-4108-b2ea-4ac0912dd760", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205658, "uuid": "b9be3239-dbec-471f-a45d-a85906a7dd8c", "value": "Stone Maquininha.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82fc2b0c-c0e5-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791222740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791222740, "uuid": "1f5c4005-7cbb-4d3a-a6dc-d65190fea6d0", "comment": "Malware payload", "value": "822d03fe303f28b4dd6d22eae96a44f9", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791222740, "uuid": "4552fcc9-6a0a-4ebd-b8b5-8a60e36dc2e5", "comment": "Malware payload", "value": "1c7307d4c302f8df999d6ad02020a047739ea65a565513a696b3e7765affd633", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791222740, "uuid": "95c0640e-4e0c-4814-abd0-a5c6f693dabc", "comment": "Malware payload", "value": "3c69e31027cb2693363172db55733a23bd025bbd", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791222740, "uuid": "647f46d7-5d8f-4d94-9d30-a1f8c13594f5", "comment": "Malware payload", "value": "75d919658b49e7ebbb83c7264e7088099aba7d0817fbeee81bc0a9ecfde7f9caa60b31f2d89a0cebb6c3b27e55299582", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791222740, "uuid": "fb34078d-d338-4d78-9cc6-06c5a3507542", "value": "T13C08330CD3B5910DFC6230F559B83DD956016CEE01FAA562E2AF92CE71AE6F2C631C91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791222740, "uuid": "82a6c0d9-26ea-4fb3-bbf9-5f2d990fff8d", "value": "1572864:I80lOfrXk1EbPDfKyeVk0uJgxPGogagKCOge1Gg9zeivS8VRJ2mH:wGrXkKjDfheCXSxPPMFOge1pCivTVjFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791222740, "uuid": "2f8f246c-e1dd-4a47-a512-5a271fdd71ef", "value": 83158824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791222740, "uuid": "ca3043b9-69e0-45d1-a909-328be9f8d8f5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791222740, "uuid": "08aeb2b6-f006-4b87-83bd-cdf77e5ee959", "value": "aTVIoSm1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff0561e-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181771, "uuid": "7144037c-8e4f-4384-becb-9e189223b5ce", "comment": "Malware payload (Mirai)", "value": "cd728066e6a9992cb0f2ff1ad4a7ff8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181771, "uuid": "8b78573e-fa9a-45b1-a847-174f5158a25c", "comment": "Malware payload (Mirai)", "value": "1c8a42d4a9ba6e96066b284ff41282abeda1c0aa0484b9408fdbe74292cf1f27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181771, "uuid": "70f7ac62-ae61-48e6-9e8a-8f289ebdee00", "comment": "Malware payload (Mirai)", "value": "51dbca305460d17a33a2273363b67518d59dceae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181771, "uuid": "d18c2469-84dc-4a89-af25-4f5c7de6585e", "comment": "Malware payload (Mirai)", "value": "21992a09767479d6a3c12395ff1b1934e008786af326a9908db364ec67ca072be03964ef1582cb9f26b79e3cc05a1c29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181771, "uuid": "021d9623-0049-47b1-9e0a-382f5be6290c", "value": "T169C32B46EA408B13C5D61777FAAF41463322DB5493DB330689285FF43F87A9E0E67A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181771, "uuid": "3d66cf8a-ce3c-4058-933c-56fe4412b75c", "value": "3072:v8PXmy9MV9JXM9fN30yDShgFKeqBEXCwrM/9Jwu/:EPXmy9M2T0yDShg4eVXCMM/9Jwu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181771, "uuid": "f843d3c6-2f64-443a-b204-fb58ed18d6c6", "value": 128880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181771, "uuid": "208c8c2f-4a09-4792-be69-86f0b41d5767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181771, "uuid": "d399a59c-bb9a-4863-9409-064026d457f4", "value": "87sbhas6as.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2717c85e-c0c9-11f1-927a-4201ac107004", "comment": "Malware payload (CoinMiner)", "timestamp": 1791210560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791210560, "uuid": "accfb581-925d-4b40-aa22-aa1ff1baeab1", "comment": "Malware payload (CoinMiner)", "value": "1f4d1005636f7c8f21df632d54745cf5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791210560, "uuid": "3fb0e6bc-c291-4d8d-9e54-ce8e3aa6614c", "comment": "Malware payload (CoinMiner)", "value": "1c8fd52d6fa54459b837faf44b8addfdaf01793406a827ae93abcdd0dc497f64", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791210560, "uuid": "7b5e6649-ae08-4ed5-b7f0-12ff8fd6f948", "comment": "Malware payload (CoinMiner)", "value": "b7a9e5e096a8e1b42e7d8dcd5d4ac12c01af2cbe", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791210560, "uuid": "41a5ee30-8153-4a83-8bcd-ef3c200cd47f", "comment": "Malware payload (CoinMiner)", "value": "19c420494dfcc4c45f2434402eb15e1d11709a8414a4f9d22cd821eafe27752d6875a91ae14d7e3ec0b700932be9e117", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791210560, "uuid": "5c9230da-6fe9-4a08-8869-9d60d0ed256c", "value": "T1B2222A1A6F8E4132E7914DF067F88A4E95BD64331B96B2EBF373C5990F6438484406AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791210560, "uuid": "53e9d821-830e-41ab-959c-1e1a38c564eb", "value": "9bd4d61f2bdd759a3539d644c013268c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791210560, "uuid": "667b1a26-286f-4afa-ad76-16bc70d7318e", "value": "192:8XM8dQBBw0/l+eLjtjVGFJxTEimFhyee:8XMyQL/0eGFwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791210560, "uuid": "17fca50d-0d44-45c6-b696-9f6f96152e8d", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791210560, "uuid": "821e0be6-3416-47d1-9039-3e13936753ff", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791210560, "uuid": "59f49004-8060-4ccf-a982-61f57a2fda7c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1125e368-c0de-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791219542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219542, "uuid": "77aa5f29-cc24-4579-9a7e-1f01f4a5bf91", "comment": "Malware payload (Mirai)", "value": "40a47ac451bf83c5bca4d877ab832420", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219542, "uuid": "266dd036-4ccd-4a2d-bfb8-25b0ae841c4d", "comment": "Malware payload (Mirai)", "value": "1d22acf142eedcdf34f2d3322747d86aa7706ee14197af8be0bae4546c5674f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219542, "uuid": "3fcce79c-452e-4523-b290-989da1eb57be", "comment": "Malware payload (Mirai)", "value": "a8b39dda47320ad0f45f4192ce901c5622fdcf4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219542, "uuid": "dd90db23-0a85-473e-aad7-a0a6a92da100", "comment": "Malware payload (Mirai)", "value": "dfb425412a111f2ebbbad0beb6cedb49d809b8d41afa53fc98870137c366446ae714524616410ecdcceb5a1f8bb034a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219542, "uuid": "807e698e-83b0-4654-b22e-d510c5e91c89", "value": "T1DAD44B03272D0B83E3974CF0777707F4879AA85620F9F589EA0AADC69771870625E5CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219542, "uuid": "b1758377-5e0d-4d3e-8e4e-3571eaed4513", "value": "6144:sqCtSOfKr3lKKpZEb8Ot7jtcWwlo/PdmD+E2pY8MSbFWGUy5jxb6Pm3+deqFyg4n:TCoOfC3lK+Vumjn8d3J3+dAg4VkuAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791219542, "uuid": "f33e0a18-5fb1-4332-9a99-0ccdb51543d8", "value": 641456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791219542, "uuid": "dd2fda9a-5463-47f9-b3de-1443250ec0d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219542, "uuid": "865e813d-07b5-42ca-a953-4ddee08acda9", "value": "powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba75bb7-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (DonutLoader)", "timestamp": 1791190676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190676, "uuid": "4fd3ce32-4bff-44da-b67b-0f46f07836aa", "comment": "Malware payload (DonutLoader)", "value": "0cbcd6e50e393169f5964ddef8800343", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190676, "uuid": "7ea7e068-9cd9-423c-ab84-61d3acf2fa35", "comment": "Malware payload (DonutLoader)", "value": "1d345ed7e1155e4bab152e192ce2de0ca47377bb4ab13287ea8dd75da0351a92", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190676, "uuid": "815af779-641f-4a5b-9d6c-3b6394058a47", "comment": "Malware payload (DonutLoader)", "value": "644ce59154970e2dae1b93bdd6eb4f69264721eb", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190676, "uuid": "a9c51a0f-17fe-4174-b7f8-e973ce63f58c", "comment": "Malware payload (DonutLoader)", "value": "d4fe317cd1d16a883c875e0455b071fc1adca3a0a0c8c0cc4c8171af8be57e9d966979b4db57b66cbaba96800b95719b", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190676, "uuid": "71c161e8-4b49-4b68-8ef5-a054f43e7d7d", "value": "T12CA606A613289675771DAB4CD23AD961A59E705364C9CF3C31ACE209770CD0BB38E9E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190676, "uuid": "92eb176d-999b-4ffb-90cb-54b905872c79", "value": "196608:MlhiP9XPQA5GpAiqrXkXlhL1FJ1IO4Htb8GwENVg3FsoFozGneniBswOYzhV10PT:vX4mG6PrXKhL7CNb8GwENe3FsFaneniy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190676, "uuid": "36999c3d-2fd6-4eb3-b1ea-dbd8a1ad4bbc", "value": 9503874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190676, "uuid": "e42970a6-8686-4708-bc70-9f6dba18bd9e", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190676, "uuid": "21e72e82-61fc-4e2e-9e73-e53c10227cd3", "value": "263077-MM_SPAREPARTS.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8ab92d-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791216369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216369, "uuid": "03522083-654c-4205-8426-f793cf8d139f", "comment": "Malware payload", "value": "2c9892be7ea9a26961b6d73354bb225c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216369, "uuid": "9f0e5689-a027-4aa1-9047-64bd477210a8", "comment": "Malware payload", "value": "1d677848506467b77fd8fbc95825280dfa958d4f7f0ffcdec51f8af085721584", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216369, "uuid": "51c5c35f-780d-4070-985d-715ad1a10025", "comment": "Malware payload", "value": "7723db56c149d23c41fa93b20ad8b999f8e87aa2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216369, "uuid": "314a7657-208e-46e9-b4d6-82ad341796bc", "comment": "Malware payload", "value": "ea4293a5f8e7b02a0d29818eae46806d163a7ba84446d720b67450de33bd7379faa02d5363d250fff6ed5e1baf70db34", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216369, "uuid": "ba0a5b49-89f6-4f1d-8d23-6c82294d003d", "value": "T1BDB49DA425E35E70E2694AF790AC8094037AC23C9EEBFF27505F47FCAE02355B613956", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216369, "uuid": "4e30fdd6-19c7-40a2-aa48-8465669c6076", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216369, "uuid": "f1eedf68-454a-4102-8ecd-291f03878bbe", "value": "12288:6M7tNj3kAxU15qXOluRTQgdzAVU8orTsXD:6MbjUAxU1ceMRM4AV7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216369, "uuid": "6c1c914e-80bc-402f-9734-9e8d8de0cf90", "value": 538113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216369, "uuid": "8babf54e-aa2a-4dce-ad70-4c0c1a804dda", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216369, "uuid": "3c6991c6-e779-45f5-8b2e-f61908198e02", "value": "Noogen.Validation_3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b0b831-c071-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791172809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791172809, "uuid": "aef737c7-ebf9-460a-9dc5-183c8ea60815", "comment": "Malware payload (Mirai)", "value": "95605d0f16c43ed9bdad067ef603e247", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791172809, "uuid": "dfbc8c2d-7e72-4b66-9b71-daf528272c0e", "comment": "Malware payload (Mirai)", "value": "1d6fd65e639d9a3ac93a8c15bf2d39f518b27ff34bbb8b806fc16a1435948a7f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791172809, "uuid": "394cbae3-f8ee-49a4-9f54-c7457a5be744", "comment": "Malware payload (Mirai)", "value": "18f818c32fa94da59de206a4255cae7f95fb6cbf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791172809, "uuid": "8cea6f29-6692-4fde-bb35-f052b10c720e", "comment": "Malware payload (Mirai)", "value": "dfdbdb312bdf59bcb7051640c19d2019fbd206110fc2fc76b3b8c857ecb43c71dad1de085ee8a717dbd95ce2a5ff77ce", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791172809, "uuid": "04538fe7-9bf6-4489-ad50-d5471789bf57", "value": "T1BE04541A3E22DFBBF56D827047F78930569876D636E19684F16CD71C1E2028E241FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791172809, "uuid": "e0bec8f7-fc4e-4653-8348-63ec8cbaba81", "value": "3072:piijwIbzMz69kWMM6fGq++Yft7/tMmejIxfQ2Ru7XY:8ijwIbzMAT6ObBfx/zejgL+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791172809, "uuid": "85491116-3ca5-4623-b638-7c41739e3bb0", "value": 184984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791172809, "uuid": "10188908-e606-4c33-a326-5089c5647da4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791172809, "uuid": "681d93fb-b06d-4156-be88-f33e3d06cfcb", "value": "eclipse.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3ec7b2-c0a0-11f1-927a-4201ac107004", "comment": "Malware payload (PhantomStealer)", "timestamp": 1791192910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192910, "uuid": "434cf0b5-ef48-45f8-b131-df48890d163a", "comment": "Malware payload (PhantomStealer)", "value": "21b252c83386884f835c3914b13bac7b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192910, "uuid": "1f99b868-0517-407f-a640-3818f9bedc75", "comment": "Malware payload (PhantomStealer)", "value": "1dc94adfd12ec56b7553691722125ff59886abfd232441b1ce6698eba7a343ca", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192910, "uuid": "5e94d7bd-73f5-42b1-bbe4-7317ee66ace2", "comment": "Malware payload (PhantomStealer)", "value": "79b9a96d9233b29c3a965dc1396b41c34942b969", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192910, "uuid": "2aa5fa26-6adc-4c42-96fe-e850ea98f10e", "comment": "Malware payload (PhantomStealer)", "value": "6461573529780bbece0f27a011c146362827ef85f9446f988a687eaac1562cba3439ead82085da5ab444c47c260c6b98", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192910, "uuid": "b7550190-6ccd-4190-a124-4b152c700053", "value": "T14606D56D1345D532622AA74C913A8A305ACA700335C9DF3C31E8F3197759E1BB79EEE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192910, "uuid": "15736544-94a4-41dd-9f46-c554d27facca", "value": "98304:iXrPiMYZzdHFPCh0YEKzNLNO/ZQbG3ouAGV4y3XXGrEgxN+L:iXrqMizBCh6BxqGVkrEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791192910, "uuid": "4ad1032d-efc6-497e-af41-6d46cb835485", "value": 3855050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791192910, "uuid": "6761d4f3-11e2-4600-a3f1-9d23b539d078", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192910, "uuid": "b9bd7cca-197c-4593-8013-df3d8835984d", "value": "yltiwebv.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1137f718-c0a0-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791192914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192914, "uuid": "8f902dd1-878f-433f-839f-51619e5f325e", "comment": "Malware payload (AgentTesla)", "value": "06cacd02cd4a44f9d3211bf2e8a14063", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192914, "uuid": "b04030a2-050f-405a-aacb-6ca608d99ba3", "comment": "Malware payload (AgentTesla)", "value": "1e02e2e7fee40183b043e4f5942f667a775b4bb56adb5d6f674295e98d9c743e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192914, "uuid": "18397497-bc71-47aa-b1e9-e146437a6950", "comment": "Malware payload (AgentTesla)", "value": "a551bfb96f700f5a7d7761c53e76d97d47ecb5ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192914, "uuid": "f2031b33-9e5d-4a5d-a9eb-4c369e200b62", "comment": "Malware payload (AgentTesla)", "value": "732f5352ba135fc43c6665075fe5e9ee92e693c167683761f81877e0e6f0b535761ca4594c6f56b2fbb16cdba23ed2ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192914, "uuid": "3d5c5270-fdde-42b8-a5ce-ddf41b788ae3", "value": "T1EA9584364AF0973C20A784C977B11DB6C8F9A605C44E3BC7D0A49DDAFF845B760AB1A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192914, "uuid": "dc58f719-086c-47a1-9d2e-b99c01d4f16f", "value": "49152:ASfv5BhLIiViNFnPRvMmmKuNEZgbh2/b89y4dgwIghzECxr6rE++iptxnarx7EYU:ASfv5BhLIiYNFnPRvMbKEEZgbh2/b89a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791192914, "uuid": "11623459-ee43-4fc2-b035-9afcdfdc290c", "value": 2010041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791192914, "uuid": "e52eb754-86bb-4860-b24b-f2be8eabaad3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192914, "uuid": "4d6bd7ec-2e73-4add-9e15-9b7148c56e89", "value": "PO06202609160034.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24bb2fea-c0ad-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791198530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791198530, "uuid": "a1765d20-bd4d-4295-a9e9-38b573e47be8", "comment": "Malware payload (Formbook)", "value": "6de08f062a31df6b113ab5ad0d611822", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791198530, "uuid": "42bb89a5-1775-4f12-8946-9648c5c3123e", "comment": "Malware payload (Formbook)", "value": "1e67a657db76e435e71bf415296975c61cafa49d5ff219ac641431eb5928f376", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791198530, "uuid": "fddda818-87a8-4127-8e3d-37c137f50a8d", "comment": "Malware payload (Formbook)", "value": "18322f6fa4ad9de0ae2c7a20dc7251654021a755", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791198530, "uuid": "09ea3a60-c8b6-46ef-9343-10c042a12c11", "comment": "Malware payload (Formbook)", "value": "0a65e654af71e1d4225ca6c3e07ff264ba70e537cd1527f9b49889bf7b781e35001b16d5318750a9fd02ee191968da3e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791198530, "uuid": "a873c5f4-d5f4-4f14-bf91-45d9e8ebb8a8", "value": "T18465231D4D2C2CDF0910F6FEB39B51496AE9738B09421B2253ACC2E477F4174E66BCA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791198530, "uuid": "47837aaf-6135-4c56-a0dc-9c76fb0c562f", "value": "24576:sCmX5fHJkaS4RUWIbPa3vg0E+8LbO/Kqv3hR0u5//PSdszpkMNu76ovpme4gt0uE:rMpcYjKqr9HdEvIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791198530, "uuid": "c91cc70c-d1b2-452a-8285-3373ad07e81f", "value": 1534175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791198530, "uuid": "8c06c221-d3d4-4396-be9f-edc6c3d57158", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791198530, "uuid": "823edf16-0e02-405f-84d1-a24c95c66195", "value": "1e67a657db76e435e71bf415296975c61cafa49d5ff219ac641431eb5928f376.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f7432e-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218878, "uuid": "b4e1822e-52fe-4490-a5fc-6aa922e38125", "comment": "Malware payload (Mirai)", "value": "de413c600f5481445479919dc21561df", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218878, "uuid": "446d3b2d-73de-48ce-8514-3e7166a84899", "comment": "Malware payload (Mirai)", "value": "1e6ba1a136a35041fdeb156f22ebf17dffaf21b3687bcd18b5bc354f16fe3293", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218878, "uuid": "4be7a7c6-540f-49d8-a411-2c3e93675d33", "comment": "Malware payload (Mirai)", "value": "21b196ed9a09505fb6507016f47b23646f6168cc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218878, "uuid": "6eea9847-cae6-492f-b297-774f458b500a", "comment": "Malware payload (Mirai)", "value": "84b39ea673480380885da8afc88c79fd43c798a6415387b1f361dd5b184168177a1feb5f74ab8ee3777c55e20e348aaa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218878, "uuid": "9e451226-0fe2-47a7-a387-9e835ee5b70e", "value": "T1FFB31254DC3427B3BD233922F62A531B010DF7CCA6486E47253D57A0BC91C8CB6E9AA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218878, "uuid": "6c5689b4-697e-49a0-91dd-d867132b8f81", "value": "3072:uz/IugiAxPSWVu32eXs6PfmUzM+nuMLqV7Xt:ubIugiAxPlV70s6Puc5LqVLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218878, "uuid": "bbc9ac4d-be56-47b6-8683-cbcb2ff4e9dd", "value": 112540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218878, "uuid": "80728cca-ebe4-4635-8731-72c739543f91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218878, "uuid": "81fbd716-8321-45bb-8fda-617fe89b7b5f", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be38a767-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185902, "uuid": "2e6b58b6-339f-4cda-a8b4-54c0ef9d0182", "comment": "Malware payload", "value": "2b9f7ff0b39ac8b8d845c071d586f644", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185902, "uuid": "e2d420d1-0495-4e86-8ec6-cc8c5704cf60", "comment": "Malware payload", "value": "1ec4583a8120988c4af6a82f1f1dc56c7cfb8b919e381e511807c337cbe96c3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185902, "uuid": "a71b926b-c372-4702-a233-1e38e0b4735f", "comment": "Malware payload", "value": "fa3b0b471df306ec866ac62b63cbe7badb148dc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185902, "uuid": "9a9bdbfc-d8a2-41fd-a5d1-60d32af232a6", "comment": "Malware payload", "value": "c109f3ba4936276555af3ef903882bc7c054df2e73dd24c9269c4bbacd1b4fdd8bf804b041856d806fb586bba2ed9522", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185902, "uuid": "724aa6f7-3504-4a38-931f-393cffc963b5", "value": "T158B5E7227B95ED0BE19821354AA6C37573957E0082A070378657F71C2FBB2F8D85BED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185902, "uuid": "34d14fbc-59ea-4bc1-9b48-1ec4d254dfbd", "value": "12288:4wUb1JKksalHhavLl1vpvQ7xAVhaZIvbwFzZLHPXaIXq2Pl8Yu/Hng/Dk6XX:GifRoVAbMRBHPqo972HCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185902, "uuid": "33620280-c4a3-432b-b933-e43e842543c4", "value": 2424956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185902, "uuid": "747bf2df-46cb-48d4-b00d-5dda6c3a2fc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185902, "uuid": "a1c5e846-d93d-47d8-9816-ee2fe8be1782", "value": "mb.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8057c577-c0bb-11f1-927a-4201ac107004", "comment": "Malware payload (BtmobRAT)", "timestamp": 1791204696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791204696, "uuid": "004936cf-9c57-4db0-bf36-2a30ede42f96", "comment": "Malware payload (BtmobRAT)", "value": "7d66873489dbcb9c98637e99cee05ff8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791204696, "uuid": "896478ca-e82c-435f-b951-548025ebb4d0", "comment": "Malware payload (BtmobRAT)", "value": "1f333d910158316c6211f7b24d118aadca778abb3964f3a4b7d3914e49278b7d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791204696, "uuid": "ec2f3250-6437-4a19-9fc0-2ef1183e13dc", "comment": "Malware payload (BtmobRAT)", "value": "72ec00cefabcb151a246b9394a4f5e3fd348a800", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791204696, "uuid": "65e18719-0f96-49da-87a5-804252445ccd", "comment": "Malware payload (BtmobRAT)", "value": "cf4979ee35e3f8910fb179924f1112d827b6e4e9c387ef04848f56719f33f2feb1a47b3999a93cf78b0b94f8797dd269", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BtmobRAT", "colour": "#8D9061", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791204696, "uuid": "20d335cf-09d8-49d7-b24d-0e4d0e84fd5a", "value": "T1A4A6018BFB88991BF0F743B2413A9361C5474C6A8B439AC75A18723D19B75D02F4EEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791204696, "uuid": "dff43e86-aa62-4871-be0b-3f27686478d1", "value": "196608:F0CVb20DsxDsAkeu4o/Crn51qdetcHFoonG21:mCc0Kk4oarn51qZFooG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791204696, "uuid": "9a70cbe8-b234-4d4f-8543-2a2d18b8c1bc", "value": 9513281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791204696, "uuid": "3cde4e94-6a01-4d53-9944-63e1d58f2963", "value": "application/vnd.android.package-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791204696, "uuid": "b922d385-746f-4785-a21e-383c2e5581da", "value": "viva.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b5f04a-c089-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791183088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791183088, "uuid": "174e9cb0-32f3-49e3-913f-418e80a4f83a", "comment": "Malware payload (Gafgyt)", "value": "9e9bcca687d6ac7190008988b9e3caa7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791183088, "uuid": "ae5f153d-3807-46b8-8dc7-863026c6a6f0", "comment": "Malware payload (Gafgyt)", "value": "1f6e77e1f4cc0987d4d5b429837022d8d1550ac631dc3384592035e540a24db0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791183088, "uuid": "d0b6462f-ff13-482f-9a7a-d6df3b84c370", "comment": "Malware payload (Gafgyt)", "value": "7d459ad7d95cc80ea5541c519caba557fb237c77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791183088, "uuid": "9d12b4c4-47b8-4ab3-a2e6-2371e1588166", "comment": "Malware payload (Gafgyt)", "value": "37ffc9d4bfea20c23bdfe07f68e4b572d34cdee526e4268929c583d9acc83afd9bdb8d2ee5f53a48d2cc065a319c2c4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791183088, "uuid": "b7828468-a1d3-4cd8-8d61-a779938290d4", "value": "T18B344B07B5E0C9FBC4C69AB52BDB95629833F8392B32610A73D4BDA52F0DED46D1C610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791183088, "uuid": "e2d14c86-f530-482e-9216-c5615bd5e36b", "value": "6144:fhdW138T3Pe+bopZa/v2dZreLjL/+n2ckJpO:fhdW38C+boy/v2dZreLjL/+n2ckJpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791183088, "uuid": "66157deb-c08c-410d-970e-cf57be13cea7", "value": 235857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791183088, "uuid": "3b52e978-a49f-4a0e-b6b9-90e2d1888888", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791183088, "uuid": "6ceae4c8-670f-4895-8482-f820cee5e96f", "value": "dissx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a1ce27d-c09b-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791190969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190969, "uuid": "159a51e3-7647-4ea5-99a8-a86fdb09cf0c", "comment": "Malware payload (Formbook)", "value": "6da6c9137bc4a504aec88893759be856", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190969, "uuid": "92130758-ffcd-4356-ac8c-c483fd3d18b2", "comment": "Malware payload (Formbook)", "value": "1fa2d2eacb3033959af5a59d5ba7aa6528e66af70922073bcad56ff42dbe9453", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190969, "uuid": "ec40209b-c521-43e2-96a1-b2642b1d0042", "comment": "Malware payload (Formbook)", "value": "5fb7ec506d1e5c98449a81270ea437a273c88684", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190969, "uuid": "070de7a1-51b3-45d1-abb0-9966d2423927", "comment": "Malware payload (Formbook)", "value": "41b518a5e8c23903e19cf4603e27ff1096c660e8062f2054f563161f2e25a7bdb00b8c24a7b131de5d7686928b70457b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190969, "uuid": "d58f7ba3-e72c-425c-acfa-95904632a007", "value": "T1057110037707E1758CB18BA6C99FA809E4E02D97AC0F08057DCC89D66F3539AB5F90A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190969, "uuid": "227e7bac-b40d-4b42-ac92-d0cd6b24a34c", "value": "48:Zow667EovYyF7LeZaYh7yiRSEtlaxIZ3ajLVAU01Wol0/CsGdJCUT/eB/BhgcY7S:aw+ogyinf9JZqjLVVol0/H6JhT/2/r1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190969, "uuid": "ec4cdc67-a03d-40e5-bdd4-6d9d05b59e5d", "value": 3557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190969, "uuid": "f5213bef-4e3a-4ad0-8935-af01c16b7ea1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190969, "uuid": "08947482-00f3-4746-8a74-e226abba8efb", "value": "Company profile Image.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b89de27-c09b-11f1-927a-4201ac107004", "comment": "Malware payload (GuLoader)", "timestamp": 1791190971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190971, "uuid": "c1095960-2e29-4d3e-b919-fb9853b49a55", "comment": "Malware payload (GuLoader)", "value": "20195280a3a0fdbc6d832fd1bb690965", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190971, "uuid": "a020768a-3c75-4114-b3df-b87e81d1b3cb", "comment": "Malware payload (GuLoader)", "value": "1faea24aece9f07900d6a6fab5d7a8c1d0607587375a46af9b55119ee48747f3", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190971, "uuid": "1af3b9bc-1c63-41dd-8d2b-e5789eabe72f", "comment": "Malware payload (GuLoader)", "value": "10b4a3d686da9b278ad5dcc06dc308b506747acc", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190971, "uuid": "a6e9472b-3d45-4249-891b-b67dd0d4df88", "comment": "Malware payload (GuLoader)", "value": "be2b14b3f4edc31a1747aba55aa14728ff0ddab6d5692c504b3e406ba89466909818b80f5c1c359b9bb00dbb1a8f75bf", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190971, "uuid": "6c315957-5797-4bee-a63f-17bc3f7590d6", "value": "T100B32A62D92D0D870D0F27BAED669B51F6BC81030E1770B1BFD8434D65069BCA3BDA29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190971, "uuid": "df1a6248-d442-4d8c-b777-9ba27f6f5aba", "value": "3072:40lKAxY6hOCcaOP2vjtWvJ/mQBAINnO3wzwJ:40cAxY6hOCcaOUxWvlGmwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190971, "uuid": "cc416059-f480-469f-9339-ff7c82617ad9", "value": 108068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190971, "uuid": "2a21cc7f-76ca-46e4-86d6-f4ea17576f22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190971, "uuid": "5c9649a3-3d84-4c6f-8796-66415b944d06", "value": "New-order35242637337.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c1f8fc-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1791190539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190539, "uuid": "7c2c6501-fc70-4606-ba8a-5673fe83d9b8", "comment": "Malware payload (AsyncRAT)", "value": "a026c9701ebe79488c09fb6798f317fd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190539, "uuid": "eefedfab-51f5-499e-aac6-4e4016be07d6", "comment": "Malware payload (AsyncRAT)", "value": "1fbb59c4a66da66ea1e351a92091a20e136020e7c86ef57c720fb51dc48f8398", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190539, "uuid": "16deb658-2740-405e-93b1-3ba2f6062e31", "comment": "Malware payload (AsyncRAT)", "value": "124ecc3a94b1f132eb25d35e87370e0200e382a7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190539, "uuid": "2da93068-f7ea-41e8-9037-12d0639c38b5", "comment": "Malware payload (AsyncRAT)", "value": "072490e4ebde545343a1673c53745666a099d148fa20865380e894584a27350d52e0e1a16ac78e71f4b18582292b3b39", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190539, "uuid": "95286107-ccad-462b-a3d0-d4131212b3ec", "value": "T1AD364FA27A4AF13CD0CD8832321A115A61FB327A9F96AD333154FA11D79F479734B12E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190539, "uuid": "95aefbc2-5f94-40ca-b67f-c9fe6b752357", "value": "384:JmvUEp6JoHtUyW3Z8e2YarisuxgdSCoe5hkvVU9X8Pgv7h/uxwYUT+gU8eQHtZls:TRy56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190539, "uuid": "4be956e3-619d-4462-8a2d-e3085fa15565", "value": 5184766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190539, "uuid": "ed36d67e-7d58-4e81-a9ae-a1be203377a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190539, "uuid": "935edcef-8116-43fe-9430-b042e3d48f57", "value": "PO # 202605879-DGN.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c5f0f83-c112-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791242056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242056, "uuid": "5dae1d13-4c2a-4cee-8471-22b2acd5150b", "comment": "Malware payload", "value": "6843fb7974881563220d3354f4a0dda1", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242056, "uuid": "e961862b-7741-49a4-88e1-77f542d5a605", "comment": "Malware payload", "value": "203727d32428db693546eb29ab6a12b52a455b7d2a8c58ea8c57c70abb2f1aab", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242056, "uuid": "5de0f381-9044-41e6-a5a6-72edec2e22e9", "comment": "Malware payload", "value": "c0140cea210015e80954b81d0a6c5f94de266c8e", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242056, "uuid": "5a8b2b40-cf4b-4c26-bcc8-a12d31b4a94d", "comment": "Malware payload", "value": "7f13d9dbbbf1e2187cfbb90bf50c4e11544f08378669b8fdb9556998b632f7101eb7c1e166417c3e612948dcb2f767ef", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242056, "uuid": "28c49f5a-23f2-4fb5-a111-d8b1f3795b37", "value": "T100C12172FD56853172C6C47DBFCB75A2EB43261B04002D4DB49FA3282F5824A71AC7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242056, "uuid": "dee1ca76-4c0b-4e4f-93fc-1ca43c0ab2d2", "value": "96:rujRQ6nIABqy4a9GHRN3khduomLWeokZmZzcOGmWFNGqV8HjJgpd4:SNQ6nIA9ZtkZDOGmWKO8HFgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791242056, "uuid": "3340abb0-3889-4ab4-bdc7-ce1b1dca3ae6", "value": 5765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791242056, "uuid": "0e50296b-545c-49ab-8c3b-bed96b0aa399", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242056, "uuid": "4307a7dc-9119-4bd8-93b4-1e4571654295", "value": "mbupload-o1rt8p1b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "547ad74c-c0ab-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791197751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791197751, "uuid": "9f68e4e7-9a13-482b-8745-647d36684bf6", "comment": "Malware payload", "value": "362612049b994f911efa5fb24cb1b0bb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791197751, "uuid": "22257dec-0f0a-4d33-bc4e-335afb4b00ea", "comment": "Malware payload", "value": "20936c7db15ddf6817f0808fd74751102e4be20dfef85e8d787bdd3755172399", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791197751, "uuid": "57c9f21e-7af4-424e-a9fa-867edce70686", "comment": "Malware payload", "value": "0d807d9a3fb3a30464a2e0917a23d389737937b2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791197751, "uuid": "5de74c61-1666-426a-8678-ced8d9207ee4", "comment": "Malware payload", "value": "b931855b2b5c8dd3949d3ddf0dcebaea10e649af998e34b2953460ec7fe36c6d528de4013eeca982c79a757a8e467f2c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791197751, "uuid": "44b2ee6a-01c7-413e-adb9-62f74d0615d0", "value": "T1A491A6F3B9525932754CC035364F5596A34B042F9A206CA8B08F69347F2D8D8E1FEA61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791197751, "uuid": "b68c78e4-8aa5-42ef-b6bc-621926fb48c1", "value": "96:kGm5T77GKJZYEkK3+aXCJ7+rwBMEqjiGut+fs79PDEK2Xek:+bGKAK3DXwzIiGut+fsZEK2Xek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791197751, "uuid": "9897fec3-e8d0-4062-91d2-433222ab9c80", "value": 4517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791197751, "uuid": "d8c5a3fa-0595-4b49-8225-8771ec6c0a49", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791197751, "uuid": "7bde2e37-e308-47af-a7bb-18d8beafb443", "value": "agent_i.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3175d2b-c0b6-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791202634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791202634, "uuid": "211011f6-d260-4f20-833b-9501e76e5fc6", "comment": "Malware payload (Mirai)", "value": "ce354b7c15ffd6cbcafd4182a7a7fa78", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791202634, "uuid": "432e458a-8bc9-449e-b039-38f46a73d7c7", "comment": "Malware payload (Mirai)", "value": "20d5a4893788205e923413b2a13b4e5e8e40e57ff01e651c5662c9a530a46786", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791202634, "uuid": "fe71f123-1498-4ed5-bc62-610a0beb62ba", "comment": "Malware payload (Mirai)", "value": "b0eb67ba97218a0d95807903e7b16805966901e3", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791202634, "uuid": "9f21fb5f-578a-4ace-a1eb-8325fdbf0910", "comment": "Malware payload (Mirai)", "value": "9828548ff1f96faa70dc1c8b32ff70fb8b64c06aec8a4f8ee469c1190583f1c1b84f3b9010ba4d4f2fd8ea556919ada9", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791202634, "uuid": "ff72d985-1dd1-4f16-a608-f8020ae89418", "value": "T1A204198AFD81AF1585C527BBFE2E418A331317B8D2EE71129D141F2877CA94F0E76542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791202634, "uuid": "fcebc2bd-59b8-4cd2-88c7-7db08f77f52d", "value": "3072:T2s/ITo7WCkybotgsJ913DhrbW4UYSx7QpUiB5IQggEuaJhnR1rmaabEtnwKSDPV:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791202634, "uuid": "ecc9e576-cd4d-491f-b80a-dc68f5423a9b", "value": 184392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791202634, "uuid": "0fed9aae-e91f-4c89-9a75-5b0cb492c3ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791202634, "uuid": "182ff75b-8952-4b22-bc02-e66401628159", "value": "20d5a4893788205e923413b2a13b4e5e8e40e57ff01e651c5662c9a530a46786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd4fa1c-c0df-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791220288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220288, "uuid": "45801dcc-0205-41f5-87d8-9b9b6be8031e", "comment": "Malware payload", "value": "6bafe513020a148bf00ee6f5998ab3c1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220288, "uuid": "99c9ef51-77c0-4e89-8722-c792714d7d17", "comment": "Malware payload", "value": "2168e7c9abdaafbbcfd897dd5bfb1554c76bdeb3b965efc01f43265f90c0ff7b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220288, "uuid": "d7911205-9f84-499e-bad2-ce40f3b0623e", "comment": "Malware payload", "value": "a187661482d753aeabc7e66119dd7b8399f4f3e2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220288, "uuid": "a319581a-d05d-4fc8-b541-ff3c516bc33b", "comment": "Malware payload", "value": "ab17fe0bb570764e28f2e40cd8a3e3bbc75278327aa5ac0eb79ad315f0f0c2a46c218f18f24eb85a94717a236a25765b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220288, "uuid": "83545811-76da-4701-a98d-ca2efc282c6a", "value": "T17566F915AD842BEAC46C4B7544FAC95A23B05D140AF14B3A66A4FFEDBC722747F0788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220288, "uuid": "8c948d42-0cc0-4633-bed2-c2b88f7a7314", "value": "49152:7t0OaoKf8w/puH4iP0LDQdH3jBUIIuWt9dxaUoe85EU:ffP00rWjFcEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220288, "uuid": "bccff7d4-acfe-4b96-9195-0259ff7727f9", "value": 6619351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220288, "uuid": "1f77ab17-0000-4ea9-8e95-1d7e96a7a9a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220288, "uuid": "6f4bcf4c-6263-4250-8699-dc09306f60e3", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fddd5d9-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791216185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216185, "uuid": "40103490-3854-434d-984a-fd416be11ca0", "comment": "Malware payload (RemcosRAT)", "value": "21da12e496e8393fce26cd13e2361969", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216185, "uuid": "33d34757-23a0-40e5-8f36-fd563d57878e", "comment": "Malware payload (RemcosRAT)", "value": "21ed13c8d7ec99df0c224171fc7d1d3f2bd08ff17c567564589c2ba769214735", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216185, "uuid": "aac3103f-e8eb-4fc1-b3d7-0aaae9549c9a", "comment": "Malware payload (RemcosRAT)", "value": "9998328d5217220703d1bf1c38e75ee420473865", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216185, "uuid": "f1e58279-27fd-4d29-97a8-61484e9ceef5", "comment": "Malware payload (RemcosRAT)", "value": "b174c4eff62ef88fcb783810e913499419f7d8c2d8796ce08cd76446e27b4a6d3018dce7d2821175261d738b7a733a6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216185, "uuid": "2bb7d87e-35b8-4a73-b346-83749bc9b813", "value": "T1AA35E05422599BD2C9E537F74672E238C7B62D8EA425F21B4ED4BFD7F932B00C842252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216185, "uuid": "9455d1d3-e890-4409-b275-a83a626b53bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216185, "uuid": "e8865be8-d41a-4997-b844-62980b035347", "value": "12288:gehmBQVkd34QmFwBrBg8y2EpVHqHK80S7RBbyLbi4GNb7WkAQAu9wby9ZR5LqS5O:gRBQeCwBrzy2EG/9tSGB3W6wbyn3qaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216185, "uuid": "2688125b-521b-4217-99d9-d45867133349", "value": 1089536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216185, "uuid": "50336759-5057-4944-92ae-91aa1314a49b", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216185, "uuid": "49a1254c-c0f2-4779-8924-7ed0aeca5416", "value": "21ed13c8d7ec99df0c224171fc7d1d3f2bd08ff17c567564589c2ba769214735.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e676c8be-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791216464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216464, "uuid": "4de13d84-62f8-4a2f-889c-d4e9b7740595", "comment": "Malware payload (Formbook)", "value": "e44ee181d3235c52db5d99e2cc86d306", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216464, "uuid": "806bc694-cc60-4458-8abc-d90210d4ef17", "comment": "Malware payload (Formbook)", "value": "21eed78ef28f13581985a98514ec70fe1d8bfb9dce22900c9cff07796bbf2ade", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216464, "uuid": "dff6cb98-463f-4b68-92a8-fe2a79b85f2a", "comment": "Malware payload (Formbook)", "value": "ffc95ee8997879d17dca007e9bf330dcfe53f26c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216464, "uuid": "c71b1215-7851-418a-9899-f747f4ece389", "comment": "Malware payload (Formbook)", "value": "5e5682ffa54e2c34f82704eb9299fd049eafecbaa7f27c86db6fd29410633a1868da76eef78cf2741aeddee79c91f8a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216464, "uuid": "ed19feef-92fa-4117-9520-e7dedbb80515", "value": "T1BB542309BB406107CE3A09F01A0A57DE7A864CB5C1EFF99B777F5AF621F11A1AC5180B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216464, "uuid": "89bad0f2-474a-4936-927e-c103415f459d", "value": "6144:WqWUwKeDrhVJZyV2LhPNaIkJN5WhBP5hUD1tLlmWCUw:WEahNa2FN6FWh9PUDUWCUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216464, "uuid": "1c64d02d-3cb5-4db3-b4a3-238ffba5ce90", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216464, "uuid": "23b4b822-056c-48f4-ab38-6aa639a993a8", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216464, "uuid": "17dfdb7a-465e-4994-83b8-773c93183ce0", "value": "Probable_Formbook.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1b1805-c0d0-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791213897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791213897, "uuid": "07e7232c-a585-469d-b214-1cbcfe355661", "comment": "Malware payload", "value": "cc5e0e767cbcdf1537aa0cf9376547ad", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791213897, "uuid": "d8b0e716-93cc-4d72-afbd-502b3e4f7678", "comment": "Malware payload", "value": "22655b01e8b6c22d3f562dd80d26922c49d24a540445aba9638db4787acaacde", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791213897, "uuid": "03ce10e8-ae85-4dd7-8c70-655002df17cd", "comment": "Malware payload", "value": "0407c18fedb82291ee192da2bc86493826cdf1e1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791213897, "uuid": "6a1c04fa-5b3a-4e9e-8890-522d7c2ebb8e", "comment": "Malware payload", "value": "b99d6f7639c2bbf6e54e82ef83ec7ef58aec4741b761ccc60af02fdc7aa194105fced6a09d1d59d9746d60a84fdabb98", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791213897, "uuid": "b95878fe-d0b0-4de1-a134-0a419d6827c8", "value": "T14794123BD56C40D0E0026639EE7987426B4EA5AE86B098C25C5F02F5FC650DD3E476FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791213897, "uuid": "91e52951-f708-456a-b1ea-943d02763fd7", "value": "6144:kuj0jc5uz/L2K+7t34mLSGzXsFQ16uNweqxjBnBaYJOZ1KO5kzgPiauTZroSue:mjc5y/9u2mLjzXX1R/qxjBBLJYL0wSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791213897, "uuid": "fb9306ae-a984-4f09-9a3a-9f80c3027615", "value": 413396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791213897, "uuid": "a5d1ece0-5e26-4839-8bf2-0358771852fc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791213897, "uuid": "3f8111a4-e5e9-43b0-8c5e-ac12df7ae065", "value": "22655b01e8b6c22d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85693542-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218878, "uuid": "489f7d3f-103b-4d51-92a6-f8c649f99972", "comment": "Malware payload (Mirai)", "value": "dc8453d8f0bfaededf5d8600b97a8fc3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218878, "uuid": "f6301451-044b-4b92-9270-42e79af06d2e", "comment": "Malware payload (Mirai)", "value": "22734a0b2e3cf2be18cb05d6fdacd6f87b80fb61481197de560bd3f573257f81", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218878, "uuid": "845118d4-6b0d-42d5-a076-bad061bf2fbc", "comment": "Malware payload (Mirai)", "value": "e58b173dec323ec24e993cb1a994d94aaaa90802", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218878, "uuid": "817d2604-987b-417d-b50c-f6ca82c11f4a", "comment": "Malware payload (Mirai)", "value": "40ac1c8dfe5a487dd0b0e85162f32e38112ae2205e14fd355bb503f9f5d5e4e552c6678c23ff1b0875ae677b212e4233", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218878, "uuid": "d1bf8459-d423-4d9d-a26c-b22571cb2757", "value": "T13C43F2E17249DAD491B02ABE5E6542AF75B74CB04A89020B0E64DF8CE1E7C92753FD2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218878, "uuid": "782fd893-877b-4dac-a0ef-e584fe649707", "value": "1536:Vp9Qx2/SYuiUw9Z/+eKVJcuCeQo8s6jgtdPDzhZL090:Vpc884+eTiQopXXhV0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218878, "uuid": "6c96a95c-cb51-4c58-9bee-9b27a27e577f", "value": 57080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218878, "uuid": "e481b88b-e48a-437f-8582-3a7185f636fa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218878, "uuid": "749c9eb2-7128-4fb7-abdf-2052dfd6d228", "value": "android-arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a947ca-c0c3-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791208160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208160, "uuid": "ebb04249-6981-4599-97f3-c315af25a990", "comment": "Malware payload (Mirai)", "value": "cb167a0d2ad5c90ebe28f54dd5cdbb21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208160, "uuid": "34632488-0bc9-481f-84e5-1004ee8d2ba9", "comment": "Malware payload (Mirai)", "value": "22d7e11fa0c2caa5cdc2086b0897f63cc9eda748c28553b1788860755926f003", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208160, "uuid": "12961001-71d4-457b-838c-d5b181c225ae", "comment": "Malware payload (Mirai)", "value": "bfe045c436a76b4e2f22ce14aafa805f98d9ab39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208160, "uuid": "e18d3234-076e-44da-98ef-19053530e10a", "comment": "Malware payload (Mirai)", "value": "a0a81a1487a20e12fab7e0aad9dd352124cdde312a68987edd96c7839307d59534c0e59375329d530ef8e8a480e507a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208160, "uuid": "9896b1cd-657b-428e-9829-d7c90035cd7b", "value": "T19E0472AEE7A19EB7DC0ECD3381D94503108C956A42D9AF6FB2E6C518E78BC4E04D3D94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208160, "uuid": "b9dfd857-3019-4cc8-8bfe-5a55ae607c3d", "value": "1536:XLeTbjHhBZWbl4vyTeUUc9LqzWgG4WPgXZKpfsn7MdwFvefFM9nEcxBXD/pSceSN:X2jfHPWP0nUkKFMVLhD/pSceS8a8tC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791208160, "uuid": "1551acdb-7500-48ad-bf13-e74201b88106", "value": 190091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791208160, "uuid": "a12c40ab-fecb-4669-b23c-05a049d8ec23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208160, "uuid": "af22f563-d9fe-4ffc-acad-d26acb53e1f9", "value": "22d7e11fa0c2caa5cdc2086b0897f63cc9eda748c28553b1788860755926f003", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236aeabd-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218714, "uuid": "503c0883-cc88-4ffa-990b-2f22d0097d32", "comment": "Malware payload (Mirai)", "value": "2e97912fda0fba539f9daac12b5aabd3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218714, "uuid": "32d2281f-850b-43b5-8c84-f05ad1588acc", "comment": "Malware payload (Mirai)", "value": "23bac7167ae3f7d98f70a850d3a47e2e52d0f0c00cbb101edb524f94f9af5249", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218714, "uuid": "36ccf31d-90ff-465d-ac74-9772a58e4084", "comment": "Malware payload (Mirai)", "value": "9eb5e834f534ed4ef05d90a262145b18979384f8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218714, "uuid": "ec9f0e8b-9725-46fb-b1c0-4911dbcd463a", "comment": "Malware payload (Mirai)", "value": "138e44952bd40b8fbb4372b247b84b901b55fc6e8429922976730282ccb6a89c7fd53214e88eacb4fee80b01c2623a72", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218714, "uuid": "63e16d31-abf1-4f41-96cc-14bd25dbebd8", "value": "T143B31763AD269F16D227E1F0B2F28E745B93BD2A48470AD99436EAF44143DCCF5063B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218714, "uuid": "6dbb1056-4cfd-48e3-afe3-44953b7148eb", "value": "1536:1/d76eW2IneCQKdQ5N7qjFYF9CKQ5rWzztopraWtVp:RBBQne+dIiYF99grW/Or9np", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218714, "uuid": "50760b58-8aa1-4d83-9cd8-5b52a047b434", "value": 110256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218714, "uuid": "72cdd896-df57-47be-9dd3-07a03ee72a7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218714, "uuid": "0c904c51-b4b4-4318-ae4f-323d6b755e45", "value": "eclipse.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6114889-c0e8-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791224114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224114, "uuid": "bb83bc4e-f033-4e88-8319-8b51c0450de3", "comment": "Malware payload (Gafgyt)", "value": "ee942152b93653774b4af81e9398e8fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224114, "uuid": "fc028c80-2164-431e-831b-b0dd00562a3f", "comment": "Malware payload (Gafgyt)", "value": "2446085f7621a3199d17b0735a564e65ad15ecb973599f21be216d95833dcd44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224114, "uuid": "e65987ec-3758-4bed-8ef6-cddc1b98a275", "comment": "Malware payload (Gafgyt)", "value": "01fd81cdd9f17e2d6b1ce9e3304b7b0785ece583", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224114, "uuid": "e2105399-faa8-4285-8736-3994a2959d20", "comment": "Malware payload (Gafgyt)", "value": "e36c3889ee73d7e87e58d95d4789c5ed128bc5457dd973f8d429bb2e2bfadb999ae753d9de03a2f92c05f2c9ada0ed03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224114, "uuid": "4304d8cb-e26f-4475-abf1-3d1dd605e1ff", "value": "T1C86302A7709E38F3858B49B318C0AED9B16862B8B99B483C9B711D1754937BEC71C371", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224114, "uuid": "92c2a607-7a2e-4c91-bf71-da91676cef29", "value": "1536:p5WVSHbU96ofJbrxflxJPGJzEkwR4xWyEjFrlLLkg4azHa:IWbUU4bFXJOJzEkweuhrlLLGazHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791224114, "uuid": "5565eada-b93d-42ed-9f41-8870ecbc096e", "value": 67124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791224114, "uuid": "b2895069-26bd-4de3-b8dd-79d9d8bac446", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224114, "uuid": "50f0a32d-7329-4e67-9204-c1d28f0eec5d", "value": "xnxnxnxnxnxnxnxni686xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c19b756-c0fc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791232446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232446, "uuid": "72736cbd-0811-4df1-8291-f3f6db79655a", "comment": "Malware payload (Mirai)", "value": "4561b14609021494d94721ec669ce96a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232446, "uuid": "79ff4fcc-e29a-4d67-884a-127f2d58e2f1", "comment": "Malware payload (Mirai)", "value": "24565f2002f8f637a190dd1d7e904209ce6a16587d5cdb4a3ee4e76fbd728ec5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232446, "uuid": "0c061f09-929c-4333-bdcc-1ebb8d43ec50", "comment": "Malware payload (Mirai)", "value": "1cc7acfbfeef7cb92e4d2242fb4938f45fff1c14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232446, "uuid": "bc6bd267-774c-4fcd-99af-3358d66beee2", "comment": "Malware payload (Mirai)", "value": "c735cbbdc3c484ee13b248ff30a72ac2af9e1d2e091434499d038449390cb6f0a4991c97f41267908716949a3caf0298", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232446, "uuid": "79973d0e-4f0c-4e85-9c1f-bc1cc3cdd78d", "value": "T18F538D75D12DAEA8C0424AB4A9598E704F13A0C046733EF7DB9587A69443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232446, "uuid": "a2c47193-835f-4cdc-88a7-d03e3fe7d59b", "value": "1536:zag/Vdf5F1LwtkbaOoQ3veifs3guba/qzCEZaCw:zJzf5TLcQfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791232446, "uuid": "ce78109f-0e95-48a7-af12-83cdb1ca3dbd", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791232446, "uuid": "f903c058-20b7-42ad-9396-1861c6809b88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232446, "uuid": "039bfad8-4a32-4d99-af0e-5fb031061de1", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8887fdb6-c09b-11f1-927a-4201ac107004", "comment": "Malware payload (GuLoader)", "timestamp": 1791190966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190966, "uuid": "74397ce8-fb1c-447f-a802-43579950c356", "comment": "Malware payload (GuLoader)", "value": "61c84a456eed4f1203594e1282f5b85f", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190966, "uuid": "13616909-d787-4fa2-9a88-1f9610191c9c", "comment": "Malware payload (GuLoader)", "value": "24c7c79ae536447a0fd14bc7e2ee352da5c942f77566edab43701a0e611f1aca", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190966, "uuid": "632aba3e-d0f8-45e1-bd95-d807d765735b", "comment": "Malware payload (GuLoader)", "value": "497914657e9726bc3ab0074c983db961f75d23f1", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190966, "uuid": "54d2cab6-64ec-45f2-a420-68f77c5b9157", "comment": "Malware payload (GuLoader)", "value": "b1e6c93632d115fc333ea214c484b7f9143ad36d49e1ec2ef1e3d758c7dc0c2f72a9e9271fe18dc8e619366937a5ade9", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190966, "uuid": "7e3d3473-4eb0-4bed-af83-f342501237f9", "value": "T12EA33A60DE6C1A864E0A27FBFC605971C6FD8106851310B5FEE9874E940ADACE3BD71B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190966, "uuid": "4271f6a4-0795-46ca-89cc-7aa128862816", "value": "1536:Y+hyNXHXUa9cgyQ6BH6als2byLF//B6/UjZXjK2IjP9mQSf1bFnhz1x34+w6KqAF:nyjCA6kaA/vjlK2IBmQSpFhzj33w6Kqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190966, "uuid": "4f8c3d53-1805-40ac-9ba6-57fdc003bb02", "value": 106629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190966, "uuid": "0f5b5ac7-f84a-4287-9bf1-c90b48915120", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190966, "uuid": "455ea0bf-e98a-47d7-aea7-9030a07e06f9", "value": "20260519094231695.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e3ddf6-c0ec-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791225583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791225583, "uuid": "8f28079a-9f7b-45c0-84ca-428c2fed208f", "comment": "Malware payload (Mirai)", "value": "b04465b75c47c5c6ce363c2b696fa183", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791225583, "uuid": "57e03a0b-4ad5-47da-86f3-16a77f0387d3", "comment": "Malware payload (Mirai)", "value": "256d18fb82f5f09352f3fab80b9a759d1a477704aa901dc355607350c17714d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791225583, "uuid": "9ef5e280-8333-4708-8494-865a2140d7cc", "comment": "Malware payload (Mirai)", "value": "ec53fa76099f4ef0efa7941a7dff74080f4eefea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791225583, "uuid": "08533201-496c-42d6-9fbb-aeac23015e82", "comment": "Malware payload (Mirai)", "value": "e4cf3f93981fd00f4463514bddeb3329b50a2a3b7ea34e66fb27f4531afbf804186bf3e6f2c1340e4e6cae040c2309ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791225583, "uuid": "30158efb-89a8-4e49-8d5b-a1b854a3f299", "value": "T182258C2AB2B3F6ADC00BC0304BDBCA714132F07569312D7B36C59B343EA6DA51769B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791225583, "uuid": "ad47b128-6b41-460d-bc0f-1f01143eaca3", "value": "24576:dR6SkL0iB1+z59F+KY9kNgakCS0Am2JHLHVs:z2wNgakCYtL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791225583, "uuid": "369320e6-0626-4302-b6bc-306ddecdd2fa", "value": 967224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791225583, "uuid": "e00e22be-d964-41d2-94ec-34b1d5399cbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791225583, "uuid": "292416a7-9257-443c-99f9-523daa518238", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ce7146-c05a-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791163036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791163036, "uuid": "97e39da0-eba2-4eb9-9925-fe6ffe259c00", "comment": "Malware payload (Mirai)", "value": "efde9155dd4d91ef09eb4825620745f2", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#AFD6C3", "exportable": true, "hide_tag": false }, { "name": "torii", "colour": "#C73077", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791163036, "uuid": "20d14a73-453c-4017-993b-cd569134c94a", "comment": "Malware payload (Mirai)", "value": "2571f3fa3054da51c16e698cb1578ab9405c80a34172874bdb56dd7df98b0be1", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#AFD6C3", "exportable": true, "hide_tag": false }, { "name": "torii", "colour": "#C73077", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791163036, "uuid": "ff1f3939-0c7a-47fd-a151-f5a7ebb50f86", "comment": "Malware payload (Mirai)", "value": "ca1550398f99d9169e8f2382fd338e8803cc6ad5", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#AFD6C3", "exportable": true, "hide_tag": false }, { "name": "torii", "colour": "#C73077", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791163036, "uuid": "a85af0d2-01a9-4597-ba81-454f5f206bf4", "comment": "Malware payload (Mirai)", "value": "70a575ffbc5685dcf2d680254a31d79d450b4c9ff6ca667eb60b0b0866abda60a9e348a61a378cb9ed344cee9769bbca", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#AFD6C3", "exportable": true, "hide_tag": false }, { "name": "torii", "colour": "#C73077", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791163036, "uuid": "a7a41c72-e628-46f9-979d-930044b86572", "value": "T1E5543A8AFD81AE25D5C122BBFE2F428A331317B8D2EB71129D145F2476CA94F0F7A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791163036, "uuid": "f8b52430-8df0-496c-ad50-8358a56fac89", "value": "6144:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRhVabE5wKSDP99zBa77oNsKqqfPqOJ:T2s/bW+UmJqBxAuaPRhVabEDSDP99zBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791163036, "uuid": "420b7627-4202-4159-a89b-2f79f20d83df", "value": 305344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791163036, "uuid": "012370d9-3441-4f1d-a3a0-580fe1d34b59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791163036, "uuid": "6654ea56-8673-4739-bfcf-18a4151fbacf", "value": "2571f3fa3054da51c16e698cb1578ab9405c80a34172874bdb56dd7df98b0be1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbeab5b1-c097-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791189442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189442, "uuid": "daddf0e9-0cfd-4de0-85b9-d1e773da4676", "comment": "Malware payload", "value": "e6a2dc6fda701dbf61cfb1adac9f34e5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189442, "uuid": "fc787a8a-9963-4d8d-9c37-06fd3c753eeb", "comment": "Malware payload", "value": "25838870505e1ae652947b7c9e27325aedb376a1507c91e82c238edc42e27025", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189442, "uuid": "034b74c7-72be-4daa-b93d-3ae0f74bd4b4", "comment": "Malware payload", "value": "599683c1f47c3e103c189eee03980a174146ee23", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189442, "uuid": "eee918b5-f246-4401-a260-bd0698507691", "comment": "Malware payload", "value": "a30017e037f308b272c35cc4d86e8b5af0e25bcd51c1cc68eda83794c01c690b8a4c196471b33498428a76a9a0154032", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189442, "uuid": "f1ee56c4-7baf-4563-b5d5-d9cb3a359f2c", "value": "T11F5302637D5BED25F96F3AB764CA0692F01044F77C2A335BE806140C1EB88653A3A5ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189442, "uuid": "44f9e312-195b-4338-94e0-6702d468086c", "value": "1536:9G6sowF+Li/UI8qHCn+leR2nK6nAJX5WhKDI7MKnRdon/7w:9qowfsqin+iMK6nAJXMhKDIgKik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791189442, "uuid": "7921750f-27a4-4b45-a770-f68233d06194", "value": 62375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791189442, "uuid": "3ec589a6-a51a-45e7-9597-064a544b5b65", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189442, "uuid": "4ca75391-b14c-4b0c-aeae-12060837b56f", "value": "bd5a22cc4f869742757100dc2683749c61c972f2bc3c02be2d6e5d7e1ffaaa76.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4923f5ff-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791216200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216200, "uuid": "05f858eb-eb3a-4dd1-9b75-8a9effa674dd", "comment": "Malware payload (Formbook)", "value": "05b3fed6b0077e2e013a354857b93158", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216200, "uuid": "1285800f-1bba-4b87-94bb-a1d337eb316c", "comment": "Malware payload (Formbook)", "value": "25a127ef0fe99db17a3a08ddbd6848b3c96e1e61819b8819d34d1f016cb72b0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216200, "uuid": "8bed7599-c6c7-45f1-95a3-eedd0a80caf7", "comment": "Malware payload (Formbook)", "value": "a1b62450bb687ce978a051a5e8e3d0cebf68f7c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216200, "uuid": "ab1517c3-6c55-4d33-aa9a-68e2429faea6", "comment": "Malware payload (Formbook)", "value": "095c6e0dc995c86706ebe551463a5dcf1b3532fa7db5a8758c8dbfc53ba417a369582bdf767eb5050fbb49e5035f310f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216200, "uuid": "25d30828-520d-4511-8824-21e88b37fc1d", "value": "T19D0501543354AB03D9A923F91871F27403BA7EDEA521D3199EE8ADEF3932F054844B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216200, "uuid": "590f200e-5c4d-41f5-9bac-000e1e06cef3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216200, "uuid": "0c166b33-3097-4701-8f0c-da8081c424b5", "value": "24576:EeXg3g9xkJW1WvA8i6gF5aBDsf23Er3ElJC8:dXqOxk+f8mna6fm63ElY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216200, "uuid": "cd2f7c15-4e74-4de3-99c3-23ed513574a8", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216200, "uuid": "b19d0476-6829-4108-82f8-8ef161bebfb6", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216200, "uuid": "fc147d5b-cfbb-43da-aa52-8d353eb9bfe0", "value": "25a127ef0fe99db17a3a08ddbd6848b3c96e1e61819b8819d34d1f016cb72b0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39672ade-c0a5-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791195129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791195129, "uuid": "004bfd9f-b6bb-4db3-b276-c47dc702863e", "comment": "Malware payload", "value": "ea58fc795e13c3a575d8b623f36d7185", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791195129, "uuid": "d05a336a-40cf-45f4-b909-590297624f80", "comment": "Malware payload", "value": "26125f5174e141b111ea76ed72aef8df50f876b18317adb110711eaa1c5a25a2", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791195129, "uuid": "300e089f-3087-4f9e-85f5-539cf8d33564", "comment": "Malware payload", "value": "88a1725a0f09fee3da47ce8321f8e30081899acd", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791195129, "uuid": "7aad3976-069b-4b8e-a94f-0d40ead0c67e", "comment": "Malware payload", "value": "267a59bace0cd12f9f41474b5bf0ca4f82f10bff33f5823b5e875703501eed65e044b920849ac21e276f742bbc38a844", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791195129, "uuid": "f950e3ce-7110-4a5c-8b12-1b0dd7461333", "value": "T16625F89EB7725080C0D522F2935A873AD8FCBAC2899116DB0D9A1F3ADC53C2BDD45376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791195129, "uuid": "de3d71b3-5741-4fed-84f1-ac4421a4f08c", "value": "624b712633b7a10a9c6032c7ca038c48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791195129, "uuid": "13ad431a-14e9-4b02-a34a-1f52a8c59b85", "value": "12288:0qeqtP1mAonWl8qfkJNf+2b+trmS9c4jB45hy+eU/Jzx2G1/IgMvWbTYZyV5ZVXp:Khy+e6Jz0GxHbUYV5ZVXO7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791195129, "uuid": "d56ddd2c-4fb7-4ac2-98ff-6ce9d19b750e", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791195129, "uuid": "76b64ad5-5934-47be-9519-79d802ed9b20", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791195129, "uuid": "caa3a607-4a2b-4222-b334-f3bda393d17a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93da289f-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181966, "uuid": "03683afd-9a80-46cc-ab1b-a47a8fb6f4c3", "comment": "Malware payload (Mirai)", "value": "57d2ce21a33c3095426a157a5601cc2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181966, "uuid": "899fa9bd-a9af-4453-91af-dad143cbcf18", "comment": "Malware payload (Mirai)", "value": "264e76d69fd2fb9cb58cfdaad501fbe144e210c201346859db3892bbd75836cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181966, "uuid": "6a54923b-3f4c-4980-b136-84c3bb179190", "comment": "Malware payload (Mirai)", "value": "87bebd865dfec2c80fb55f4e7188aec81b63dc47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181966, "uuid": "51d9b715-3f03-45cc-b01d-bac9be38b73e", "comment": "Malware payload (Mirai)", "value": "5c58f7fd4d413110b13c65ea16951e822815e2e380d2a4c0575c70e47a38b5ce5dc0f0a0eee9d2f09d87fd31839ae1b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181966, "uuid": "ff5b06e2-5598-499f-a02b-e5442c318839", "value": "T1AF530169B3674C77A89078F818F60D8838676DB0E1ED636EA3505635993481C8DFC2F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181966, "uuid": "5f252517-c8b5-4a22-9004-b21cce19a08a", "value": "1536:WWql07FFxxG9i3OSRJJ3+NtJRRmsInhyFr+6D:WvloFYi3BJN+/JRYsF+6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181966, "uuid": "6ee9e881-36a2-4b9b-9527-3bc6a02055e2", "value": 62456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181966, "uuid": "d0d9351e-5288-489c-847d-67e3210cdee7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181966, "uuid": "8d170258-6507-4459-b7eb-f21b2abd0b32", "value": "wife.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d599ee2-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791190545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190545, "uuid": "b4debdf2-ef9f-47fc-b867-9567de3dcf97", "comment": "Malware payload (AgentTesla)", "value": "ee9401eb5da7695933b985d0d73391d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190545, "uuid": "d345b0e2-0a0e-418b-a125-b94d8c370cf1", "comment": "Malware payload (AgentTesla)", "value": "26b97bd07b177a1303e2f32bbbe45931d69b992f545ad7841f8cb9f2bbd4951c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190545, "uuid": "1e6c6f4f-8faf-4822-893a-5227b27ab3ce", "comment": "Malware payload (AgentTesla)", "value": "e2ed2f8463da57a4928794045a5530603d8dcf95", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190545, "uuid": "4cf2695f-554f-4ab8-8568-28a94860fd51", "comment": "Malware payload (AgentTesla)", "value": "12524a561dbbbda13b0c9656c2125b10f60a6cc3d4a8024c072927507278023749445092e1d55689d4d18d0a14d152cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190545, "uuid": "30988e48-fc46-4542-86f1-bb80f88d43e3", "value": "T1594574570EF68EB07FE8DA858AF60BE84F31DE5495913051F8DB74C93D58A40F22B1A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190545, "uuid": "d3c7b17a-6a21-4494-90dc-72cf402ba88a", "value": "24576:k7UpHwde+EBedeilQ5sAUcuvgz1/UaPFGRm3Y/PvLPuksk3dIOxbPUp8g6gUaPEB:k7oHwde+sMrQ5sXcuvgz1/UaPFGRm3wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190545, "uuid": "55ea155f-9ff5-45fa-8510-9ffd44717ad5", "value": 1208208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190545, "uuid": "9847221d-94bf-4d14-bb75-bacdb1b7d33c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190545, "uuid": "9fefbbef-1f59-4fa5-8ee3-26c9216794f5", "value": "Order_Forecast & PO-9458735.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122848b0-c053-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791159844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159844, "uuid": "a7634131-307c-4fb5-b9a9-510a35b825f3", "comment": "Malware payload (Mirai)", "value": "84e596b93bd712bbe52869762f1aec4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159844, "uuid": "f05df2ae-11f6-4a08-9b21-b657d7e0066f", "comment": "Malware payload (Mirai)", "value": "2721dbcd118b8c4f018ff09a96c10bf5e60ee537a4ccc9c83ed824d90d49af14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159844, "uuid": "f359b38a-2c60-4d6d-915a-59779ef9f967", "comment": "Malware payload (Mirai)", "value": "c2b8ea6333a5557245179c1e942ce5dad46754a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159844, "uuid": "dabda937-f010-4ce2-8aec-b7655851ca05", "comment": "Malware payload (Mirai)", "value": "18fdc56f2823cef8132e001c69ea7e21351068f41ec28a8986c4684a9da7bb1d4162b6cb0293861cbe05ac13734d644e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791159844, "uuid": "f36d409c-ad91-40f1-9111-8a507166330d", "value": "T1ED533A17B94280FDC49AC1744A2BBA3ADD3770FD0378B2A677D4EB222CA6D215E19D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791159844, "uuid": "e8b3553c-11f8-4b24-92aa-b1847d79d7cc", "value": "1536:Y5S8iA+Ebh+uRjihp1pvyWwTUrSDpy6Y0CSU3f/CMx:WiFEbh+AGh7pvlwoQpy6Y010f/Cu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791159844, "uuid": "f3e70fb7-9c8b-4817-8513-343efa567e4a", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791159844, "uuid": "5b602d60-3690-4c7d-99fd-5e6a809b58cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791159844, "uuid": "cb217436-f40c-46aa-9aa7-1d2360f9df73", "value": "2721dbcd118b8c4f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883285d5-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218883, "uuid": "634237ed-7fb6-4fa5-87b2-cf62281911a6", "comment": "Malware payload (Mirai)", "value": "9f693ca3e742fd4d3bf190a2469f646a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218883, "uuid": "afdb4c40-18a2-409f-abf0-64f41114ed99", "comment": "Malware payload (Mirai)", "value": "28b712922391d10cc7609712edba1f92ab70f0f8512c90ab629ee76ba1c21083", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218883, "uuid": "e94392ae-1e43-40ab-8e30-1bbcf28f147e", "comment": "Malware payload (Mirai)", "value": "390c62a4258c1dec4e7509d4818b983e6453d5b1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218883, "uuid": "c8a1c585-b978-4264-9ec4-c5a6b009b9b8", "comment": "Malware payload (Mirai)", "value": "534ca4545143ba1f9f30534248a3585054e4db1192b4b4fea82b6f0089944c477ee202eda2988b14ecccc8147bbe4121", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218883, "uuid": "fc5eb3f7-b736-4ba0-bb13-756e59f4a159", "value": "T12183024F169BBE78F97170F285D61314E188B10FA88633D714DC787F352A8ED2922B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218883, "uuid": "b138aa37-8507-40f0-b87e-548dcaeaa275", "value": "1536:KECJyQqwmE1C0xe+p4kUGN0LRgVZIMwR2rLQgTxfZSjzQgAGqvJVXi:KEg7rdHxe8bN2gTxZoMaWBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218883, "uuid": "ddb93025-6f87-4bf2-94f1-101f9332c7f5", "value": 83188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218883, "uuid": "ac23b64b-5e7b-4d6f-89f4-a983e70deda3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218883, "uuid": "a30ca645-2594-4403-b7d0-58d6056a27e7", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c7da1f0-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185846, "uuid": "deb384d8-2926-432b-a805-a68d08f076b5", "comment": "Malware payload", "value": "2d348924959611ba79087f3487d8bbbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185846, "uuid": "7e7a2d2e-aea7-4cda-b70e-73d0b52ecd85", "comment": "Malware payload", "value": "28d85568352578b2550fbc963f75fca51fa1f58dea21938bfef28c2a2a8b1f4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185846, "uuid": "79eba560-8658-4873-9518-ba15004ff8de", "comment": "Malware payload", "value": "74128f771a9dde66546b900278db5ad1140f9d8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185846, "uuid": "7de50d09-ed05-4878-9e8a-3e91a0d8d3d1", "comment": "Malware payload", "value": "48e0e59a17f08afc07a749dc84a818082aa4f7578328961f3bffb6a8e74bb047e0ce358121ac1bf4dca26f4e1c9e5865", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185846, "uuid": "10aa6b13-18d5-4b59-86a3-6486065a3011", "value": "T1DDD21967A1A360EDC15BC0318757A822B9327C6413206EBB2BC4F9722F71E61377D766", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185846, "uuid": "c22bf0d0-9b66-457f-a890-0822e004eff9", "value": "384:okMOgGh3e3MEHEyeNINmqiaTXx0R24Olc0zEr:okMtE3ejHk0Ria7gOLzEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185846, "uuid": "cb0080ea-4f6f-4ebf-be4f-d75ac5a2effa", "value": 29792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185846, "uuid": "aecbc4ab-8d79-4225-aa7d-613246e02a81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185846, "uuid": "eb7d388e-52de-4df7-9493-73bb34328639", "value": "dldr.amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33f4a39-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218928, "uuid": "78a9de18-b12e-4b37-9f7e-0186bedc874b", "comment": "Malware payload (Mirai)", "value": "cca4a72befbb46c370d7a8b675027e2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218928, "uuid": "272077de-ccb8-4768-a2ab-6ec2f004cbbf", "comment": "Malware payload (Mirai)", "value": "298fc9c1a4a68d8ea137f06ace4d01a7da450b41ec7f853438bfda5e167191ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218928, "uuid": "a8817557-89fc-4515-9f89-b339042ae10f", "comment": "Malware payload (Mirai)", "value": "5a54c0756d23f2f2977751b7cc362dd4d88027af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218928, "uuid": "d638a0f4-32f4-48d8-b792-c9943046b415", "comment": "Malware payload (Mirai)", "value": "3ba40dd8b5d81b85478ded00a56c10274b2ac740b97851fb6e52bcecb4e45d417f07b898d623de5264aab2dff26188d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218928, "uuid": "ca05ae63-7da4-488b-83b2-2bc815a82dec", "value": "T1FAB3079AB8D2D453C4E45E75F82D82CC33673BBDD2DA3202DD04EF2429DE48D4E29695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218928, "uuid": "d9d8581e-1e15-484e-ba4c-52aca388e9d4", "value": "3072:P0GrvkrWqB1Cjxs1UBwzquSBJgK7ybeA8JhL6skG:P0GrvuDB1AwUBwzquSRGbPghBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218928, "uuid": "f65fe366-9162-4397-b120-8ca0ca5cc8fc", "value": 108916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218928, "uuid": "2ee365c2-0b12-4ba5-ac12-b57b7ac0129e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218928, "uuid": "e2da0b12-639f-4982-91f1-292ec6928f7d", "value": "android-arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3ce212-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791216501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216501, "uuid": "c21ad7f2-88c1-46f4-a0e4-20c677aa309b", "comment": "Malware payload (Formbook)", "value": "ac727d7ed3a0452251ae8b3d0f7f5d80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216501, "uuid": "f1f7ef32-c552-4ca5-9763-f183fbbf3658", "comment": "Malware payload (Formbook)", "value": "2a4e92f9ceeafddef77dbdba62c0a9bd2711ce7be586994ba810712067c0e4fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216501, "uuid": "b8d3b98a-712f-4fc4-9f52-cd4703f22c40", "comment": "Malware payload (Formbook)", "value": "ee30381c96e9b17cfc08e2390087944ce99d8ee9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216501, "uuid": "3d2bbb79-82af-4e1f-adaf-068a6691967a", "comment": "Malware payload (Formbook)", "value": "68b0c520cc0808295769d7751d041758a0c2ac94c83372b29e3f542daa142ccacd17613ef9060f6c22017d35a141f314", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216501, "uuid": "0dacd11b-1a1e-419f-933c-dd620b1beff8", "value": "T1565423110785D935E332EBB7B43716CF94B9B5393D1FAA3362A509DDA0C06F22276D22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216501, "uuid": "b0b6b882-527e-4a1a-a0f4-69631670a23f", "value": "6144:ekuonW+Ow8w7oNaHIMRr+kD0Ifxpb0AsGOnhlG1i9Y4+g265D2K:BnZOw8Z7zkD0VnhM10YB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216501, "uuid": "af6a8670-82b5-4154-abdb-5b0980e71d9e", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216501, "uuid": "f7e2903a-4009-442b-9431-272bbb60823e", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216501, "uuid": "ad6891b3-6e97-4afa-a334-3e78c550189e", "value": "probable_Formbook_4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "192baf10-c0fc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791232441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232441, "uuid": "23698d5a-6055-4222-8bd5-d2bff22548d3", "comment": "Malware payload (Mirai)", "value": "49f8f1ebf09a2d34f26818ef15457050", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232441, "uuid": "9ac3cf0d-b726-4939-8b2e-b4aa336e12d3", "comment": "Malware payload (Mirai)", "value": "2acc41126e26cb463e9fff43b2006cc4d888c39939d5ab0fbaf299be56e109e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232441, "uuid": "8051fc67-6f14-4889-9cb3-38e7ec7b5c67", "comment": "Malware payload (Mirai)", "value": "386d3cfbb6dfb362d6254f1e979953d9094b0298", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232441, "uuid": "6cca7fa8-8d0e-494d-b3b2-30ea758f7ab9", "comment": "Malware payload (Mirai)", "value": "42b97a3ab5807c4eed09a7fe9f8b272eb25185d5c6c3b9837bb7f90db8593406128a727222b5c159ea3064fcaf211117", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232441, "uuid": "83badfb4-e915-49dd-acc6-3edb6dd53a79", "value": "T1B4533B99F4028E3DF88FE9B984160E05B93023D212931B276BAEFDE37D331659D12E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232441, "uuid": "ebf4421e-2ac0-426c-969e-1055fe021c74", "value": "768:me4gpsM204GEkRbjveXQonQiuQtt7v3gFHy1eu48B8vB6J7EzNfXQuJpozJE7P/:mo3EkRbDfDiDHIFy1X48B2SEzNfAuJfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791232441, "uuid": "faeb0d1c-e3b3-487e-8043-5f3b7a9e94c1", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791232441, "uuid": "6d03fe37-69d9-4952-82f1-250775e0f5b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232441, "uuid": "cbbb6487-b4a8-4fd5-a92e-098a26b73a8e", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed35a0c-c06c-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791170710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170710, "uuid": "8eba719d-b223-4d00-88cd-9c93ed3e2b21", "comment": "Malware payload (Gafgyt)", "value": "9e65dd5d99f3e2edbad42e408b7eb529", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170710, "uuid": "7b7d79a1-eb51-4d0a-81a6-d7582eecd750", "comment": "Malware payload (Gafgyt)", "value": "2bfc0f1dbec327a29e9fd26ba97dde795ae768382cb64ffecf694a111483cc6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170710, "uuid": "4a24417e-66c7-47f0-ae77-62ac9bdc6744", "comment": "Malware payload (Gafgyt)", "value": "c9e6884009d8005b741a0d2f12fca5f9d24a409e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170710, "uuid": "430e98d1-c369-41f2-836b-757edd297489", "comment": "Malware payload (Gafgyt)", "value": "7f083aed795ba710527db36f7e0b56485266f314caa31234d15438c666dbb424bb91d2078d14c2fcc23e155a80c22bf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170710, "uuid": "888b6f5e-3eb5-4e54-ad8f-5d6042b97711", "value": "T172343A05FC548B6BC6D22BBBFB8E428D37335B5897DB33019A246E742BC6B9D1D29101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170710, "uuid": "f7d869dc-fa2b-4b97-89f5-523411b0d3cf", "value": "6144:CC/ITqq/3q/xL5oLk8Pb4a6oIa8xPnchK56uEvgdZHYlZSjHNH2UsMOO:TlUb4a/QtncUyvgdZHYlsjHNH2UsMOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791170710, "uuid": "8e8ce07b-7809-4c35-bb8c-b703e7eae92a", "value": 236692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791170710, "uuid": "87639696-b1b8-47f5-b04c-5b7cc9195ed2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170710, "uuid": "9c7707e3-1ea4-49c8-9a0d-3a94472c5ec6", "value": "2bfc0f1dbec327a2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ee35a1-c09b-11f1-927a-4201ac107004", "comment": "Malware payload (STRRAT)", "timestamp": 1791190880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190880, "uuid": "919208dc-0884-454e-9a41-7f9e7b1c0db0", "comment": "Malware payload (STRRAT)", "value": "b92ed93111f166452bcaf33b1384c8db", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190880, "uuid": "c898781c-690c-424c-9233-c5231f724e9d", "comment": "Malware payload (STRRAT)", "value": "2c08726d40a1bd521d37c4d6b4a8ff0e423249b374a7aea15dca32600b82bf8f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190880, "uuid": "5e8c7d6e-c9a7-4444-925f-a5e4a3978081", "comment": "Malware payload (STRRAT)", "value": "f81a0d458ffcde2b37eaad1838db41618708effb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190880, "uuid": "d35d5b42-b8c7-4553-84d7-fe0ff897be89", "comment": "Malware payload (STRRAT)", "value": "651709620c153b029362b17b665f7e1793e106e54d94b171d40e666e2f0a44de2d42d1fc89e3122537e24cba90607116", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190880, "uuid": "b9315000-85f7-4a06-8ae8-5875a7a06544", "value": "T1D5050055B36A098B1B0BDE34341A1D637BB80B61EFCC49C49257EE998C5EFC70259E0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190880, "uuid": "95651c0e-27ce-4b06-be0a-5465c02b4725", "value": "3072:OJErx4bb1O2/1fcRfbd7HJHy0OV3+GANo0VY8Fu0RkDwnGa3DqkdIhqn5Jz8DlYy:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190880, "uuid": "2bf26ebb-04db-4967-be82-3528495794e0", "value": 849318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190880, "uuid": "202f5c61-7595-42dc-bbfa-e1c5033b8cc2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190880, "uuid": "93742083-650a-421e-8e62-dfc4a70b1ab7", "value": "PROOF OF PAYMENT.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab41f03-c0c1-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791207103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207103, "uuid": "6a5b885d-989a-44e1-9958-b27570983f7c", "comment": "Malware payload", "value": "e84b6e4b4b1283486267009fbddd5c7c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207103, "uuid": "8af32c04-5609-4e32-bf3a-9199f58a7e37", "comment": "Malware payload", "value": "2c2511a8da4d5d01ad672f105b9b46b6ccc26754bc6f34b5577673078e3c6681", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207103, "uuid": "da5fde83-88ec-4c2c-844d-9b4c84cc0624", "comment": "Malware payload", "value": "8d04a24ef4dab2672aa5f5e3e0a4cd1a3ba9283f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207103, "uuid": "64e5b850-9245-442e-81d5-250fb9bfc1b9", "comment": "Malware payload", "value": "79261997755af37932c21bd7664938b56cee3765ef0427e29c1d14f28fe628b8f10adbdde4ae74481a54b02788f95971", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791207103, "uuid": "9bdac2bf-4eec-47b0-ab25-4f9e794cf7ad", "value": "T1464185F3B5B6C9302ACC501478D98AD6E64B463B04583905F0CE38243F18CE4F1E5B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791207103, "uuid": "e9a8d1fe-e321-4908-ad87-0af9545feff0", "value": "48:Siv2bDqWhUEhcicHJOvOI2D1mSNzbxi5ogvK0C/0Ckd/f0CMYk:V2KpXJOz2D5tVihvKn/nO3n3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791207103, "uuid": "75911354-9a0a-4abb-89f0-8a10e5005a5f", "value": 1971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791207103, "uuid": "c398fceb-6825-407d-a8c2-c7576fbf2ef2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791207103, "uuid": "4d335b31-12da-4eca-9ca0-e4748a25802a", "value": "2c2511a8da4d5d01ad672f105b9b46b6ccc26754bc6f34b5577673078e3c6681", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "205ecfab-c0c2-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791207542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207542, "uuid": "0943a044-6e50-4914-a332-7490afa9a4be", "comment": "Malware payload", "value": "493aafd42641c852be9a7a0e8fd77f85", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207542, "uuid": "16e8adf5-aa40-4df8-835a-3a51a9a87ee5", "comment": "Malware payload", "value": "2c727096f8c9d698e7fdfd80551d2bb9075854b43f940e87d0a482e83a114ff7", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207542, "uuid": "62f8bc28-f4eb-4c6c-b74e-e009d5156c00", "comment": "Malware payload", "value": "807611afb2f130b9e2d69a78dc842b80c11362d7", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207542, "uuid": "3a92122e-1486-43fb-b687-817ea43a2fb9", "comment": "Malware payload", "value": "c5834e28a0f1431407c748130cbc21256b51b7add1edccdf40d9c5e86a7ca7648501978697ee803c18d0f552c6f1c48e", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791207542, "uuid": "b49dbdb9-05ec-4fd7-836e-43e0e8ed933f", "value": "T17F45F200CEA650AAF9CCEB302BBA5A33DF357560858416DE63922F688D317D3F55713A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791207542, "uuid": "7c1986a9-1e34-4602-be74-6ea7926b5682", "value": "24576:s9IrIJVK1NCmYj62ldCNcADm4t2FZUmmjy4hdiNL:KKurYF2w/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791207542, "uuid": "85cbd739-48c6-4f7c-99d2-2f7900c52d32", "value": 1249296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791207542, "uuid": "a36fb858-96c4-4129-8088-8ec05a9a1ae1", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791207542, "uuid": "9034f97a-d811-41da-88aa-7084a4c9a268", "value": "macho_2c727096f8c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1db1cd-c0a6-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791195509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791195509, "uuid": "f840b1fe-6667-4efd-8297-3db39012bf3d", "comment": "Malware payload", "value": "7dafaf2c1531acb29eed0c26127f7f70", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791195509, "uuid": "2ecd12cd-eebd-4dba-af89-f3a7c70e7f97", "comment": "Malware payload", "value": "2ca5868e9fa35362d6f1f285b83f47dbc8990885914e00d939a0f7cd914a5307", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791195509, "uuid": "e8fbd7b3-9ff8-4db9-9d2c-e7cd150ab19d", "comment": "Malware payload", "value": "edee51e8d0a000c2937ed811c504e7de3a6aadf6", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791195509, "uuid": "de4c18b3-3704-487c-9df4-7c3f7b041826", "comment": "Malware payload", "value": "168f0452f10e4e6b555b7efc94a028033cfa52ade5685c9875db1976c812cb59499db0d23914e16ad7b2f811dbce7422", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791195509, "uuid": "c8c0144b-3b69-45a7-8a0d-5ea3714810e7", "value": "T17DF3D6AAF4DB28314073912E0EDB840D77B986139049D484BD9D41D8AFC537CDAFEE6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791195509, "uuid": "0a17bb7b-178a-4392-bcc6-19305436af17", "value": "3072:lC5yTE9oz/vmhIfGRkxoyfHMEHXjTIX7D20QMk4vWfcmrtX:lyyA9offGRwf67D20QMkKmrtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791195509, "uuid": "c0c3937d-5264-4eed-8fef-3dd1e5e77d57", "value": 161258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791195509, "uuid": "8247bbb9-7694-4623-bf0b-97084a2b70eb", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791195509, "uuid": "13c07859-3dec-46d6-94cd-d50072c64030", "value": "2ca5868e9fa35362d6f1f285b83f47dbc8990885914e00d939a0f7cd914a5307", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb065669-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181629, "uuid": "29e22b2d-ee39-4e77-8bc0-8a7bbb5083fe", "comment": "Malware payload (Mirai)", "value": "0035a903d6242cb2ca0d3856b21c5780", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181629, "uuid": "e577ae8b-fc22-48e5-862e-3228289149b2", "comment": "Malware payload (Mirai)", "value": "2cb1ef299da279404e60453ec87b4c5ab3c84416a9716bfd321c264aa1dd56fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181629, "uuid": "7d08495a-43a0-44ea-9906-8ec2812aeaf1", "comment": "Malware payload (Mirai)", "value": "f32c7eba951dc9587d02de6e202ccb74cf32e7a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181629, "uuid": "e4253992-e272-4636-9965-7501c36c2813", "comment": "Malware payload (Mirai)", "value": "ce82d408d1cda6beb00157b37142e5339c45ee1f4a789c0d735e3a6fe341a5983ecedb69f6314d5a6354a20d674deb81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181629, "uuid": "f371661e-d640-4dfb-8e66-01add8e624f6", "value": "T1DBA34AD7F800DEBEF80ED7770453050AB631A2B21A431F766267B867ED351A82837E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181629, "uuid": "5dd0a172-b4d2-4456-a6cc-233eb388e8ff", "value": "1536:5hxDU0RxyjEdAzI4Sr8I/yGTwufWOy2EFs5bTb7JsvIXohtAlmcyUb:5hdU7odAM4SbyGTwj2OstEIXo3AQUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181629, "uuid": "ee1a1047-27d6-430e-a4cf-c2a04f3921a2", "value": 97748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181629, "uuid": "9ac44026-51b4-4cbe-a07f-e9b7c1d32d88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181629, "uuid": "c8225aeb-dc68-4d29-b5a3-27e76bb0243b", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d16604f-c0a0-11f1-927a-4201ac107004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1791192907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192907, "uuid": "12d9ada7-b7f2-4c68-a5bd-299b83914a7b", "comment": "Malware payload (AsyncRAT)", "value": "04143e73b28dd43bfe87229eb4dc7b21", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192907, "uuid": "32608d18-68e7-431d-878e-4a2350adbe67", "comment": "Malware payload (AsyncRAT)", "value": "2cf64a4bf25515774b4241667db3cc52c9df956e684a3c58535c7f0e0a27cff6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192907, "uuid": "68205b97-2f08-42c5-b1b9-bbfe04600f06", "comment": "Malware payload (AsyncRAT)", "value": "6237965fd0bc45f4e1125b86546f1d850b5f2aa0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192907, "uuid": "194ed2f6-ffda-440c-b475-3b28d83ad1be", "comment": "Malware payload (AsyncRAT)", "value": "b252713c77e1799a5557b4198b430bfde579a6d55f02b8d2117670bce122792f43cbb5d11d74c885dc187e17dff717f6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192907, "uuid": "91672014-e7e4-47ea-8788-764cbfabc66b", "value": "T1D3365E87BA75280E86DC416A8C7FC1D3EADCB80D0D2A544B41F5375971099B6FF83A2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192907, "uuid": "9871d11c-c1ad-49c0-ad36-4ca8e91f6653", "value": "768:Mbnw2KIl7wO2ORE5f3iuj/D3gups0wVEAt37sH4AysInWMqfpXW4/KXXVKiGU19r:w5YY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791192907, "uuid": "fd8666ab-a950-4856-8e98-1dbe26517878", "value": 5181800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791192907, "uuid": "2da658c0-8f7a-4d0c-adb0-bed990c5f629", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192907, "uuid": "50b8a355-ee47-494d-ba57-dbba648cda52", "value": "PO_REF FG224003.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc193979-c0fa-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791231855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231855, "uuid": "910a2878-b4c3-4244-9a28-9722e128c71d", "comment": "Malware payload", "value": "7d7c28dbf7e36faee6f4627bff47150e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231855, "uuid": "94f9ccd5-1d9b-4fd8-a54b-249da583f0e2", "comment": "Malware payload", "value": "2e1f662500bb0850b68c7117d7eff513067e9686b6b290d9946033d9d725b40c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231855, "uuid": "325c5874-d4dd-459a-9406-70f0e8124e0e", "comment": "Malware payload", "value": "c87f5a3a71dbe10489834cc270e57589208991fc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231855, "uuid": "16cb9e4c-5550-4425-b32f-220af7297f9e", "comment": "Malware payload", "value": "731f6f2588cf1481f722073e4c9dd97fcc6ee5df24e21dc9322ef62fa728d83054bac931d1dfe3b8aa552cff17ffd681", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231855, "uuid": "a43c85d4-4998-4cdb-b326-f0091e06980f", "value": "T11C753317952CA813FCA343744B8D73FA8AC5B05B0D898A6B5EB55221CD5FFC40E2C9B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231855, "uuid": "576a9479-df3a-4013-8d48-b882345f0fa4", "value": "49152:AicSAU9wspVaH3Vd0GE2eprdi89L34WbN:lcSGspVaH3Vd0Gvefia8sN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791231855, "uuid": "54a14088-2354-4f0c-881e-c1cb829ea85f", "value": 1584655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791231855, "uuid": "2d973ad4-9993-43ae-81f5-1125ecac47f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231855, "uuid": "6ab38012-05fa-4522-9e97-05c94e18ae4b", "value": "2e1f662500bb0850.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa49ea8b-c0e1-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791221088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221088, "uuid": "19ad5c80-b21f-4603-a3d5-ef20e7a0c07f", "comment": "Malware payload", "value": "12869dca48ffac26aa233cd2c3f45d03", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221088, "uuid": "c850cd6c-682f-417f-ba34-6a7b48c75e8c", "comment": "Malware payload", "value": "2e93a030d87009fbc378e9e7fe2cfd43554d32cc194317f81e1dfc591edf6077", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221088, "uuid": "e100f031-d7e0-40d6-aad8-c523d263c4dc", "comment": "Malware payload", "value": "bd19ab25c620e3ca416bbc5368fcb1c9f53a1493", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221088, "uuid": "51b51843-da4f-44eb-95e8-daaa8da58ad2", "comment": "Malware payload", "value": "403e4cf17da4928579c3863ea4989b0c9a8b8754efb11cd2efb41880fb8db43503ba66b6cc2db6b38943e8fdda7978b4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221088, "uuid": "1dac6801-367c-476f-a06d-2eb10a3a232c", "value": "T12AC633C4876EC6F7C286D03DD4FE836D380519A773726BB6B401D6E279C15E0AE8A48D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221088, "uuid": "1e81121b-dd33-48a8-be2a-feffae6c8680", "value": "196608:FkphTE0sD2NZKlO7u85niTD3m3mIqhzjpPBCy+D/UH6OCIJWC3N8D3dWp:Fj0sSNMlgu4iTDpIQPv4c3x3N8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791221088, "uuid": "976250a0-7eda-4d09-8af8-8c54f11f5ad2", "value": 11658504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791221088, "uuid": "bd45d33f-d6fb-424f-9596-63df1689d912", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221088, "uuid": "26f0fe33-207f-458d-aa0b-85c063494578", "value": "2e93a030d87009fb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65471199-c0c1-11f1-927a-4201ac107004", "comment": "Malware payload (SilentNet)", "timestamp": 1791207228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207228, "uuid": "72708165-0101-4237-9d2f-196c53bf95f7", "comment": "Malware payload (SilentNet)", "value": "76d3284621286d394e4b026120cfe911", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207228, "uuid": "ae89e411-75b4-484e-ac67-d09942d89d45", "comment": "Malware payload (SilentNet)", "value": "2e97d4aaab5617f2ec5eb49768ff31c420d7c912e290ac4e99f849232c0af9e6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207228, "uuid": "a0a2bbb6-10fa-4ae0-9a28-f75923eb5ff5", "comment": "Malware payload (SilentNet)", "value": "00d58bfe00004178dd9dc612042612612e74c673", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207228, "uuid": "93092056-947a-4212-a048-21b15a7c7382", "comment": "Malware payload (SilentNet)", "value": "b07fe0ae1aa2b426188016ccffaabfe4f7a5af3ee19b974d4a3610cbd822f80916d850d4fb9a6e44a7b32a89e077937b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791207228, "uuid": "0f0210b3-57e4-4429-9e4e-5eb589c7fe57", "value": "T1A34423E9784FC42BE103EC7061C2BFB11E8D635AA0DC962E04B8459B595CA175F3EA73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791207228, "uuid": "7e1ff7c7-0703-44f7-9ae5-8b92a32ba604", "value": "6144:GcQFRl1PRHugq4V7QSw26B6FqCU7NE0KFYysF:76l1ZOgj5k6FqvEGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791207228, "uuid": "246b9a7c-8032-40ec-8c37-2d23cb2f3e47", "value": 277067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791207228, "uuid": "cebc290f-42ea-445b-b6d6-e5e0cc82db62", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791207228, "uuid": "40e4169c-ce8f-4807-87d5-67143ba12eb7", "value": "Cyberdupe-1.0.0-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d496a158-c0d4-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791215575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791215575, "uuid": "6cc83a8d-f334-46ef-8bb1-e20b701c4f53", "comment": "Malware payload", "value": "6e2ac3ab704ad6ae9557360b2ba59b72", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791215575, "uuid": "c353d0ea-4c78-4b28-8755-cafc79eb0f0f", "comment": "Malware payload", "value": "2ede40f7d7f02014533a250bd68ee2da8f48cd222d14d4a66c50206646ede127", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791215575, "uuid": "5010a41c-74c4-4e2f-ad42-c9ab143a2cab", "comment": "Malware payload", "value": "69dfa5c233958ec6c590fc261e24d86ffef32fc8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791215575, "uuid": "6a6f8fec-ca2a-476f-bf26-61a74e5c1361", "comment": "Malware payload", "value": "2c8b56453a3a26c3baaab4bacd36a350fb707a9d3bdfa6d696f23c85ba16c8d3db34381d482affc66aedb0db9d38ff04", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791215575, "uuid": "95140148-926c-4111-9884-ab289112b3fd", "value": "T1F9B733068F6F9E2F8ABC215C24BF0F4E26E48E544105B9E767E67CDB9A4FF11204616C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791215575, "uuid": "e6781e5a-07ef-42c6-8ba1-d7183f8a1756", "value": "49152:QF+1Z8nS6+ScO88pUQGNL70GNecQYVMIVoQ2UDPOT83SAdQ9t7HBFUQbneE1o+JR:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791215575, "uuid": "6dd025f6-f727-4be0-bb19-6beae462deb6", "value": 52430906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791215575, "uuid": "46379667-0709-4bae-9a67-1f39f4d8e610", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791215575, "uuid": "e931937f-56fa-4818-8d42-77acc6582c73", "value": "msg0001.wavPortalFile)34678458745a742e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac614012-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791190597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190597, "uuid": "cdd699bc-0547-4fd7-a2e4-128aea10a847", "comment": "Malware payload (Formbook)", "value": "d8b0561e67d333b30330f527942c9874", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190597, "uuid": "20c865b8-3839-4b8f-9b40-7fdec3b717fd", "comment": "Malware payload (Formbook)", "value": "2ee5fff869eef9829bc93e16fdd87edbf4e487d8b7173ea8401f11fb3301327f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190597, "uuid": "04b3d6c1-0c8b-4718-9246-dde2639fb364", "comment": "Malware payload (Formbook)", "value": "c30088e419926749dcfcb6a233cb6c81306995e7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190597, "uuid": "5cd5a9e6-9366-461d-8321-63d549f3ee7f", "comment": "Malware payload (Formbook)", "value": "d46bf98cfa94383b392e22e0e300f03e958cead47a1833350284f42177fd4b208e11ec7bdc91ab3d7e7649b9ea47aa84", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190597, "uuid": "1157495b-3a60-40b8-981d-6602684b9b84", "value": "T11423FB444D81748423336B7ABB2AA8E5F77B0A6B0194490BB87C7494EFB1D18DEE4DF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190597, "uuid": "1ff1fbb0-d323-4bda-8ae5-154c868be558", "value": "768:OoT6s0rdUEVDLCi3yRB7eep4bl3A69euqtZvVJPT+E3FTcxDp9wThIuq1Dd1R/ee:OpUEVDLrW7ks7+Tyy0CHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190597, "uuid": "aea7da0a-3782-4866-b6e5-30eaa7d6a847", "value": 49679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190597, "uuid": "76c8b7f9-d224-4eda-b6b7-08327ab0bb9a", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190597, "uuid": "73fd5a7f-5e49-40af-a802-2e69171c4120", "value": "ePL_051026_4850.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a768d2d5-c0de-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791219794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219794, "uuid": "eac744ad-792d-4bf7-996c-2d1bd51e73a5", "comment": "Malware payload (Mirai)", "value": "56930f65a4a5718cb1e42c3d35f529a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219794, "uuid": "a38e4991-9960-4e25-9e6a-84f3ccf4e215", "comment": "Malware payload (Mirai)", "value": "2f3ad7513639f68f664d3fe613884afba9301e4409d317dfdf23a88aaba31d26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219794, "uuid": "d78e5425-d798-4df9-9575-b6ec490966bb", "comment": "Malware payload (Mirai)", "value": "84d94d14c74fb8a65e0827f3cb3d0fbf201a186b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219794, "uuid": "2aa0a58a-5703-4178-93a2-96cb3f9b903b", "comment": "Malware payload (Mirai)", "value": "f41e79421f1483b6a29f3abbd168a0025341b1bc789ef2189afb0ff9ee5523c0d2b028a3c2d958709a2a42b0a2ab0f74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219794, "uuid": "b5a0136a-c713-4807-bf67-69b282e8e886", "value": "T1F505E60B6E329F7EF579C73087F34B74969972D726E1C588E19CD20C1E2028A651F7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219794, "uuid": "addf02b1-9013-429c-9a36-5771ec2b0436", "value": "6144:YWQ3CBOf5fed3T6Fw8CnuhbA3TcMNgimsAGo3Jcv71PxY+MbklxXOwAZ1TCKeRHR:kAwRK3Zuhk1m2L+RoR9tReYyuOzrc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791219794, "uuid": "8195bfdf-b550-43fd-888e-cb54cd09d9bd", "value": 856372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791219794, "uuid": "83fcceb6-dbc7-4ddc-9e2f-0253400a0304", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219794, "uuid": "50fc27b2-758f-45e0-b84e-c0d040a36dfc", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14fbfae3-c0fc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791232434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232434, "uuid": "f93504b9-7caa-4f45-9a7d-2fdc6c650d06", "comment": "Malware payload (Mirai)", "value": "26e6f99ef220be0220a873ac77828140", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232434, "uuid": "2a227a8d-5d83-46d2-83d9-704089e6dc4c", "comment": "Malware payload (Mirai)", "value": "2f7b82759e453c063e5d62619ed9437f9fd81d0132b9df24c1ade7ecf6362a6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232434, "uuid": "54aa59a9-06a9-4173-9c44-e7c87b5d33ce", "comment": "Malware payload (Mirai)", "value": "eb5fcf378489559481dc3b850e79a365b3944dfe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232434, "uuid": "948a0cb8-37eb-47dd-a8f6-3c54bc3d77b8", "comment": "Malware payload (Mirai)", "value": "dd06552f955d3c245e02d870d2d0dbb232e1e0bce5958e9d86c18c71de73103fb308af279f615da68b0db81330000960", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232434, "uuid": "45837b22-97ee-42e5-9b3a-db894ab157bb", "value": "T10833F1B6929B9D61C17056FB162DA49D64062378E3F2F10356624470EACB1F38AFE7C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232434, "uuid": "b2ebc8ee-29ab-4343-bebf-bd277c17ad30", "value": "1536:3CoqsGR4eB3g0Vmh1IxIpC8Jy8L9VE8amFZP7R3F:Soqs2Twh6P8Jy8LJ9ZP7R3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791232434, "uuid": "0c175022-9cd4-479f-9822-c2e37eff08d8", "value": 51444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791232434, "uuid": "94efd066-74f6-4aae-b857-b88c217cb902", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232434, "uuid": "79c92a4a-8071-4a15-ab7a-ebc702f44167", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa3acf5-c050-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791158766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791158766, "uuid": "365c5b30-4b58-4bdc-b3f4-658111b78c48", "comment": "Malware payload", "value": "cfb471d7c3a01f0f2f45794e7bfdab24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791158766, "uuid": "861d452a-5da9-461f-90d2-39c3b910e85a", "comment": "Malware payload", "value": "2f86a4fe00548a8ac9cf5941bfcece12e8d1f815ce720bbd02a8fa7b93ef015c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791158766, "uuid": "55531cb9-b5cf-4f4a-902a-ecea84ca99a1", "comment": "Malware payload", "value": "68c89f23c4eb5bf7d89b9704ac6350bb6c71b6d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791158766, "uuid": "8e296ab2-4675-4751-8111-f60768c9c1e0", "comment": "Malware payload", "value": "d5aa21f150032329985651a959825d6613cbd7d7d04cd84dbf1ef1ee6b0920ca41eb948bb111a94b83280f8b84cf9ddd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791158766, "uuid": "dad73ae9-c398-4b57-9622-c56845f6b008", "value": "T10CB24A95E6C3E0F3D89401FD11A3D7116772F8382176FD4BEB2016BBA802961A74BB9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791158766, "uuid": "22aea1aa-a718-4977-9646-ed0680589748", "value": "384:fO7o+KLO0HmRVvpnRR3I0zFg8q7/kRuJTco2XURhC1N9JmE3CkkRgSr:KNKLO0HmRVvpnD3fShJ6UvCvmE35kRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791158766, "uuid": "b66e5335-9152-4e99-9c4a-d496f92efb22", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791158766, "uuid": "5174249e-2fb4-46ea-a0f2-cedadcb6e8ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791158766, "uuid": "4b176ffb-b3d8-4afd-a2ab-f338555abc3f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a00e96-c103-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791235500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791235500, "uuid": "d1037c2b-9d0c-401f-833f-d81930fa0264", "comment": "Malware payload", "value": "643f40ec3da1858d2ec85976b9c41959", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791235500, "uuid": "e235260e-6cf9-40d9-aa2c-03fd9b2c1f54", "comment": "Malware payload", "value": "2f9383b9fda686b01e8321b66970bce73d9626013135201b524ece8549b9ebdc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791235500, "uuid": "67f2cc5d-18b5-40f1-88da-b55841d481d2", "comment": "Malware payload", "value": "4a4a8deef3dfaf02ae8605177e90e4f649eedfcb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791235500, "uuid": "d83999b4-53d7-4d7a-a2bc-71dda7cf382a", "comment": "Malware payload", "value": "fb6831507a15b6749025cd8e6da6b394f06603dd12268266f44213b099fb85cbcfb5dd2fe074ebcb56d0df89e8960c03", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791235500, "uuid": "439330d9-ebef-4204-b8f1-74068e789acc", "value": "T1BF75330795ACE813FCA342748B4DA3EE86C9705A0DC58A7F5E7592608D5FFC40E389B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791235500, "uuid": "cd21d960-32a3-4e05-9775-9cf88bf46203", "value": "49152:TqmeWI/MKTLCrnhb0KASE93dYiH53GWj5I:mmeWKTLCrnhb0KDE/Yq4YI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791235500, "uuid": "176cf8e1-3ab0-4adf-8c4e-1944d793c70f", "value": 1584678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791235500, "uuid": "0a6593ed-9e56-440c-9e8c-8f1cbba18795", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791235500, "uuid": "54a2543f-95b9-4930-a996-b4c00f14f13f", "value": "2f9383b9fda686b0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3fcb84-c09b-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791190974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190974, "uuid": "5c85d1fb-dd11-4dd6-b844-fda5c28fed47", "comment": "Malware payload (AgentTesla)", "value": "02a3b582ec8d3c7e88ed89f81ca5140c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190974, "uuid": "7ab43b18-892e-4103-b438-081ce3d5c536", "comment": "Malware payload (AgentTesla)", "value": "2fa99988277efa08940d00156a61518f3c302747b5e0997760bf78055928e6d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190974, "uuid": "95b59280-064a-46cc-bf2b-d905fcc80206", "comment": "Malware payload (AgentTesla)", "value": "de8526b910f391116b8824073be554c92ba759ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190974, "uuid": "064a04ef-9a8d-45b3-a203-f5c676261557", "comment": "Malware payload (AgentTesla)", "value": "ad99b837886beef8d29b8cf1da617d2199cdfa8ddf1f5f2c33e8649f3b56739f89ca3972caa5b828fa6d440291bba440", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190974, "uuid": "1086940d-e301-4b8b-9ab4-5911b61f249e", "value": "T18DB33AF4CE1D598A091B72DEEDA41E02C1FDA199001B45E2FFC8074C506696DE7BEE2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190974, "uuid": "ed3d822f-d6d2-4e38-a1f9-fda813a008eb", "value": "1536:sMCym9XXU9TbehJwNg9sWdMhZ29LhswmmjfMLVgIFfgA59mQ0+mdntzm1a24+wXN:85Ane8NgdthFjiOIF5fmQ0Pdms23w9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190974, "uuid": "24810e31-22b6-4960-a385-3cd3163a48ad", "value": 111823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190974, "uuid": "824bddfc-7ac1-4299-b4d4-52ba996369f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190974, "uuid": "1974b2e3-7e33-4a3f-aae0-77afc29f06a8", "value": "Trial_Order_Requirements_2026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24c902b-c0a4-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791195009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791195009, "uuid": "6a0ab7d2-998f-4668-bda0-1e2c80796c37", "comment": "Malware payload", "value": "7ce4327525fba7548d6c8b432cafc976", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791195009, "uuid": "cb20d438-4e5c-4c3f-b7b0-26d11909313d", "comment": "Malware payload", "value": "2fd78799b30164e8191cc94722a193761814274309e2c99b45752a01acdd175c", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791195009, "uuid": "4efeb7ab-2064-4121-be5c-f4e3d0ab5456", "comment": "Malware payload", "value": "cc5fe3e2acc5bfd476c503bbb814a84ebb390e17", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791195009, "uuid": "9aa6cbf3-0a9f-4146-a005-b8cb57d83bba", "comment": "Malware payload", "value": "bcd32c6160bbfc91d42c895222d647b84f3a39774afc22b92204d60a4042eb1c7c013a2da95ad32ab71d40d76ae71bca", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791195009, "uuid": "fc314bd1-1396-408b-85c7-3b5e1613da56", "value": "T113A3C645BE9E14232777742A97E7701F5EAA89129101B053FFDF80C4AF8D13889FDA1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791195009, "uuid": "46d931de-22d3-4b25-b768-7b481d111aee", "value": "1536:j+KO5okb1K18hpCjByvB/sO+cqC3OoJ7Su1u0LIcjjV6sjG0liD:1OHKjNyvB/sO+dct7pLjUsjR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791195009, "uuid": "47e84e05-20b9-431a-b28f-6846911e9291", "value": 100225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791195009, "uuid": "238603e2-d5b8-480f-bac4-d4f5ede000fc", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791195009, "uuid": "af130334-6cd4-4682-bbe1-419f91a8cc54", "value": "2fd78799b30164e8191cc94722a193761814274309e2c99b45752a01acdd175c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c8f143-c0c3-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791208121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208121, "uuid": "ca31b17c-824b-4c0a-ba85-e183ead78aed", "comment": "Malware payload (Mirai)", "value": "67b138f80326cbbe6969f3ddc3498d44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208121, "uuid": "b3cb66db-b193-49de-88b2-b99e1081ba46", "comment": "Malware payload (Mirai)", "value": "30e0cb05a8c207c4084adaeb2906cbb8119b3d638999a73d4635e333e09cc0f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208121, "uuid": "76d17a29-affa-44c1-bede-6f0e902a7fe8", "comment": "Malware payload (Mirai)", "value": "531749a71cb6da2f0479f481451893436e2e6e98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208121, "uuid": "d6ec0fba-3ab3-4408-87e2-13f1498e784c", "comment": "Malware payload (Mirai)", "value": "463fd3dc334efcf7b98d550a8d121c5929fc80d4e7d69c761950f1b9dfad8843a3233c90098570e7ccdb74195706e181", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208121, "uuid": "3b76c521-f2d5-4623-95ee-5c89d2fbb75a", "value": "T173F3E6CCED54472BC2D323BAF78942CF37361A789797B31159A7EAB02BC53441D292A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208121, "uuid": "30f21162-742b-454a-a865-21a69e7f5bcd", "value": "3072:2kAR5cCI0gu0gb2kqi6QSsSmaSXNiqSEVAmiL8qka/2agGpOFxqSentSbpCzRuOl:poFOMGJssXgCnGUGpIDmP0Q38MO5tx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791208121, "uuid": "83b6a405-7822-48db-b388-16c492ae6be8", "value": 159621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791208121, "uuid": "ded182e6-7daa-47ff-83d2-34b813375b99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208121, "uuid": "2e967d12-c64c-4fc5-9f14-44224825ca98", "value": "30e0cb05a8c207c4084adaeb2906cbb8119b3d638999a73d4635e333e09cc0f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3241a2e-c0e8-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791224190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224190, "uuid": "ce87f418-9bcb-4f6a-b9bd-3f61165de3a2", "comment": "Malware payload (Mirai)", "value": "5d8767cfb0428859a4bc8e261118fe59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224190, "uuid": "cfeb125f-4186-4963-a889-18019e749e8b", "comment": "Malware payload (Mirai)", "value": "30ec28369bcef2c7be1d7f814be7bfebec79ba8936eeddf6c2849e73c73e73dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224190, "uuid": "ccebb706-ca40-4ac0-bf03-7150842fc73b", "comment": "Malware payload (Mirai)", "value": "0cdbe3c6015740319c2ac845348e69bbf5000874", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224190, "uuid": "c14676bc-78f7-4306-9a24-0d60884d4be9", "comment": "Malware payload (Mirai)", "value": "5b5d59f825650e5d535f1eb0e9e3acedf89d59139bd4359da8340537d27567c8ed6e0cd191e01c493252d958df01c02c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224190, "uuid": "1353064b-984c-40d6-b779-ef38bda0e3fb", "value": "T11C244A02BB1D0687F1871DF43A3F17D1839FAA5120F9E648398AEE4E52B1E326546DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224190, "uuid": "bbf75b8c-579f-4514-a925-7854bbfe082b", "value": "3072:tdG8N4PlBQXXCF8gI8106epeaF6G3A4xHGWCHhBlAhC/PrKAeC/O5W:tLiqSv3bNyxHoHhchQDKAm5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791224190, "uuid": "6681b56f-eb6d-4d8e-9011-39949dd7c17b", "value": 225804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791224190, "uuid": "08976d81-37ce-4fe6-910b-2d5336350c6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224190, "uuid": "8e712603-e4a4-42fc-8452-70e3539a3d76", "value": "xnxnxnxnxnxnxnxnpowerpc440fpxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a7a971-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185881, "uuid": "cb7a1474-da2b-4e0d-86c6-80348897af17", "comment": "Malware payload", "value": "7432d669a900dacd338c311a40cdb37f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185881, "uuid": "2dbee03e-77b4-43e0-937a-7890c24d87bf", "comment": "Malware payload", "value": "31257befcfc080c5685485c292bb4e01c5536f072e6ce24cae05d11827fac962", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185881, "uuid": "b7e6ff46-a4ac-4a5f-8410-ce5c78b9e95a", "comment": "Malware payload", "value": "f0e384d91502fe512acacfa68c6c396f9f7d3294", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185881, "uuid": "915fc4bd-c714-437b-8b4e-c9b30e9d5178", "comment": "Malware payload", "value": "d5fb6305ab91f920f78c28f12e5c5a2f1b55d8052d90677be192129382cf550c9e91fca7f74c7b34f6d8039f06d7b197", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185881, "uuid": "29e97eb8-a546-44a1-b5be-da51087969aa", "value": "T1D6053354A01AE471F8749BDB13570B1B9CA6B6B707F9DD4EEB2ACA51CCEF12A0011C39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185881, "uuid": "b4d3bbad-5291-4da9-b03b-1d90bca13e3a", "value": "12288:luXGoE3tZRb4ClXCGHhxQslzNnUbQPG3MYT3ahlfbl8jZA7ALoCLTp2M5GcEA:lAc3tZRb4CEGHnrRnfGcuqhtleyWlAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185881, "uuid": "c32aa0fa-848e-41e1-b85c-a35fa5c8b748", "value": 826908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185881, "uuid": "1d76504d-0b64-4061-8f9b-4b0e23a2968a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185881, "uuid": "3996ebcb-d403-4ce5-8a37-bcddf98a0466", "value": "go_bot.mips.bak", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2014fdae-c0df-11f1-927a-4201ac107004", "comment": "Malware payload (VorishkaStealer)", "timestamp": 1791219997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219997, "uuid": "df9091ce-b052-431f-8052-dc5719f8a435", "comment": "Malware payload (VorishkaStealer)", "value": "e85a16d7e9fe863a85f78d9f0cc4501f", "object_relation": "md5", "Tag": [ { "name": "VorishkaStealer", "colour": "#AA7A08", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219997, "uuid": "457ad5fa-ca0b-4282-993c-709632ae6ac8", "comment": "Malware payload (VorishkaStealer)", "value": "314a605bc42b47f044a1b297e4db33e66460952a23840767ee40c0f4acfdcf92", "object_relation": "sha256", "Tag": [ { "name": "VorishkaStealer", "colour": "#AA7A08", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219997, "uuid": "feddbf0d-74f2-4fb5-bc43-9edf35fb1ba0", "comment": "Malware payload (VorishkaStealer)", "value": "8b67774d341dd30223a55d201e5a90ceb65579f1", "object_relation": "sha1", "Tag": [ { "name": "VorishkaStealer", "colour": "#AA7A08", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219997, "uuid": "2a28329f-b60b-4d36-a941-366f2fcc797c", "comment": "Malware payload (VorishkaStealer)", "value": "11cf9c956af80c08a396c7d8a079284b250250b66d1ef7fc596802bb4b5e9e2369361b20bea4743bb1b01a4027020e49", "object_relation": "sha3-384", "Tag": [ { "name": "VorishkaStealer", "colour": "#AA7A08", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219997, "uuid": "f9e2385d-ce0d-45ba-9bed-0089dee64cfd", "value": "T160359E26B2AC01E4D166D1BCCD960506F7F2BC4613319FDB47A06E961F17AF1AE7E220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219997, "uuid": "1c89480d-823c-4227-847f-c609ae7e7796", "value": "853a8c2cca7aee080da03665735756a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219997, "uuid": "80b007d2-a5dd-4de1-9859-79094fe3c5d2", "value": "24576:9AUVZpgaFsx7MmMKsmsCMmM7mMCsmswVMmMCsmsasmsCMmMKsmsCMmMoySMlMMmw:CKWdGkgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791219997, "uuid": "841ce049-74cc-4cd8-b588-ce2312d22c11", "value": 1136128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791219997, "uuid": "d3d2fc92-5748-49fe-8e3c-748a5b9c49c7", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219997, "uuid": "5ae4ff71-ba6d-4b96-a3b3-e74498fbc06f", "value": "111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5349c9b-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181646, "uuid": "84e50cd8-8b60-4585-afc5-1101dbf324a3", "comment": "Malware payload (Mirai)", "value": "ad9701ee71f6d273d8a6a9993ee4fd42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181646, "uuid": "08c24120-92bd-4456-b2f9-da28603abdb4", "comment": "Malware payload (Mirai)", "value": "3174b833774119e0ece2beaf9ec69d6e53ab28b5b052c4bab090a960dc07963e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181646, "uuid": "e904714a-4ecd-4ae4-bacf-6e0843333c13", "comment": "Malware payload (Mirai)", "value": "6b30b3fcbdd94e240457ccf77cb40114066a837a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181646, "uuid": "61a76364-fcf8-43b6-8743-fe3654b40619", "comment": "Malware payload (Mirai)", "value": "6362709d1f7533380b1e27116f5cde949a7b817a3506d57ec3984a128ab96444315b63ac9f793df228101d9848f15f27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181646, "uuid": "e773cbe6-8ae0-4783-b86b-218a3edc7f71", "value": "T1CE043C46EB418A23C4D2277AB6DF424533239764D3EB33069928BFB43F8679E0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181646, "uuid": "a34aabfb-4efa-45e6-99e3-812e6e647ab5", "value": "3072:opcXsI12J2vuJTRgGaclkHy1gN6iOqcqfFIRMkVKuR29LM/9uLUL8b:oyt12PZeGaclkHy1gQiOiFOMyKuRiLMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181646, "uuid": "c2b9073d-cd4a-4b27-a104-fb7667ba0b55", "value": 178143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181646, "uuid": "9e8f7bfc-95a1-4c30-aa9b-2daa68a0511a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181646, "uuid": "990e7932-af55-4cfe-8d4b-651bafc3ca55", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab895165-c08f-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791185871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185871, "uuid": "7c7abcb3-e5bf-4466-b88a-c4608d3d80d3", "comment": "Malware payload (Mirai)", "value": "5f2410506e9c704af8d1e10ce7f4b879", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185871, "uuid": "1771090b-daa2-452e-975d-b80cf00461ba", "comment": "Malware payload (Mirai)", "value": "320118834d57513651bbefe36859ee9e2e40607310a4e03710dccb5bbaca8e3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185871, "uuid": "e4cfa913-5a2d-482e-bb4a-a44067230388", "comment": "Malware payload (Mirai)", "value": "193e8fd75013d340e2f10cda58539cd0f21cb3e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185871, "uuid": "78001b69-2c37-48f5-a8e3-09ea972aeef2", "comment": "Malware payload (Mirai)", "value": "8491d5cae8f3d79db77b90cf203db18c18637abcedeee12dae1897b0fa405fc372c0ebe901a90f5d636f10ce24ca0337", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185871, "uuid": "abd3c525-8c9d-40b0-966f-a50d4f6dff12", "value": "T1FC531995F880DE21CAD02A7EFB5D128833130B78D2D97202DD24AF3567FB9564F3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185871, "uuid": "a8362b6e-fed3-460a-8786-c33d6d9bffd0", "value": "1536:9YsP40Hx1t7zyBjNZJHzmzQA6PCWRzFOkilF6qOMPzOIrU:9YSBdPGXJGQAeq//tzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185871, "uuid": "72d0d17e-99d6-4ab6-a746-b5a121ef2c2d", "value": 62848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185871, "uuid": "cdfedd74-040c-4642-93af-0463255c0032", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185871, "uuid": "e1a4b48c-57e1-4a3e-ae9c-a575f0a4861b", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bddd574-c094-11f1-927a-4201ac107004", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1791187858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791187858, "uuid": "5ccee550-b056-46d3-9a93-c8695aa2f8b4", "comment": "Malware payload (PureLogsStealer)", "value": "5500207c170d4ba2cdb301ec87a2db6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791187858, "uuid": "494e150b-218e-4cd9-9025-422ca86bf310", "comment": "Malware payload (PureLogsStealer)", "value": "321412c9e3b62d010fa039be0c56f2440910082abcf36597de697240ffba4011", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791187858, "uuid": "ab2bc979-4e6d-4c28-afb1-9e3ee94bca99", "comment": "Malware payload (PureLogsStealer)", "value": "e2dbaad6794722e575c9b43bf78a9ebc404c7a38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791187858, "uuid": "0d19b35f-7a81-4d76-a5da-0b4221221360", "comment": "Malware payload (PureLogsStealer)", "value": "27f1b77a1f3a6cf782d942d1ead095c083a1429490a8cac58f2075685dd34dd8b7c71b2ef9218c8cb5a1c2413465dd61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791187858, "uuid": "4643d115-d1bb-497c-b5ad-01fefe9a0692", "value": "T15DC45C1B36914E90C28457B7E1DB950083A2AA86F9E3F30FB28413A61D177FED947793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791187858, "uuid": "1bfeed5a-3ba0-4a95-a92a-b7988ebfc749", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791187858, "uuid": "9f42c6bd-7703-4d07-aca7-83c0239833a8", "value": "12288:yW+0epmeEj2KqFXqZYyZicQBeNIPsqNV:V+rJFXqZDixeNIPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791187858, "uuid": "078b1751-5395-43cf-8c88-1ebf98029b64", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791187858, "uuid": "08fc665a-3dc6-4e3b-bc83-7bab6291497b", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791187858, "uuid": "0768f76e-9ddc-4182-9f5d-2266611479a5", "value": "5500207c170d4ba2cdb301ec87a2db6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b136890f-c0fa-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791231837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231837, "uuid": "3308546d-9103-4078-b865-7be6dca0440a", "comment": "Malware payload", "value": "035e1579c1946fe4a988d35615ee8c64", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231837, "uuid": "f25b3bc5-d441-49bb-bfc7-5e120ada3800", "comment": "Malware payload", "value": "325a6f8423e68cf79d5dd0302f35274b2b78f7d40e17ccb2d0acf3a094b9ac84", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231837, "uuid": "f1a78975-7ba3-477c-afc9-994c49844d58", "comment": "Malware payload", "value": "ae81e88678d47ecb6ef9dad861edc8ff0da71951", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231837, "uuid": "e1d5e6d0-3076-4ee6-b2c7-08fdea7d9720", "comment": "Malware payload", "value": "fcf6251ace44a2c977f547d3fe8a761f75be539687706de85294d8216c06ee5897e79a77a50603285bcbbde77458c10d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231837, "uuid": "9478c1ec-7c65-453a-a6ea-b55fbf0d1dcd", "value": "T1A7753306967CB403E8B203748B4DB2ADCAC5701A0DC4CA7B5E7992619D5EED84D3CDFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231837, "uuid": "2e58f062-b11e-4939-9c2b-1e5b17efad54", "value": "24576:vBRXkF8k510cD2UW506FT6EAIb4uEz3RrzAS/0cr/J8G9u9XYedf0nOVzfP/H33S:v0KcaUW508TBQhzR/0geGM97d8O5f3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791231837, "uuid": "16bfd8a3-9835-49b5-b9d1-f47a9c6480c2", "value": 1566674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791231837, "uuid": "beaf63eb-d5c3-4d9e-9ddb-a0db549ece03", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231837, "uuid": "d3dd937c-e719-4828-97b7-375a6eac1f36", "value": "325a6f8423e68cf7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56fd3ed3-c0ab-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791197755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791197755, "uuid": "3b8fbf91-71ce-4ed1-9aa5-42790fb8a4b3", "comment": "Malware payload", "value": "b8ae44aea7c0f0ab89e13da2f62d6b6c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791197755, "uuid": "b835e59b-5e11-42e4-b9e2-cc572fe80d8b", "comment": "Malware payload", "value": "329e1748bc219bc90cdef7fef6f7c03f39f16f4d2e77021a7c37b902fc94c20d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791197755, "uuid": "f8e60e21-dd4d-4843-8acb-20dcd940d2f5", "comment": "Malware payload", "value": "eb7ac078907f709063720d91a9ef1ec42f5fd0ca", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791197755, "uuid": "e885fcc4-0355-4e44-94d8-464f5b5c5d00", "comment": "Malware payload", "value": "bb64db1791aad4d22b21d77a0de10dc9b75df1fd5fa91379583316e4c929871fe94237e1df029d59d7c9e7e941d9cb39", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791197755, "uuid": "b7ffb964-a4fd-4248-ab62-68c907f3f99d", "value": "T1563140F3B5F6CA71268C501469DA8A97E64B0A3B08583915F0CE34143F18CE4B5E5B57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791197755, "uuid": "f1240ad1-979e-4503-b14b-259c91cb17b5", "value": "48:Siv2bDqWhUEhcicHJOvOI2D1mSNDogvK0C/0Ckd/f0CMYk:V2KpXJOz2D55vKn/nO3n3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791197755, "uuid": "5e173007-3f63-4bc9-afd7-8c1b40998def", "value": 1812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791197755, "uuid": "abe54a6f-521f-4d37-9a7c-b4ddb6472257", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791197755, "uuid": "325a51bb-f9a3-4812-a09c-8e0602d2806e", "value": "agent_i.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0d1076-c0fe-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791233308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791233308, "uuid": "10ea83e5-c6ec-45bc-9a1c-f447de01c228", "comment": "Malware payload", "value": "52fa00a270274ce339ab0f0d828396ec", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791233308, "uuid": "bbd4acec-10c5-4376-8f06-610b3715fa59", "comment": "Malware payload", "value": "32aded55547f7ddfa2bbe0298985f27848009d77f5ad117221f44d86266e353d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791233308, "uuid": "9b1d7f12-5f0f-4f89-a7ae-ea4d3540add0", "comment": "Malware payload", "value": "7f046eabb3c7811768e8de1260c2371a7d41cc0b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791233308, "uuid": "dc8a357b-3139-4cba-8afc-a5aaf3cfb7a2", "comment": "Malware payload", "value": "a9752b03d4afa6004fe134ad352b3422f8957f58bf4b8164fd4d7084e92bd1a97957f5254667246f391d3bc3357845a1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791233308, "uuid": "f52cb51b-58eb-440f-aca7-8ea558b284c5", "value": "T133C1318AEC016099A931B3BDCB7F965DEAF29D136158D301BC5CA485AF34C6042A5FEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791233308, "uuid": "d0e38c43-f253-4317-a787-a914273cc06f", "value": "96:mypy9IbK6KARIj+FWbSDGM0DoUeY2KFP4GOagBD3s:mD9jn6FxCMOeY3PXKh3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791233308, "uuid": "2c54dd28-1f6a-40bf-86b4-2a91dd985686", "value": 5891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791233308, "uuid": "befbdc70-9c9e-437a-b7a0-50e4e2655c99", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791233308, "uuid": "3f0b80c6-6156-4c63-8367-050ce716623f", "value": "payment_26.08.2026.839263.p7s.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94233026-c0c3-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791208166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208166, "uuid": "ead471d4-a0e3-4f33-bfcc-979d24f6ec8c", "comment": "Malware payload (Mirai)", "value": "b623466f843cad87003897d9c64a9c70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208166, "uuid": "11fa4d30-05b8-4d85-86cc-c6e5936ed127", "comment": "Malware payload (Mirai)", "value": "32cfdba8f76dcf9f81111a4f1444b7b6cb6c80e00fc3bcb20dd0870e9ff06bee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208166, "uuid": "cd63d26d-8de1-4b9e-b1e1-f2484996eedf", "comment": "Malware payload (Mirai)", "value": "da0b9a8b3c5eed512d007265486b8b6895da7fbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208166, "uuid": "483864c4-04cb-416d-bd80-a06e54a8243b", "comment": "Malware payload (Mirai)", "value": "d3d8ed6086dedb9d8659383e746e71b8abde4443f667349fa948ce1f8688309246c88a5d328499d39ad21e98e1ecc25d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208166, "uuid": "2aa36290-ba12-4ac0-9b3f-29f4cbda1a48", "value": "T125D329CFD4914EB6C159BA79E9A62533071EA430171FDA8660FBE6B4430F4CEB00E6E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208166, "uuid": "d59e828e-ee34-402e-b5fd-75a77dcbefd9", "value": "3072:JGwg+1h4jr3wKZT6dNQK8U3xRTM/lQttfKLROGdHmDvBoZVSihhP5:P1h4jrTIH8U3U/lasRr0DvBoZVSihhP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791208166, "uuid": "049ee897-228c-4be3-8f4a-4d25750a8c29", "value": 139119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791208166, "uuid": "cc5f6f06-bd7e-498b-aa0f-ee9f6e9da3af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208166, "uuid": "a689ceb9-2b16-4798-8041-6f0766895a28", "value": "32cfdba8f76dcf9f81111a4f1444b7b6cb6c80e00fc3bcb20dd0870e9ff06bee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1e8860-c0e1-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791220846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220846, "uuid": "f9db90b8-424c-4f92-b63a-2d58d263ea11", "comment": "Malware payload (Mirai)", "value": "98fab6a4cdf85cd9d73033cb2abdce77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220846, "uuid": "0004895a-bc17-470c-a7e7-2589b8e41d85", "comment": "Malware payload (Mirai)", "value": "33ce1e339349564422cb0a9281637d25ee546c9908ded202d72fca399f5ff1b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220846, "uuid": "c4f8ca0e-4de5-408a-a1bf-b270a5f3a7a7", "comment": "Malware payload (Mirai)", "value": "3914cbe7d1e8b3d00d8af89cac736e1ad1b28504", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220846, "uuid": "a15be853-a396-4ab8-bc7b-a615e394fa8b", "comment": "Malware payload (Mirai)", "value": "4774964eef5fb5213ef7175750a37c973882b74c4253c4b52296ce8573e3cc1ca791b7c853edee4523f7bc274dd78cee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220846, "uuid": "c0210d1b-b9fe-4c37-ade5-36409a759612", "value": "T14AD30ACEF801DE7AF40A977AC4C30A177270AB750A12D52672CBF5679A371843826FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220846, "uuid": "ddbaa777-938e-4479-b2f4-4b5762b39970", "value": "3072:IIpbr4ZrRpAP6OsHYtmxeMvyIuHhx1DABoZWUohh25:1wPlHYox3yI6vDABoZWUohh25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220846, "uuid": "23ed6885-6844-448a-914a-b018a7ba5c59", "value": 139553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220846, "uuid": "0c696bf8-9c75-49d8-9547-60bc28c56f23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220846, "uuid": "8b1149d9-23d9-4f54-b2cc-fb9b8c0f7677", "value": "kernal", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90719901-c0cb-11f1-927a-4201ac107004", "comment": "Malware payload (SilentNet)", "timestamp": 1791211595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791211595, "uuid": "808eb87a-ad95-4c2e-ad0f-b61421d6b207", "comment": "Malware payload (SilentNet)", "value": "fad9cbe853b269468cea5986288ae3ae", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791211595, "uuid": "a28b1424-0c88-44e9-a82c-8fa911109313", "comment": "Malware payload (SilentNet)", "value": "342841fe8f50a45abac8c2dbd246d842f65705212b1936baadbbce9b3f0aaa24", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791211595, "uuid": "ca92b058-6d45-4cfe-bfca-39567e75ba81", "comment": "Malware payload (SilentNet)", "value": "52ae89f79113b8eba3e95cdbef816431ef546006", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791211595, "uuid": "429cdeca-ae43-409a-9581-cd42adea60b2", "comment": "Malware payload (SilentNet)", "value": "47f635d5f7d2bf31a67a83338f1f167d6587410f3a7bff640d2d8681cdddfe735a7b0bbd04a8e2df9123f6f048bb1335", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791211595, "uuid": "39038f62-1f0a-4c5d-8029-6d37ec5a874f", "value": "T1F5560221DA1E0039F833FB339042B9E178FBEF95520BF06A3A79154D4859A838F7E556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791211595, "uuid": "58666c06-7f5c-47b3-8a2b-be69daa654f8", "value": "98304:sKc5mNtJPM00THoXH8kqS2SKrs1Hw40qkdL0GEgGf3Uw18PpKl0:svgNHbondS2mHw5qkJ0lgM3Nehl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791211595, "uuid": "a22155a1-978d-472f-8eea-dafa1a8bbdd9", "value": 6044326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791211595, "uuid": "fb72abe3-e833-40d0-9490-c1988b8822fd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791211595, "uuid": "c8b3cda6-09f1-47e0-8971-a616d7bda741", "value": "CorzClient - 1.21.11 - fabric.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6046630-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181674, "uuid": "e86381af-6a8b-4425-9bda-a749c53763a8", "comment": "Malware payload (Mirai)", "value": "305e152600fd172825d0bdabe531090b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181674, "uuid": "5db4a886-cd22-4b12-9ad3-52dd0a52e802", "comment": "Malware payload (Mirai)", "value": "346cf59b814c3be242578cc09be47a07005c13734b8bfb1ba53bec707cdbf21c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181674, "uuid": "ad8aa60c-ea1c-4113-96ed-1b48f7763660", "comment": "Malware payload (Mirai)", "value": "99d2589f56955953c3a74976828c8a92294dbcd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181674, "uuid": "219054f6-a57a-465c-8d72-7eea3718f263", "comment": "Malware payload (Mirai)", "value": "f1a9c554b43ad542e977b3294a3b1e8f32581f80ef773a34a374ae0d91ebdcc5d4d968c386886901c4c437c2cd10dd9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181674, "uuid": "23777c4a-41b5-41e5-bc82-48158ed6fd34", "value": "T1165302DBB0BA8F6EC0B9D4B3244A25CB1451D41F375B1792BA80D47B97EEB0130FA645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181674, "uuid": "c4fa0483-e2f4-45ce-8688-c4ede51da0c6", "value": "1536:Wi/QY1nIzlyf7eeA0FFjFPhy0XXDWSVRziRRKkxF9nouy8p://HIzQ7FFAK/2RRK0outp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181674, "uuid": "5190ae24-b6bd-4550-947c-6a4daf81a779", "value": 61800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181674, "uuid": "02c26ec3-8d49-4d67-8427-4fc39a1dde0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181674, "uuid": "4c6f6215-8172-443a-8f69-8ef7fad8e00a", "value": "wife.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0673d04-c0db-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791218494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218494, "uuid": "37e19c31-9bb2-4efb-b95f-3c5409d4f9e4", "comment": "Malware payload", "value": "b9c1b1f909c56adf92fa6f3ade3834bf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218494, "uuid": "0ad03e40-3597-4a54-81fd-8edbb06e9268", "comment": "Malware payload", "value": "35afaa50f989d629aa5079bc4909d202806b0a35f570379d9fb3ae9f07039b55", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218494, "uuid": "94f8adbf-667a-49f1-9375-16458b8e483c", "comment": "Malware payload", "value": "9b51452d8cd985b1a02168ff4860f48601f40a33", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218494, "uuid": "47628aec-99df-4086-ad95-5a5e578d569d", "comment": "Malware payload", "value": "052e78ba0882600e38af63fffcb89839062f6bb0676f3f4ee92c160cc8964f6387f125972fff6683f29134c2b9cd360a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218494, "uuid": "f67595da-477f-4b13-b7f2-f17f367127ba", "value": "T1442174CF60A355766CE8ED67727A8404B190E58F50CE6F09ACDC38F984CEE04B460797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218494, "uuid": "0efdcbe7-ea80-4636-bd73-aaa7b1c5a7ad", "value": "24:Upm6pmiXpm6NI7CpmSKoprJhpnFJpSp8wpNTtjptJpGm+:UpbpPXpkCp51pbpnFJpSpvpN9p/pGm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218494, "uuid": "20b747ca-81c3-4926-8f8a-e0edc2f0c289", "value": 1431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218494, "uuid": "cee53984-e888-49a8-9293-1dc1ce94f840", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218494, "uuid": "88189f36-3e81-4c12-a98e-40f99ff57759", "value": "ipc.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646681b2-c06c-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791170719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170719, "uuid": "d5d3478d-75c4-401e-a1c0-d456c8424c7b", "comment": "Malware payload (Gafgyt)", "value": "22b905a10e07e3a984ed85393ea7f93f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170719, "uuid": "b8007fa3-839b-4223-9f54-a759cb8b740b", "comment": "Malware payload (Gafgyt)", "value": "35d2c3464b1b345e0bf5711b845abd988435bb2da9b452a0de44f99745f3d62c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170719, "uuid": "5490e713-4a9b-47d9-921b-be92e43c7599", "comment": "Malware payload (Gafgyt)", "value": "27ad19418ad9e538b0008c495f7011306e760a12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170719, "uuid": "b3b6de2a-d178-4af7-bdd9-41cf495dddc7", "comment": "Malware payload (Gafgyt)", "value": "86de8e2e7f0a6040f80c6a51cc185557f95cf2831e748e5e88dc4af712de0a2e7e42c5fc599024638123089cccb884ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170719, "uuid": "787f1c2c-0e0c-414e-b338-9669128a29ce", "value": "T155342A05FC504B6BC6D32BBBFB8E428D37336B5897DB73019A24AE702B8679D1D29111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170719, "uuid": "a97788c1-2933-4479-a3c0-3fa5faa49d24", "value": "6144:Ag+C/uRpq/Yq/QXyMXMq2Fg74swOTNBlK4qKjaMv9dZHlWZgs67ojz3VbO:LWCU74sP3I48Mv9dZHlWms67ojz3VbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791170719, "uuid": "35abce2e-d27c-4927-a1e3-0babb8b87079", "value": 244691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791170719, "uuid": "5ebe9c52-5d32-4d7b-8d4f-774b3ac69c12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170719, "uuid": "0962e371-acbf-4624-ad19-a50ddefd8575", "value": "35d2c3464b1b345e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7329349-c05e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791164926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164926, "uuid": "6f8c2368-72f1-465b-ba7c-2b00640415a6", "comment": "Malware payload (Mirai)", "value": "757fc26bd0a7a88ff8d6aabce0227cce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164926, "uuid": "49db89ba-155c-417f-ad17-4b7f4bfeb5d3", "comment": "Malware payload (Mirai)", "value": "361699bd9c276fdbef11bc135de69dc2b2dc423c7460f96b5f42cf7eae2c2e83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164926, "uuid": "2b8907e2-3eab-4b15-8a16-d333bca9cc3e", "comment": "Malware payload (Mirai)", "value": "eaa7dab0e04b46538dc1b9d02e9b0d36b6be5258", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164926, "uuid": "7bd0a7df-4df7-42c7-bc4b-78ac6cfe07ba", "comment": "Malware payload (Mirai)", "value": "c54f95b28db4814958217308f5f6121fe2e72b13cd169b8728005924fa844036f4d6c7069a10367e7109821fba26213b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164926, "uuid": "14696eca-4ec7-4bf5-b9ff-12f5d902393b", "value": "T13B633BD6E801AD3CFC4EE6BEC1554B09F931736899530A7B9162FCB32C321E45EA6E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164926, "uuid": "262a5d6f-9bc4-4175-bfe0-657e590da39b", "value": "1536:sfEU8x74k58y99F1bcRc3o8UiL5ERrX7WG:XckgR6fL8rrWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791164926, "uuid": "749af019-c296-4414-9c82-d46303940333", "value": 67588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791164926, "uuid": "6be4017e-bce3-48c8-bf9f-e796e29ac385", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164926, "uuid": "c96086aa-dd7b-4cee-a78d-e30f42ff791a", "value": "winki.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e4e3e3-c071-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791172811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791172811, "uuid": "8466f9be-badc-4e54-95e5-8f90452fba5f", "comment": "Malware payload", "value": "e4966fba1bf680fb14165db4c4348698", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791172811, "uuid": "73ddeb9d-50fe-463b-b553-ad7c8b136139", "comment": "Malware payload", "value": "36a048b70f0add874047b8b9e794182497fe7a0580e9a0a4eb3638cbf0111a21", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791172811, "uuid": "a0322281-ad7f-4755-9af4-ed6773e3113b", "comment": "Malware payload", "value": "679b197757b9727eb101e4e7eaee6510e216205f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791172811, "uuid": "faacc50e-cdbb-4240-854d-ce76691d04b5", "comment": "Malware payload", "value": "12b3674922f7074258573db2dea365d3265e3db174e1cbad21a108235cadde98808c80edc2eca1fcecde1663c2b48f8b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791172811, "uuid": "9ca32c58-a0bd-4714-a68a-18a2388a4050", "value": "T130C08CDF0024457CAC85E009BA4A04E2A080806A268A6D2888452C7FD85910EB05AAB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791172811, "uuid": "23392465-dffa-4d2b-823d-03742c4f1e87", "value": "3:TKH4vGBwVLJJ4kO2Qi6LkXpFZTLTeUWciTqPuBNbIg1EIAUzOdGEZWJAwjVZLKn:hDrKiLpzfWxqG7bIgSZwpOwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791172811, "uuid": "d2389f0a-3cd9-40f6-9a69-74695fd1c185", "value": 151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791172811, "uuid": "2ec7dfd9-f737-4703-93e4-751353c455b9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791172811, "uuid": "d494b37d-a4d7-431f-b7d2-0ab40124051b", "value": "eclipse.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d43ca2db-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185939, "uuid": "05241443-652b-4f44-8271-2f4da1c6c1f8", "comment": "Malware payload", "value": "23c9a2f78344aac09a5ef57c3a3da8ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185939, "uuid": "feeba691-b1c9-4a6c-8558-7b880daa3228", "comment": "Malware payload", "value": "36f893e3328ddf7720338924daab142ca56cff5aa3d518f7b2a5bd09a0fbe896", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185939, "uuid": "5060c0ea-38c0-4b0d-a204-b497544fa775", "comment": "Malware payload", "value": "2db14590bfb980640666e3b87e2c01f0ad34f4fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185939, "uuid": "4157d1e5-6602-4f76-a66e-a6f7762417b2", "comment": "Malware payload", "value": "878a9ec6805d9064658a6bb3cf02633302516190d7f84f7ff6d2cb26cdefbd7564733ffdc7a9fae94713daa6e52c837d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185939, "uuid": "b4f2bddc-1404-4197-be0d-e2cd5b2e5c60", "value": "T13C951860FD8B14F3E5031A3115ABA2AF23319E054F30EBD7E9447A6CEE776E51832259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185939, "uuid": "591efdc2-1216-48a5-9650-04fe37502310", "value": "24576:3tjzFcYr6EmhaB0wvhUlpWMSX5xwVT2uEBS2qL7EfO47RsYW7qS4:3tjbgX7O5Re6RsYMF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185939, "uuid": "ee4b3cb2-24a0-4168-aaa2-c7fd3ddf69ac", "value": 1986684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185939, "uuid": "244f870a-bc97-4d5b-8f3f-b8c5ae158996", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185939, "uuid": "37a9070a-f1c6-4f89-814f-0df1d3db55ac", "value": "mb.386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c3d102-c0db-11f1-927a-4201ac107004", "comment": "Malware payload (SalatStealer)", "timestamp": 1791218372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218372, "uuid": "f99792d8-ebb5-4d35-9967-bf000b80828c", "comment": "Malware payload (SalatStealer)", "value": "f221f1a45d3646cb8117fcc5f699c20b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218372, "uuid": "2e492678-5bba-49a4-a8ad-b757dba5ff23", "comment": "Malware payload (SalatStealer)", "value": "374c1bcedd9eb8d9e537dd47759685e5d9db21c0aa9b943592cd95aadbd18248", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218372, "uuid": "6bebc150-07d5-45d1-9526-658560cc0be6", "comment": "Malware payload (SalatStealer)", "value": "9c68b869355bf750c8e67d6d83c1d97d01961291", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218372, "uuid": "aaf300c8-1e5c-4f2c-a15c-b903c4cea3ea", "comment": "Malware payload (SalatStealer)", "value": "41ffc277166b095eb7a7ed356b1adc66d274a5ede11bd228410d9cd03c1849be0cd42dec6d18bc5ec402d7593405316e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218372, "uuid": "1283f1e9-6342-4e9a-9d9a-8ea264ff38c2", "value": "T12DF5330521D4DD4BCAB7E6B0C2BCD515E39D07909F396C528EFA97258A2BED71C82CB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218372, "uuid": "e22755c9-062c-4da2-b428-5eea29eea444", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218372, "uuid": "00059c09-481d-4800-b524-156b2c0c52d6", "value": "98304:D1Wo4QdFeHqKY59vz2dqKd+BFuvNxerXH7bU:D1WUFeHqP9ZKdMFrrXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218372, "uuid": "aa55168c-0457-485c-9135-2d18f536d35d", "value": 3586048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218372, "uuid": "518e9cea-c479-402d-b1fe-e6966b2cbb78", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218372, "uuid": "7ff257d6-4904-4968-9f7d-b256df803836", "value": "FTcheck.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7328e3-c0b4-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791201527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791201527, "uuid": "e746a662-ea44-4b6e-95f0-9059b7f88572", "comment": "Malware payload (Mirai)", "value": "6561e2acd2c6c1446250efabe9a4f5c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791201527, "uuid": "c63a284d-8107-490e-8384-6e546c70cfa9", "comment": "Malware payload (Mirai)", "value": "37acbeb44033456803564707bcdc4ca78ff7d357577afea4dc6fb88a10c9682e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791201527, "uuid": "60fb372b-1201-459b-bdb0-37d6dae881d0", "comment": "Malware payload (Mirai)", "value": "37918ee93e9604917a98efcf780dfbb860dec8e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791201527, "uuid": "2ef47901-2033-48c6-aeab-c2b57281660b", "comment": "Malware payload (Mirai)", "value": "297b199da94e056095587317bcbf600c76914666ef479d67a4e9f506f6e1f2206cfa50eb0f2b5ad9c7f8994f55b92917", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791201527, "uuid": "2ad9d78e-e20a-42a9-9564-940946cf8a84", "value": "T1F3344C47A9D08EB7C545AB7164B7AA30071BE8161F4B0F9BA539E6F4424F9CEF009738", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791201527, "uuid": "e235fe4a-53f3-45ee-8bce-03e386816398", "value": "6144:KCqMcT3i5UDg37epl69I7bYvj4wYLqz0txmyGklpO:KCIAUDAevaMYvj4wYLqz0txmyGklpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791201527, "uuid": "40c4f8c5-7872-427f-93aa-c99b1ac5a173", "value": 238535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791201527, "uuid": "49bc184d-b9cf-48db-868c-074f389b6b11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791201527, "uuid": "d5f20d73-178c-4ce3-96af-16cd7d46bfae", "value": "disssh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb483311-c0df-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791220284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220284, "uuid": "cfb534b9-5bfd-4b94-9b48-74c82f042245", "comment": "Malware payload", "value": "6fb510770a7c5c59f1ee15282894a263", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220284, "uuid": "f65f064a-f7c7-4a67-bd17-51f0ec44bb90", "comment": "Malware payload", "value": "37c86bea8327e4fe041bb67f915fbdc9656d244656f1b954adac67649ab5de7a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220284, "uuid": "57b7a6a6-99a5-4445-8307-31867199644f", "comment": "Malware payload", "value": "bf7e1c867a375cb6539847a385d55ca178c5242d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220284, "uuid": "9a202a7f-df7e-411a-8cf0-f1a8327a4b20", "comment": "Malware payload", "value": "2fd16e79ae88abe2f61541ac3637c5d751302cdc5c36a7660dc136ad8829a726420b5e9d4d84b553d6e564df136b4b1e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220284, "uuid": "1509339d-5cb0-4cc1-bcfd-8fbd1e5fca6f", "value": "T140561997B9D24942C4E43A37B9BE80C433635EB99BC612665D05FE383EBE1D90E35318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220284, "uuid": "987fed1b-f584-44d6-9ffc-ec8c8411e519", "value": "49152:Go0tR7ZcPlBH3QgeHKSvwRwBuTmI8+xCgHp6/kC+7U5EB:GowulBXQg6hD/JEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220284, "uuid": "a005910f-d3ab-4b54-a407-5e01ecf36682", "value": 5963960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220284, "uuid": "667cf799-ab3b-4c86-bce9-3c8764298e2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220284, "uuid": "4b1ae3f7-ee70-4a8c-9992-9dde2b885754", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efbd22d7-c0a5-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791195434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791195434, "uuid": "6d4aaffb-69f3-4982-9fb9-7e9527003606", "comment": "Malware payload (Mirai)", "value": "314921c674259b4f7420eadcd9ab50a2", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791195434, "uuid": "dfba1c10-5811-49ed-bde3-ef61cbc7edda", "comment": "Malware payload (Mirai)", "value": "381f6d187a7c0765ad92a32139c2e7bf23a8b07d17fc92a31a6643472b5648be", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791195434, "uuid": "231ca018-5566-41d2-9c55-a285808b7877", "comment": "Malware payload (Mirai)", "value": "ea56c620e8bdc5b06ba422e7fdaf073c727f5954", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791195434, "uuid": "c906586c-7f91-493a-9bb8-806e85f04f71", "comment": "Malware payload (Mirai)", "value": "5674a1422dbff1b06c58fad6afa3adfd65176fcf8236ebba5095dfd4df4aeee8c0489e6246b24fdf5dd90a0002defb9a", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791195434, "uuid": "fbcbb85f-5e4f-47f1-8b5c-6f203bbfc04f", "value": "T12693299ABC919A5945D413BBBE7E818E330723B4D2DF7103DD041F18B6CA94F0E7AA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791195434, "uuid": "e8398f68-f9d5-41a7-bccd-e8979ea279dd", "value": "1536:CMn12A//SrRftY97WARbIcbboW+zLsYtJ913DhrPDysX+4if3LEVwjUt87HwJXUl:T2s/ITo7WCkybotgsJ913DhrbW4UYSxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791195434, "uuid": "957f5afc-afb6-429b-bd70-755b208222d9", "value": 97392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791195434, "uuid": "7c9ce92b-4762-4dfa-945f-36211b78ba5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791195434, "uuid": "30cca150-bbf8-4306-90a0-06464cb490fc", "value": "381f6d187a7c0765ad92a32139c2e7bf23a8b07d17fc92a31a6643472b5648be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83cc9768-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (ConnectWise)", "timestamp": 1791190529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190529, "uuid": "9345aec0-663a-4e64-9029-2db1e5f56020", "comment": "Malware payload (ConnectWise)", "value": "20989c78b1e51478ebea87d03005095e", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190529, "uuid": "3d849cec-5be9-4ac8-bb48-333a876a7dea", "comment": "Malware payload (ConnectWise)", "value": "385b70c5cddf2e9fe4a4951dab0dc8dc0eee6271a2699a0051d385b476cb249b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190529, "uuid": "2e23428f-f825-4f74-8dc4-92606e82cbfa", "comment": "Malware payload (ConnectWise)", "value": "c92273a160f9bf7c2f565ac57ba8d63e4def834b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190529, "uuid": "4d64adaa-d445-4e2c-bc95-76852da8d648", "comment": "Malware payload (ConnectWise)", "value": "bde98c81661b286756d1fedfcbafc2a257809188d976693b782276f8fa25046105838196a29af1d4ad1e28f53abb26bf", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190529, "uuid": "c1f72b91-f1d3-4ad3-9189-ead1cf7a329e", "value": "T18171ED2117F50308F3B76B39ACB7B5215833B925FE32CF8D4090414E1962624D47AF2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190529, "uuid": "90a4ecea-69e2-4ad8-bbea-bc5e52f3a3d1", "value": "48:89pr1Ze28Yc0C8wVdsyAYiHYEC+m1cd00E2/XuH96BPozq4:89pr1dQ8w34YiHpC+iafudIPozq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190529, "uuid": "68a50bff-1808-469b-95fe-41705346ce20", "value": 3592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190529, "uuid": "9fcd835f-b3da-4822-bc7f-329c7a15b088", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190529, "uuid": "ee7e64c4-78aa-4603-bc87-b6cc2583d5df", "value": "RFQ order list.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "121eb869-c0ee-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791226416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791226416, "uuid": "a1a78263-df1a-493a-af82-0d48f1d87a49", "comment": "Malware payload (Mirai)", "value": "c5a9bb66b445cbda337b329b69ea59d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791226416, "uuid": "3d75ac50-67b4-443f-a931-c4e8b03d5284", "comment": "Malware payload (Mirai)", "value": "38d1a81202fb9d1ca5ece1ea1539f2d46b755cc1c9515c51c76783fc6d799b03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791226416, "uuid": "fec7e2d8-4a94-4a08-a212-cb03687d07c7", "comment": "Malware payload (Mirai)", "value": "59109def446f97772d7ca7047ca140c70154859d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791226416, "uuid": "9f93a9db-7253-4a74-964c-10233a7465f1", "comment": "Malware payload (Mirai)", "value": "b583cbe72c947fceeb6d28cb7f95d24ef43aab74ed09ab22b6b924e8d1d5aa4f46e0992a70d5412728e8ebfbf749fb6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791226416, "uuid": "374c05cd-3304-4663-899a-6b43b4e27c38", "value": "T1EE2419CCDA504B5BC1E227BAE68A02CF33324B78A397F215497BDAB437C27595D31192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791226416, "uuid": "d7ead5c2-8ece-4455-beef-f9c55d4be501", "value": "6144:v1XB88ax+yLZVhGCqY8mEgM/9xjWmMXCwgUXzF2:v1XB88ax+yLZV1JUZ//jWmMXCXUXzF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791226416, "uuid": "35dbe3d3-5347-4eff-85ac-0de643ced53a", "value": 211596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791226416, "uuid": "72ccca34-837e-45fa-b9ec-4e3daddd32ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791226416, "uuid": "c6f2e0ad-d7b6-45b7-84af-244a39acf912", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d85c6280-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791190671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190671, "uuid": "b477fa98-8d6f-457c-9e88-5254cefc69eb", "comment": "Malware payload (RemcosRAT)", "value": "d8d637de0a8a5dc3850216cd2d328ce4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190671, "uuid": "4925aaf5-b842-447f-b263-02b964eeefed", "comment": "Malware payload (RemcosRAT)", "value": "39fd829a11ae7a611ee88b37e5b61cf19e07e6bff7d66b8665426f59d7f047f7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190671, "uuid": "78e9c6f4-e089-48c9-a273-7869a8dc5bb6", "comment": "Malware payload (RemcosRAT)", "value": "1093b0a1bd47beb493be5efa3d618fa56745908b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190671, "uuid": "185a9094-d983-4a48-8f43-93d2bfad5bc4", "comment": "Malware payload (RemcosRAT)", "value": "a784cc91ee41e793603f808715f8043ab6fad5e051677f1dc3377819bf16a6ee74d2833eb612c1f04309a1e887eac1af", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190671, "uuid": "6c9a16be-5ca8-45a7-a080-e539665bbcba", "value": "T119832820E9A695760F87AA58BCED0770C5B88B0C912705B0F7DAC70CD10A9DCE77DA76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190671, "uuid": "2e510041-93ee-43bb-9e62-7eac6c997c1d", "value": "1536:XHexLA2DTWX0mOfBjjLwYxLr0HGLKr7eCAX6nbhim3h0buQ89i:uxLA2DyX0lpjjLwaP0mGXeCAX6NimR6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190671, "uuid": "fafe62be-4f2f-4a6c-bba7-65d3bfde4097", "value": 86649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190671, "uuid": "7834e2b5-2277-418e-8bb7-3481a3e415c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190671, "uuid": "11f0529f-8625-43bd-9fff-6cdafac26572", "value": "PO1145_RFID SAUDI.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45031c9b-c083-11f1-927a-4201ac107004", "comment": "Malware payload (RemusStealer)", "timestamp": 1791180545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791180545, "uuid": "1ab7c73b-636f-413e-b472-d12c5ae9687f", "comment": "Malware payload (RemusStealer)", "value": "5abc7e8f3ef276096a8601598e360973", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791180545, "uuid": "fd35ec15-bed3-4f76-ac1b-87958775fec0", "comment": "Malware payload (RemusStealer)", "value": "3a5ddc82c5ad3647fee3b4a11bc67d05ccd8a28777abd8ee708920393c55e44a", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791180545, "uuid": "c510882f-6cc7-4820-8f54-febf8b6a047c", "comment": "Malware payload (RemusStealer)", "value": "324e86d06be714765126ae5188dd5288057746b9", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791180545, "uuid": "f3a44c9a-7efb-42ab-b006-53bb329e2dab", "comment": "Malware payload (RemusStealer)", "value": "9a6b6c1f9364568b96cefd06cb14300732fe32375fe29c5303ad4175c34ee557717e1a2c5e1a8d1ff81ab2ac1b5f424f", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791180545, "uuid": "dc099658-cbef-4fa7-8e1a-4a8feb90c111", "value": "T116C65003B74802C8C467EE7085A15A71A1B03C9D86357B6BDDA57E581F2A784BFEEF01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791180545, "uuid": "76715db5-6aeb-419e-b508-b87ee298c8b8", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791180545, "uuid": "70128c18-2f64-46ea-8d5c-192f7b5f3ac0", "value": "49152:513Nzzlosai1r1nviwdrOT5np+sSiuL1vaCs4I+HeDjSchvPt+MFDtYQ5zZUgvCE:5566jp42WLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791180545, "uuid": "fd58de7a-05e6-4b13-8584-062d72d65094", "value": 12028416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791180545, "uuid": "d2ce1bf3-fcad-49b5-9699-dd362acce84d", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791180545, "uuid": "a18ae0de-770a-4dad-97fa-92e22492f304", "value": "7c1cc22a11e0d0a49ce86d1e5a2943922555860450d7ad6559ca7bc7c4eec99c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76ae5f0-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (PhantomStealer)", "timestamp": 1791190723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190723, "uuid": "8246f5af-0c22-44ef-8ba0-d73398938501", "comment": "Malware payload (PhantomStealer)", "value": "4f03bc40c699a72226bb507a3ead1cea", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190723, "uuid": "d3786aa4-2dd1-4fbe-8afe-d3581a384cf8", "comment": "Malware payload (PhantomStealer)", "value": "3ba631eb3059a6af65b913151f530e481c35e14b8ff68cc56a35523051628499", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190723, "uuid": "1961492a-b05a-4c34-8ce0-522ffbc3612b", "comment": "Malware payload (PhantomStealer)", "value": "87d978381037e115894620ad07b540369ef103e2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190723, "uuid": "ae539c62-7352-4f25-a6c3-ed123320e823", "comment": "Malware payload (PhantomStealer)", "value": "5256d1d33119ec34ce230a30d116d0a291960cd3524021fbb41a4f14a65ca6eefc6f9d65bb4f80ac82b6f26a8c715afa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190723, "uuid": "d21e6c65-8c8b-45c6-9476-6344a19dfeae", "value": "T1CB263A111E1B8A70B53E6B2CD176A5500A4CE00722B9EF3D31B9274777AD71B678F8E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190723, "uuid": "b78b7b86-a886-4643-b07d-1d66ce958c55", "value": "98304:BClNgR51Y33ThVgd4vY3xiSiCEvytaGeZvCLMhEWlR93yddfaObHQdBRGVICqwHQ:njy0d0Y3U9vyt3kvCLMhEWlDCfjbHWBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190723, "uuid": "46002d55-5a99-48d5-9099-31a012c65bc1", "value": 4508858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190723, "uuid": "01e0abc8-c4b5-4b66-b86a-f5c5285c81fe", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190723, "uuid": "1ab07fb0-0d27-41cb-8f69-4f31d0340400", "value": "1X40 4TH SHIPMENT.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403b3201-c071-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791172806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791172806, "uuid": "b8077b78-ae57-4639-9026-a00eb1136878", "comment": "Malware payload (Mirai)", "value": "9e727f9d15f9db77d80a7bb0d902225e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791172806, "uuid": "67f7c7e4-80c9-41fc-91a7-d48a201f2bd9", "comment": "Malware payload (Mirai)", "value": "3baf1b9349f0b271860e300c2e61f34a3ea0ceed25e518b08db9274a730eabc9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791172806, "uuid": "e88a9386-1a10-473b-95f2-236cbd385da7", "comment": "Malware payload (Mirai)", "value": "5856d9f25547e1b6340caa89feef8dcee4c48e1d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791172806, "uuid": "12589fff-4f65-4f3f-9408-500777b5fac4", "comment": "Malware payload (Mirai)", "value": "e3614c833c6b0b2b5b02b52d427c89bc9dd28f602d54964e8b6dadc0915d36ab7f10513f242dc955e85b56e33e64685c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791172806, "uuid": "4e6ddcc5-fa3c-4e3b-b638-c693db45820c", "value": "T160356C5AF2F370BCD067C030439BDB62A835F47901226E7B65C4DA352D66EA01B29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791172806, "uuid": "f6766273-f131-4c37-bbc8-3007f1656d05", "value": "12288:8F/4HH4fUGYmeOzuWVYjgQooRs/mBD/HNDFmyObD+pndCuMu/5k:8F/qH4fU4jzuWVYjVoWsOF/Fy+BdSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791172806, "uuid": "218bbc92-4cc9-4293-a924-175a151ab539", "value": 1161288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791172806, "uuid": "2e041481-b678-4d88-9280-46bd35243850", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791172806, "uuid": "bfe9964f-570c-4d9e-a2ff-71a914ef1ced", "value": "eclipse.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f023c24-c06c-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791170683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170683, "uuid": "bc454dce-970b-4faf-b673-9d96011fb9e6", "comment": "Malware payload (Mirai)", "value": "6c9accd6d19254c49bb564e43b43bf6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170683, "uuid": "d781adf2-15ef-4752-8e1e-10ed3a1abcc0", "comment": "Malware payload (Mirai)", "value": "3c29f43472e65ea111cf6fa376ba1bd7e3d4bf3e1d2f05d44456d08b16ea1934", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170683, "uuid": "0d8f9597-f450-44f8-8ecc-e6d638e624d6", "comment": "Malware payload (Mirai)", "value": "0220e8a6fc38e4f2a0e43eadb3b9c096be4ed2f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170683, "uuid": "972cc855-dfb4-408c-8879-f8136e012326", "comment": "Malware payload (Mirai)", "value": "512081516746226b19ad6b7f6335f04d70fb1ecefec2d500c8972e51206df07ef09fb36603851ce1b301fe8ff73b7e50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170683, "uuid": "117288b1-df15-4642-a3a3-1541e9df987f", "value": "T177442B08EE408B5BC5E237B9FB8F424A33339B58A7E7730596285BB437C7B595E25102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170683, "uuid": "7bc84954-b1f2-4461-b89c-7a209623ffb8", "value": "6144:xj3lLC2pMdIw6rEa+OiFqq/EpSJHc7Og1liIgEV/Gf7md28gvIgS:xd+Sw6rEa+rqq/+yc7Og1N/g7mdFgvIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791170683, "uuid": "9e3e0243-318b-4d86-935a-535f8b215188", "value": 270791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791170683, "uuid": "02ce91a7-1bfb-49ce-a9f6-1d14cd12d962", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170683, "uuid": "c9ece6a7-4fb6-410e-823a-e157b7073fc1", "value": "3c29f43472e65ea1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83cf50e7-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218876, "uuid": "1f3a9c51-76db-41e7-a4a0-608530f0939e", "comment": "Malware payload (Mirai)", "value": "1c2f1bd4f198e637373fa6ab863bffc6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218876, "uuid": "55941f94-e9c6-4424-819c-8f6c0ef8bfdd", "comment": "Malware payload (Mirai)", "value": "3d817d970f498f9b47a529674745ba70bf179d3ab5838b07c6cd4dbc62b447d1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218876, "uuid": "411c9c66-6bf6-4aad-ad84-00c805b59fae", "comment": "Malware payload (Mirai)", "value": "7f8d566bfa4689d1ab4f40f33023011ebc860666", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218876, "uuid": "0189a34b-4281-43c5-b7ba-e92de11db9ee", "comment": "Malware payload (Mirai)", "value": "24e473af1eb35bc27c65474f1a8f4c7474787901efd6a6313280853f39937a81f14d6fabec87dc5a4c30e9079fa5a4a3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218876, "uuid": "f9b913f9-061d-4519-9a15-3664fa45d5eb", "value": "T14024BD73F24B1491CC6516F823CB6BBD692311039D6BC5D36C9B3B346EB60CE19227A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218876, "uuid": "676b128f-26c8-45b9-ae5e-90c6fd23bdba", "value": "6144:krt+AuAxn64WOkSpFkByPyyPWEJCPcPeFTq:kPx6ekS3/3OEQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218876, "uuid": "acb61af0-6906-4721-8b9d-654efbb010aa", "value": 214560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218876, "uuid": "19281529-3ca4-4bf2-98b0-4a00da053572", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218876, "uuid": "ea563361-52c6-44c7-ba6f-2b2b9897cf72", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94444d0-c08f-11f1-927a-4201ac107004", "comment": "Malware payload (LiquorBot)", "timestamp": 1791185894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185894, "uuid": "22530cf5-3d4e-41d4-90a8-2770e3a4edd1", "comment": "Malware payload (LiquorBot)", "value": "226ae5239a0188dc0ed400377f879930", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LiquorBot", "colour": "#1604D0", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185894, "uuid": "98b8708b-6e5a-45f9-9306-dabd6be735e5", "comment": "Malware payload (LiquorBot)", "value": "3e9f981ae600aca11f1c0e945528a3db3384e5557ac0a02a3dce7219b473623a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LiquorBot", "colour": "#1604D0", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185894, "uuid": "9b95fdf4-be4d-4bab-a653-0dc8557ae9ad", "comment": "Malware payload (LiquorBot)", "value": "a6d06bd272ebf83209ae4422c9d03ac2e66e2153", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LiquorBot", "colour": "#1604D0", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185894, "uuid": "9f8c0e84-4482-44e6-9a13-7765f7659b02", "comment": "Malware payload (LiquorBot)", "value": "77c485e703a160936a9cc884485b4503f4d9c70831543840c2b1d407d85ecb3fb9791dd6aef5b27a75fcce4b981e36a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LiquorBot", "colour": "#1604D0", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185894, "uuid": "8ed3c14c-a0ce-4c04-bcba-9927ea272e6b", "value": "T1E1D42308E3C2DD9DFF4578B996A18AA677C22B7A4E7E985F44403BD461183AF3714CE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185894, "uuid": "2a40fea5-c782-4ac7-99bd-1acb1585e4de", "value": "12288:S4qbClJhb3LrWMC6jDwey2NISduwICXo2TAzPyAh9YdQI:BpbiM3jDwoNFAwnXo0MPyA0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185894, "uuid": "4021e4f4-d0ce-4b6f-9875-18f94a3975a4", "value": 635952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185894, "uuid": "0cc8cd14-0a6d-495a-89ac-7b23de1466cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185894, "uuid": "21adda85-c81d-4368-999e-49e6b66cdb1c", "value": "mb.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "079405c6-c0dd-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791219097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219097, "uuid": "a31dea1c-96df-441e-bc22-ca2f8e0a73a2", "comment": "Malware payload", "value": "ee009758219f6b7cdbfe4a346924cda4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219097, "uuid": "b09f55cd-d225-4985-9a1d-b5e51b3e0668", "comment": "Malware payload", "value": "403eb747d66afce6c38cb4364dadd3bf7149645e41f1c73892c99a475c9f2dd9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219097, "uuid": "d2bc81bd-88e4-4cee-93ba-e1140c61525a", "comment": "Malware payload", "value": "31ec753275e8e3ede76ae503fff472b6c1e6633b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219097, "uuid": "b806fb4b-6769-465d-96a9-5aa4c92f8062", "comment": "Malware payload", "value": "4c69d58c67473385c4b2868ed68fe074175ce51b39d2b4ba029288499df01da2a1a1de4e3da813edceeec20bae400b37", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219097, "uuid": "c919bcad-aa51-4d7d-b5f7-4f1645f7078f", "value": "T168A68C03EC9519EAC1AEA271C9A796537B31BC450B3263D71B50B2347EB3BD0ADB9314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219097, "uuid": "88a3a49e-13a3-435b-8606-ae953f40ca07", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219097, "uuid": "87b15b79-4b46-4638-b421-45370c620aed", "value": "98304:kTFBrs/Q9HO0S02SPU/dEEXOgZGRG8GPTqmsCc9t166dXdtaJ8Rli:E582OtLXXOfoLq7Cc9/6AtaqRli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791219097, "uuid": "112f5065-1889-475e-a3db-db2dc9d69400", "value": 9986048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791219097, "uuid": "7bfb8fe8-a385-42e8-9150-14209264df15", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219097, "uuid": "b857bc49-de15-464d-babf-09844ef509d3", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c322b46e-c08f-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791185911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185911, "uuid": "f284784a-e4da-4ed6-a572-e09e5543c7ac", "comment": "Malware payload (Mirai)", "value": "d780cece11f5c134b8eb99c410cf67ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185911, "uuid": "93c5a9d9-b46d-45e3-8926-55d865362075", "comment": "Malware payload (Mirai)", "value": "405e75cf8c202d00833b9836ec9a0f1f6d358f69a297adccf2074dbf684d9ee2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185911, "uuid": "89279206-99f2-49d8-afcc-12cb404c9ee8", "comment": "Malware payload (Mirai)", "value": "a9e14fec465995078249a09ac0de2c8dc5198c73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185911, "uuid": "31ca48a2-dccd-438d-8a04-ee80c924b070", "comment": "Malware payload (Mirai)", "value": "b3d7ac9fcbe58e95a71fec0861199beaffcbdb5301c5c8c762265d5eb95222e7026e980633d1a2dbfdc75982f55a457e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185911, "uuid": "3322baea-1453-4579-bb9f-1616674d59e7", "value": "T1C9542B08FE408F5BC1E137B9FA9F424A33339B58A7E7B30699285BB437C6B595E25101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185911, "uuid": "ba4a9042-a583-4700-ac00-731ffd93459d", "value": "6144:Q3D7EmO5Ut+NH4GsaFqgqCxjMe9SZRj7rc2Z9HP3cV/GPcmX28gjIgS:XKt6H4GsaFq+xjM4Mj7rc20/ucmXFgje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185911, "uuid": "572b33b4-6e5a-409f-8135-ba07d15a04e7", "value": 281313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185911, "uuid": "a6b380f7-5710-4ea8-92bb-c6ff5714cf11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185911, "uuid": "90344364-4a3b-4cb1-ad7f-8a61c293c917", "value": "dissarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "145dcfe6-c0e8-11f1-927a-4201ac107004", "comment": "Malware payload (RemusStealer)", "timestamp": 1791223843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223843, "uuid": "e511d1c7-c4d8-46fb-92a4-a8fb739167d9", "comment": "Malware payload (RemusStealer)", "value": "259b49948f479a1ecb3448ef7e6bda75", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223843, "uuid": "448050f3-f055-422b-b48d-34dbea27636e", "comment": "Malware payload (RemusStealer)", "value": "406627d034ccf27232851600b6d2f4f93e93fce673b6c3b801e2f1140dc76736", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223843, "uuid": "ac041713-11b8-40ef-80c9-7854b92ddc85", "comment": "Malware payload (RemusStealer)", "value": "a0923b596bcfac3adb3c7e6631b43188f8931c52", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223843, "uuid": "68ba8226-70e8-403f-aa0c-6ae4fd128e0e", "comment": "Malware payload (RemusStealer)", "value": "3626d07987462ed573b599e8b92b991509e6f5c11f5b57fd1c149c2d4fc015a42b4043b13504fe18c4d411711ed92794", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223843, "uuid": "af393567-5da6-4df8-8a47-0662d1353bf6", "value": "T1C5F33A4B73A931FDE177927C84961A45F37278310B61AAEF0360467A1F272D48E3BB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223843, "uuid": "4de3fe27-8dae-4ff3-b8c3-4b8c25576f73", "value": "672bff0d668d8425dce5b5bf2bf7b41e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223843, "uuid": "d9f66438-0765-4460-938e-4958a394ff48", "value": "3072:MGIL01thaxLrnwj/inxUBQeQMHyqyC1oG+DUwt:j/DwqGxTMHpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791223843, "uuid": "2c77ed37-6bb7-4f06-9541-d1158955bf20", "value": 158208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791223843, "uuid": "541ba944-5431-40c9-887f-4e29d5703dce", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223843, "uuid": "95eb7bc9-a31e-4c57-bf48-80b1aaf7727b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dea975a-c08f-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791185848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185848, "uuid": "3afb2b9b-ff29-44bf-8ffb-bd7a4b994ccb", "comment": "Malware payload (Gafgyt)", "value": "47cfe015866baeb0e7f1bb9a5b6b0672", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185848, "uuid": "04432737-31fd-407a-a14e-16caef9b17f1", "comment": "Malware payload (Gafgyt)", "value": "40cc252e04ce69c299546fc01002283691c3b079e6b8164eb62c653c689dab6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185848, "uuid": "37cdcc75-7d5c-4d70-9701-c73b866f3bc6", "comment": "Malware payload (Gafgyt)", "value": "faab6b8ba10cd28115a499ec8e5b07ba83721772", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185848, "uuid": "85f83c9c-c3bb-4d2d-810f-9c1d6d7e6b00", "comment": "Malware payload (Gafgyt)", "value": "4510f9b267bbb4645fabefbbf3a70c4731bb322de851a4911af7932f1f9a2a768b5729cfad2b2b3012aa2e5be95ef114", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185848, "uuid": "7e8b1a5e-c074-4dd7-808b-281ecad97e77", "value": "T179C26CC2FBC3A0F2E483457100A7E79FAB34CE2A1094CBA6E7097A15FDB2713115DA59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185848, "uuid": "301c92d9-a3ba-406c-9f20-1f7e0cc1ddbc", "value": "384:10Nh/j7TzbkXH8X3+MZwxlx+lef8a4gIhO3NNKOXcQuT6rUZzEru:10NhL7THkSwxlx+AEaYOXKlDzEru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185848, "uuid": "ae810db0-34a3-4677-bbe1-e2edc7e748fa", "value": 25748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185848, "uuid": "a15419d0-4d20-456d-a1db-9954802dfabf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185848, "uuid": "6d5b996b-0ebc-412e-a050-1b160fdf772d", "value": "dldr.386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c12fa64b-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791182042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182042, "uuid": "be1badb6-9c29-495b-8537-1f63a20d5dc4", "comment": "Malware payload (Mirai)", "value": "fcf8f480009f2268e318ad948decf204", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182042, "uuid": "f63c69fa-a57b-4e04-99d9-3aae06cd886a", "comment": "Malware payload (Mirai)", "value": "41795666a9ffe055ea78fad0dd09a944223a80e681f9bdbaac4c6e6449742de0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182042, "uuid": "729e882b-675c-4c4f-a988-54590f67dd03", "comment": "Malware payload (Mirai)", "value": "9d0460a71600e7cffe0c2e0fc643f48ac8092aad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182042, "uuid": "8fc48f72-5c64-4d36-b096-68350f12ce8d", "comment": "Malware payload (Mirai)", "value": "7a02bc67d1cf87171167c237539663cc7fde430d86e6128429a69712ff106b2751755b5433a67635a8d5b5bed2ad8eb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182042, "uuid": "a7b569f2-ffd9-4961-9ee1-1692a1ed9aa5", "value": "T1CB63C546BF610EF7D89BEC3745E92B0529EC560B21B97B75BA30D818F64B20F19D3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182042, "uuid": "aeca4d9f-5e11-448a-a34f-4dd4400c8122", "value": "768:YU6bhcgHSIJWB9cHlfD2wLX3YEwja6PN1oAg5oRKxeU3hVpxedxAxePx28szI2Zu:YU6bh1HFV2wEVjZPzgj1GCK2dFsTcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791182042, "uuid": "c396b3e3-385d-48fc-829b-05e19ee0a6fa", "value": 71764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791182042, "uuid": "5b67213f-f259-48e2-bd00-3c486c3392d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182042, "uuid": "fd1fd27e-f097-49b1-83fb-c6c64994ae7c", "value": "87sbhas6as.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f06c9a-c0e2-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791221376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221376, "uuid": "c898da1f-8220-416a-9e8c-2eabac72b115", "comment": "Malware payload (Mirai)", "value": "2d9ab1aec37841454f2682d294324401", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221376, "uuid": "8d5a9925-cc42-49d8-bd43-cc14706259d1", "comment": "Malware payload (Mirai)", "value": "417a7fe18a7fb408806ae438cac774d2cbced54ab2e0fac6952dc9117e6f4e9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221376, "uuid": "dd9a88b4-7d87-4a83-bcef-4b5c520aa005", "comment": "Malware payload (Mirai)", "value": "cd0fedde58d65bc67cf6ddf5d87943b9b318d5d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221376, "uuid": "62e42b73-0cbe-4cfa-80ef-672e9a41a04f", "comment": "Malware payload (Mirai)", "value": "c82b321974b1cde7db9d027f63920d006a04acc087485a7e9a8637f9ea5ed922fb93aac63997fe3069b761049d87afc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221376, "uuid": "5e14ea54-9d37-4694-a9cd-61a3fd56e95b", "value": "T15FC31ACDE642C1F7D8431AB1E257A66B46207A39491ECE05F3DBFCB89B228C871157D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221376, "uuid": "1f625c97-e538-45ad-84d3-8d1af0527c13", "value": "3072:AbjFwdsCZ5q5DnK5ZoEPyrm5w2G5FP1kDnyo5XE8hGEn:cOdsCOBnvAC2GDPiDnyo5XE8hGEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791221376, "uuid": "922017f6-be55-4708-9ec8-3f7a453075af", "value": 119087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791221376, "uuid": "3a2e7bcd-2789-4114-a31e-243f54482282", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221376, "uuid": "838f4c78-36f4-4808-8cfa-37f4fa850599", "value": "getty", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34bc822f-c0fc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791232487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232487, "uuid": "32254e5b-1627-404d-af02-0200d915b2db", "comment": "Malware payload (Mirai)", "value": "05cd99a6ab95de3c4567ea0d6af8c13f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232487, "uuid": "ac6ea6af-dcc9-4d5f-bac7-e23a10653b3b", "comment": "Malware payload (Mirai)", "value": "423548c515990f7e115dbc6c2b98664f58076745c16f4d3c6c23ae7c5876549f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232487, "uuid": "7a4cbb72-815c-49a6-bc80-bb2cabf0529a", "comment": "Malware payload (Mirai)", "value": "27eaeeef8b82e4ecba5b905cd2e7bc59a187d986", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232487, "uuid": "d6185e3e-998d-4f3e-861b-fe8a57531778", "comment": "Malware payload (Mirai)", "value": "a0def2190a4a9ab05dbc72526c23e976ac03c32ae37ab05417d71b3eaf0311118a9c36ed7f0299259f2683444f8999ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232487, "uuid": "9fa5a5fa-27ff-4837-9232-f00db3c2c085", "value": "T128630891B881A626C2D1177BFA6F008E372457D8E2DB33139D255FA0778A81F0D57F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232487, "uuid": "65d8832e-cb9e-4f24-9eeb-fd3eac19278d", "value": "1536:eOTgWIYeMlktkUwnEU0+m7FcWS2RM8fhWtu5zPeH:eOTgWLeMDcJS2Rrpeu5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791232487, "uuid": "2a2915cc-c836-42a7-abb6-fea54c622f28", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791232487, "uuid": "283a08f8-c146-41c3-a917-4fff380b2f88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232487, "uuid": "797d52e3-eaee-4f8c-b886-8c6a5fba0caa", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37754cd-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791190663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190663, "uuid": "48d06dbb-afb6-4c1a-b41a-c7d4ff5630eb", "comment": "Malware payload (Formbook)", "value": "53e525ca2bc88bc4fdbab21a4e600411", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190663, "uuid": "a76f555d-0ad2-4c2e-b67f-ba3cfc934588", "comment": "Malware payload (Formbook)", "value": "42716619bb34bad714092ba694190c82fc18d39553d033ff5b2ba6e0f370bf64", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190663, "uuid": "f4e11848-4d70-4328-abb3-be0c49abb5bd", "comment": "Malware payload (Formbook)", "value": "67796f0fc9c0591eb71c56106274aaa6391bb636", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190663, "uuid": "66feee2a-f137-4e8f-8171-803a2b9312a1", "comment": "Malware payload (Formbook)", "value": "ca4b8bc93b213629411a6093d7bcd17ec03636f9465ff126082176502b5c3c02c21da0958b1e23c404b105d6b02bdbc1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190663, "uuid": "ab35dd6b-d564-4ba3-8337-2b6061c04f62", "value": "T1ED23EA444D81748423336B7ABA2AE4E5F7BB0A6B0194494BB87C7484EFB1D18DEE4DF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190663, "uuid": "681f810c-f923-46fb-8264-0d8e2f1ff98d", "value": "768:OoT6s0rdUEVDLCi3yRB7eeH4bl3A69euqtZvLJPT+E33TcxDp9wThIuq1dd1R/ee:OpUEVDLrW7Gy7+1yU0Cxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190663, "uuid": "44f54d2a-f20e-4cce-98e7-611780439a5a", "value": 49379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190663, "uuid": "a24f5909-8058-40de-8ad5-5847a61bb4eb", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190663, "uuid": "2ad058e2-9b9b-46bb-bbc9-1582292b7f07", "value": "Quotations Image.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873aa0bf-c097-11f1-927a-4201ac107004", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1791189246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189246, "uuid": "09127ee0-4650-4d98-8cfe-4bbd35e13888", "comment": "Malware payload (PureLogsStealer)", "value": "d81f22b5cdd06f2b56d0298b63e14008", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189246, "uuid": "521f7679-07c4-497d-b816-c8d9e8841605", "comment": "Malware payload (PureLogsStealer)", "value": "42918e64a23e822406f4148f7f183f6e545692f6133d16b88b8c5d8c23abed72", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189246, "uuid": "c4f7578c-1c18-4ab3-962c-034839e48676", "comment": "Malware payload (PureLogsStealer)", "value": "8a1fe6ceecae5cc8ad8d0a3c32e5fc089947624d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189246, "uuid": "efa1feb3-a3d2-49b5-a0d3-1358e9d0c6ac", "comment": "Malware payload (PureLogsStealer)", "value": "8cb9d82af3d841f4f800a8d67030572024e64c2700b7e7c7549bbff260c17efb1023da28ac87ec07a777cb07441e2610", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189246, "uuid": "880870d6-7431-45bf-8d01-a6fd06bd9fa6", "value": "T10C6512C935428932C7EC47952F6B2B0912B59FA5CA5FC9C3E1F99FA13279B44C0B0D98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189246, "uuid": "7881596e-6bf1-4b29-95cc-634c2758aa00", "value": "24576:+h14pOr4uA3YLDnfM1u51H25bfBptEPTCxe+T9E5nInZXLKRkEg6dtpY:+EpOr4JIx51u7OPuxeM9WWW+2do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791189246, "uuid": "f8a77d5c-748b-4d9e-a43a-3cea32052efe", "value": 1508295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791189246, "uuid": "376f47f1-26b1-412c-9a62-8aa3ef484885", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189246, "uuid": "1ef6907a-532e-4d6c-a89d-3d5b24299e1c", "value": "Purchase Order 20013962 \u2013 Order Acknowledgement and Delivery Date.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e43c8b-c05e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791164919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164919, "uuid": "d57e50ea-4881-456e-abcc-b2d6d4b0e251", "comment": "Malware payload (Mirai)", "value": "24442784e568ce34f714ee920ffc383b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164919, "uuid": "9a362269-a294-4f04-a7cc-4ffb92faa73e", "comment": "Malware payload (Mirai)", "value": "42aa476e9677d875f15f6e09c8cdb40a461a2db58dadcb9b6c5adfd4a796d948", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164919, "uuid": "6a9340de-4e9e-47d2-b70e-054ec5801baa", "comment": "Malware payload (Mirai)", "value": "b09cbdac8f905c2e5a1504a2eb8fa9ae647d8028", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164919, "uuid": "afc4ff8e-9607-4622-841c-0baa556c5318", "comment": "Malware payload (Mirai)", "value": "926045c18236bbe66d33a73b788245a61d59a127f40e5a39e2c7603b44d05c3dbf23b0579f07b4415165445cfe272b6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164919, "uuid": "ebcdd807-2a83-4efe-b725-65aaa97b6d3c", "value": "T10B632803689081FCC551D1715B3FA53BD623F07E2135A68E77AA7F267E0EE211E1B18A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164919, "uuid": "db672996-b691-4b7c-a22c-401ab16d048e", "value": "1536:T2UgfuDqm6w+/FoVgUYpNS96dmPbGUjhCIN5p2:T2lfuro2qUYpY9CmPbDbN5p2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791164919, "uuid": "120a5d2a-b527-4064-b67b-35e5a5f60b88", "value": 66976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791164919, "uuid": "8f6ad78e-36f9-41f1-8f36-d59994696579", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164919, "uuid": "414baa62-bd23-4028-b7fd-c36a36c85711", "value": "winki.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da88a92-c0be-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791205873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205873, "uuid": "b5bd2f20-78a0-49c6-ae71-f988fbd68de7", "comment": "Malware payload", "value": "31094369401e8ea12040547386422f71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205873, "uuid": "c5a7333b-4439-4c5d-842f-d42763c6fb9c", "comment": "Malware payload", "value": "432bacb1f8513a465f1f00f910b96cf7a0b32e4d0cb083e35b71bb4c198b790f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205873, "uuid": "361a9677-c2e8-4037-afdb-5fb7adb2e750", "comment": "Malware payload", "value": "1d9ff7b54fe603727153e65edfcf40c5ca35d62b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205873, "uuid": "d2337053-721e-47e6-bb77-bde4f1164ec3", "comment": "Malware payload", "value": "669bc3a87958945437c881139229973c17dd0c44851a0728e6688e4386f0fdfe7acf2df0f117a92d6a9ff666226a9677", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205873, "uuid": "d484a5ff-531c-4104-99e7-8baf0307b6e7", "value": "T1F0246C5577A10CF5EC73C239CDA39512E67278110370DAEF03A0466AEF2B7E1563AB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205873, "uuid": "b27eb8b3-1f1a-4167-9b6a-fdf63ea3a76f", "value": "0674faf10da3d541a27e42d98f1e66dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205873, "uuid": "fe3cb7a6-b019-4aa5-8201-f34710c80cb1", "value": "3072:LWeWIhwDMd1DAQMZ0Oq8vDrf79TuBIyNuEYV/z/AC0V5+JbfRjtjd:SeWIKw3DDOq8v3f7Jgc/j90Eftn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791205873, "uuid": "1eba5532-46f5-4e76-a70a-b80671f82202", "value": 227895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791205873, "uuid": "389b6c19-f93e-4735-83a9-2e129ddcf75a", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205873, "uuid": "a18cacd5-b4f2-4c2b-a6f3-d65f5626fe60", "value": "432bacb1f8513a465f1f00f910b96cf7a0b32e4d0cb083e35b71bb4c198b790f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b65c24-c084-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181035, "uuid": "2113bbc1-793d-4956-aef7-00aa389c7819", "comment": "Malware payload (Mirai)", "value": "3185a43b50640be2263d3262ee86e75f", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181035, "uuid": "f6a8cf20-d898-4204-9d33-70437b2df3f6", "comment": "Malware payload (Mirai)", "value": "437e78d9c486a8e3b4941181cbcd54eb40f48759c6fd1e412212ed30574167b1", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181035, "uuid": "eed2ed05-1516-40da-a1d2-cb1de4b4e7e4", "comment": "Malware payload (Mirai)", "value": "bd21fc1ee111aa99cef05275aa2c5c2fe9dd895b", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181035, "uuid": "37ef316c-3361-4558-9250-1b4645789b86", "comment": "Malware payload (Mirai)", "value": "904301f9ad3952897339e31378f33b8e075c98b279423afed1099810e4f89d05bd4ea40372fd806bedf97c90d17daba0", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181035, "uuid": "0a324d29-42a7-40db-911c-6fbb3af50d8c", "value": "T1C4F3199EFD81AE6546C127BBFE2E418A331317B4D2EB71129D141F2877CA94F0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181035, "uuid": "f9a62201-da7f-4cf6-a6ae-278039c52061", "value": "3072:T2s/ITo7WCkybotgsJ913DhrbW4UYSx7QpUiB5IQggEuaJhnR1rmaabEtnwKSDZ:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181035, "uuid": "0330ffa5-6c24-4bb4-8432-336cbe837339", "value": 160558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181035, "uuid": "d4536e5a-8cec-43ef-84f7-24e883dc0261", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181035, "uuid": "defeccd6-fed0-4433-8c64-e975bd82c3b6", "value": "437e78d9c486a8e3b4941181cbcd54eb40f48759c6fd1e412212ed30574167b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b951a3-c0bc-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791205264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205264, "uuid": "6c6c593f-79fd-488f-b99b-8d79fb19895a", "comment": "Malware payload", "value": "54892b4ff7c5d718d016403876aa5800", "object_relation": "md5", "Tag": [ { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205264, "uuid": "1fee89bd-319f-4f68-b5fa-e4904964716a", "comment": "Malware payload", "value": "439f82b7a4ca1b2837a4c0885d1b4e695d43245c0dd360a39d8680ccd0448c35", "object_relation": "sha256", "Tag": [ { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205264, "uuid": "e7e6b6a1-e51a-4a3e-863f-2968b149f656", "comment": "Malware payload", "value": "a5740430072d72083c3d6c35754632f8fc88081f", "object_relation": "sha1", "Tag": [ { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205264, "uuid": "d81d075c-c8fa-464b-8c17-8722419c4fb3", "comment": "Malware payload", "value": "deb08b3a144c9582438f5f498687fe435c37a8ea73119df81a49a681badf4f9916231f9c8f61dcdaa71fb87135a41400", "object_relation": "sha3-384", "Tag": [ { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205264, "uuid": "c59e3f4a-a783-43e1-93da-146bdfa58e7c", "value": "T1A4875C52B6C08932D1EE623585EED736777AFE212B134287A646B3397E723D01D38913", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205264, "uuid": "01877f14-f94f-4d16-a804-bc52abbda4f5", "value": "6144:krZn7y/EGuH/cpiIJgVV8K6VGrE8y3CtcKn6yv8zRkDVn5iJg6mOgTMBwFTMVcTh:wUDuH/c82GQ8y3CtcoRv6ilTMgTMVGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791205264, "uuid": "26122f0c-71e2-47fb-8256-4f893a1f33b4", "value": 37748736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791205264, "uuid": "45e1dadd-08db-4db4-844e-6eba66e5a861", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205264, "uuid": "f6de0444-3ed2-4e24-abbf-fc4b35a7cf2a", "value": "PDF_YKKJ4K_20260926205409.vhdx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef08c491-c0e8-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791224210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224210, "uuid": "59b1df72-5133-4537-8d73-6434317a2e57", "comment": "Malware payload (Mirai)", "value": "fe4b1a2050946af8a9b8733eb3dff458", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224210, "uuid": "bc7dbc0c-b94d-46fb-b862-1f43e1574699", "comment": "Malware payload (Mirai)", "value": "43aeec8a68b8ed1a3dfc7d4f1e8300eeea9e78ec9e4750c063a9041feec309a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224210, "uuid": "88d1f62f-9750-4152-87dc-f26a949d402d", "comment": "Malware payload (Mirai)", "value": "606e591e83c5005c39b91117f65129e66ed67e18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224210, "uuid": "39305212-0b9f-421f-bd85-991d515cbada", "comment": "Malware payload (Mirai)", "value": "06a6e495dd3bd3e45c1decef44b98efe5861ed86f1f08f3df02d1704defc42c68e032410bdb5df146954ed7fc2d87aa6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224210, "uuid": "92cd21fa-ae0c-4ab7-88b0-023dac7dfda6", "value": "T1D3341A56B8909F11C6D166BAFF1E019E33131B7CE2EE72029D246F3467CA86B0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224210, "uuid": "6983888e-22ef-4533-9a01-aab85c8fa190", "value": "6144:qFa4GdxCY4UBzvOnfWgzpMtTHlZ3t3XB+bEaUermQcxXkAD/6b:qFa4Gd4Y4UBDOnfWwpMtTD3hX44aUenz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791224210, "uuid": "36c7116d-f8da-4177-9239-c0574b592231", "value": 236916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791224210, "uuid": "885f1ac5-96db-4df7-b9a6-1569c682e978", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224210, "uuid": "8449b10c-6c47-4bd6-a37e-6e72dbdab083", "value": "xnxnxnxnxnxnxnxnarmv6lxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b36ca7-c097-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791189356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189356, "uuid": "51d62ea0-67cb-4302-b540-20a77fa94d13", "comment": "Malware payload", "value": "be9f60cd730df02cc7243c3369f4c4f7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189356, "uuid": "e44e9043-ab66-403f-bd80-a58d9f621eb2", "comment": "Malware payload", "value": "43bd79b58a3a115726570766138fa7f2a05bfa6bebaab5993019e60e6c973300", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189356, "uuid": "2e251606-35cb-4c65-a180-32e63d839017", "comment": "Malware payload", "value": "44e21d0b81c356d21120f94a603a9f8a143a7bf0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189356, "uuid": "9b92f9a3-b1e2-4ba3-846e-eb5b93afab0c", "comment": "Malware payload", "value": "6ecee130223fec628bd17236b6a3ea1fb04b4f2dfb283ed21303340986401972216d9f3001257fb1422dc33a01f32134", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189356, "uuid": "8276352a-748f-44f4-9b43-af1da353a112", "value": "T14D21B7A3C2784A11DC5431B77D29286C5A9328704742E15B6EE3E5219869E3CDC7A257", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189356, "uuid": "a5f3cf89-182f-407d-9d43-eda73a3a2553", "value": "24:9BssC+aJg+Sh822GkkUttZPo1OE+jfmqg364DK5v3IwT7NAwLUgX:9x6g+h22fDRPo1LGfmLfDK2C55X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791189356, "uuid": "85680b41-8ced-4a4c-b6d6-0bae6264e25a", "value": 1215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791189356, "uuid": "4d72a2c4-47ec-4829-917c-79e906a9a909", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189356, "uuid": "e375e799-394c-44f0-be5b-b88b19e3af3a", "value": "329e1748bc219bc90cdef7fef6f7c03f39f16f4d2e77021a7c37b902fc94c20d.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e85b11-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181694, "uuid": "b84a3406-f5eb-4edd-8e14-93f048d9a2dd", "comment": "Malware payload (Mirai)", "value": "66fabacdbb61dbb9438e73ea7db9f6f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181694, "uuid": "d41dab2b-28b5-4eac-9cc6-da872ec99589", "comment": "Malware payload (Mirai)", "value": "43c04d5e4131a99d5a52718a3022e44d2e228518191554cae0ad96cdae86abb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181694, "uuid": "0df7e755-709a-4082-ae9d-04b9a9407ea4", "comment": "Malware payload (Mirai)", "value": "f04b6ac9a380a716a9a5e8fa5c0945db8d70e9cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181694, "uuid": "d2859993-9206-4cec-98de-5d6fbf6ab295", "comment": "Malware payload (Mirai)", "value": "05bc6cf124eb0289d4c4e8336dbf8058b429779c6ed3b7a60970c0c19b80709774cc906edca82581e4b18b621585a12c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181694, "uuid": "1b41fd2c-28b1-4a9f-ac0d-5f0e2fa0fdde", "value": "T1996302279A4E6E85C4ED19293B683B534B98F8D428C6C78559C1C6D4E37BC0B2D8E43B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181694, "uuid": "96b3b0fe-1e2c-4b7e-b0a1-b676616eb879", "value": "1536:l8HKY+WsqjU2ZXhPnDcV89CrA2HmoDFlWonyl+V2Nz:lzY9sqphPnDFEGS8oyl+Vmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181694, "uuid": "e59767a7-9324-4fad-a824-8e0ddce4409d", "value": 71064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181694, "uuid": "486917e9-f778-4002-a6f0-e02534a2be83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181694, "uuid": "41e434af-9926-4c01-9cae-f92924eb3c8e", "value": "wife.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e89bb36-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181984, "uuid": "108df988-279d-4043-8d60-e1c9e129cf7e", "comment": "Malware payload (Mirai)", "value": "70516cadc3b9cb164a94dd954a1c7707", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181984, "uuid": "2124d5f5-d69d-4884-9311-609888c4f124", "comment": "Malware payload (Mirai)", "value": "447c24304c7274d6358052b3606408e26331a55afac188729bc21ce598c8dd72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181984, "uuid": "5cc928f7-d44d-4bf9-8591-241be02b4561", "comment": "Malware payload (Mirai)", "value": "82d7c88bc35644549eeca37d4523b42957368773", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181984, "uuid": "d50e10dc-1408-4e2b-b1b6-d84cc49a4eff", "comment": "Malware payload (Mirai)", "value": "102c20c029636d90e87846883a16edfa69b0b05f7e104dfe7f3cb4819e0e43770f9256f14fb97033ce33263060a5490d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181984, "uuid": "59ffd5cb-0ae5-4c51-9333-5750a5bad99e", "value": "T12F934B81FD419662C6C112BBFB2E428D372617A8E2EE3207DD295F21378792F0E7B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181984, "uuid": "91e24c86-d26d-4aab-9a3a-d5b8caf58b75", "value": "1536:9TacF+TvUXnvP2gIbif4syXrnKhrVqb+OdU9aBBkmvcvU8y:9T32UXnkiwb7nKhcu2Sc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181984, "uuid": "d0c0571a-e1ce-49ff-99ae-3ff33d9eb4c8", "value": 90032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181984, "uuid": "02ed39b3-817b-4595-9a74-08885353e853", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181984, "uuid": "618b8a97-650c-4c3f-b25c-17f25c89a1aa", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc07b71-c0fa-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791231828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231828, "uuid": "56391e46-60e2-491e-be02-9a0b30cf6fd5", "comment": "Malware payload", "value": "3d203a621de4a4ac7d0aec86cab7226f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231828, "uuid": "9e21835e-1b88-4ee6-8a57-eee3f02a70a8", "comment": "Malware payload", "value": "45385b4251b03cfcecd0fc4aedf0c647cf2b21d529def65aa92a5450e1ce2b90", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231828, "uuid": "bf2a3695-bbc6-4d15-974e-0d8c0afc1b9e", "comment": "Malware payload", "value": "7f2d891d6c55569f3254b77fe83a14263f2e18c0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231828, "uuid": "9e96fe81-2563-4034-aaad-3599ee137ec5", "comment": "Malware payload", "value": "367df98b5d6e6355aceb4f2e0092c4f20c24dbcd26a8b95c50e3276a29f041b05faf9c01bd768e764f71fff21373f6a7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231828, "uuid": "71b50ee5-b763-49e5-b465-849852e27a20", "value": "T1A9753347A56CA813FC634370879DB3EACAC970570DC45A7B4E7986218D5FEC80A3C9B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231828, "uuid": "bbeaebed-64d7-4400-839a-be2b50e8aed2", "value": "24576:5JGnBmAD+KKfCSF3mEwW/ugGL/tjnwKP0cNNJQKtwBrS4dHydWDzfPLJ3VhKaW3t:MQACKKfCk3LqxnFP0IaK2BXdSgf1374", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791231828, "uuid": "f4feb0d9-40c9-4f1b-b200-ce6ed009db7d", "value": 1584457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791231828, "uuid": "3cda5372-aaec-460b-b21c-4a37e5642406", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231828, "uuid": "84952cbf-2495-443a-9ddb-00bd87cbbf86", "value": "45385b4251b03cfc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a71b2d3-c0bc-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791205036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205036, "uuid": "921a6c66-72a9-4be9-b17d-cacb8ec88bd1", "comment": "Malware payload", "value": "f209ec0484a312123c81dff29f4c595f", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205036, "uuid": "c88406d3-8547-4ad8-97d1-6ccceda40708", "comment": "Malware payload", "value": "453f5522c1b05fd807af02571f031e26ab81a3b5b27b62d98f89910eb3fabae1", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205036, "uuid": "b66656a0-de0d-4499-93b5-6c9319deb94a", "comment": "Malware payload", "value": "5c37e138b2fb4ed8d406185348cd7e6b4f680ce0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205036, "uuid": "eda97017-6bc1-45e9-a56e-3cee18e7fcbf", "comment": "Malware payload", "value": "b7a681309ae16ef41d910789e56ee3c3ad6bf14d7c99b92336a197876a66df563094e4a955adffa8355ed9c8b2fe3789", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205036, "uuid": "9c61b040-34af-4876-83b8-52402605650c", "value": "T16BA37C324A5AA9FF517EACB5B591F0BDF2006E1DA1DE432400B258B4D7B06D7E14E28B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205036, "uuid": "4979cb31-5d62-4bbb-859c-81df5ce26e6c", "value": "768:h4lpGy2xsGt7XbH2ffffffffffffffffRGyyyyyGo:EzGt7rH4Go", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791205036, "uuid": "54e88487-a9cc-4e42-82da-6b9867ed8632", "value": 98834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791205036, "uuid": "7928e611-14a9-4dc9-accf-d1d01a4aa9fd", "value": "application/vnd.rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205036, "uuid": "3d2dba74-2701-4499-9e99-1e95f095e5d5", "value": "ScanDocuments.pdf.p7s.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85bbb940-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218879, "uuid": "ec552373-dd1c-40bc-9581-8404932066e4", "comment": "Malware payload (Mirai)", "value": "5bb723a6669b12d0328939a950177a12", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218879, "uuid": "506af37f-6e09-49b4-b237-71a3757c11a2", "comment": "Malware payload (Mirai)", "value": "462ecf0af56896993406b940292a7ba9717f918016cc996a0376a8434f76806e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218879, "uuid": "afca281e-a05a-4d88-ba3f-3102e78f36f9", "comment": "Malware payload (Mirai)", "value": "dcb69066ff57a9a489279e35cfd5b212db097539", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218879, "uuid": "545692f6-82a7-43fc-90ef-d9e3b46b238b", "comment": "Malware payload (Mirai)", "value": "1282021ed03f18010ba239123a1ca36e1410cdfc302a72549d66fa962ae330f39dee48a5188c80dce2713b1b592ba554", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218879, "uuid": "6dff6326-5484-4018-9cf0-5315b956123f", "value": "T1D37302D9666EC3440F29E43AAF5EA106ED3080D2D41C963199463EBE57E3B506DACCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218879, "uuid": "4555e376-1992-4ce0-8e9d-d56dcb5e8673", "value": "1536:joKgfvmVgOc/7Jfjb5y5xgPex3nQHkUrf9Znouy8GyE:joKKBOc/tmxgPqnQHtr9Jouto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218879, "uuid": "401da7e5-6df8-4351-b410-c3a3d490f039", "value": 74720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218879, "uuid": "43c4340b-23ae-4f29-864a-353646f593f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218879, "uuid": "f66051fe-a0c5-4ad6-9398-c3127c87bd61", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed5c420-c06c-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791170737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170737, "uuid": "0ab0f726-4cc5-4ad1-bde3-fffbc47f016c", "comment": "Malware payload (Gafgyt)", "value": "f8d669b637b41c45aefca1d5f66ed368", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170737, "uuid": "9e92a2ec-5878-49c9-9042-56f6cd032926", "comment": "Malware payload (Gafgyt)", "value": "46db514c0791f4093050cad13f69dd6cf207887992104b57ba3bca38d38ba14c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170737, "uuid": "398a2c49-aeac-4945-b4c4-24821fb7bf64", "comment": "Malware payload (Gafgyt)", "value": "b1d17eb9fa275c364d76dbc630ea50455c00ef86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170737, "uuid": "2bf355c8-5344-4d76-842c-cf696a815ce6", "comment": "Malware payload (Gafgyt)", "value": "a8a2467b9be371ebe5ca8c1285b21688243fd211eb1cd88a545fa4ba6b0fbbbb7792aa4f7f51c261d3964f1152073c7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170737, "uuid": "2e0e5caf-94f9-42b8-8a58-40e09b931860", "value": "T1D464C716BB919EF7C85ECD3306EA4A1110CCE44622A56B2BB7B8C61CF74B94F48E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170737, "uuid": "e76bec96-6117-4f26-a473-d4650ab6b44e", "value": "6144:cU+L9NDu4D/fj6Fvi1FihvZHtWGL5Fh5J/qOAYP:chDyk2FvimhvZHtWGL5Fh5J/qOAYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791170737, "uuid": "7f8fc789-2b2d-4b4b-b163-c5ee7e817b8f", "value": 323278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791170737, "uuid": "ed14200d-b0ac-45ba-93ec-acf281fb0e6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170737, "uuid": "0b68d644-d613-4a01-b556-ca0c6a94278c", "value": "46db514c0791f409.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93419af-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791190592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190592, "uuid": "531d0dab-bb9a-4466-962d-678f878779dc", "comment": "Malware payload (Formbook)", "value": "14a1a43ccad9a37fcc91d886cc3651a5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190592, "uuid": "24ffb253-809f-41c8-9324-2e149f996fd5", "comment": "Malware payload (Formbook)", "value": "46e8d2bd454926641176ea67b2e357089ff411c89e524def0158a04b6103d7d4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190592, "uuid": "d3c2d2b6-c604-4dd5-8223-dfbda4b0183a", "comment": "Malware payload (Formbook)", "value": "8e8c94ad10d201b7d3085d4dbcf7a309b1c3f93a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190592, "uuid": "78c914dc-56c2-46b4-9a0e-09039eb0d348", "comment": "Malware payload (Formbook)", "value": "c242a98db9d9e73a7e0190c691632fb3e3cb35c48bf2622fe321c07412213aec6330a588453aa2cfb868217f16f3262a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190592, "uuid": "574536b9-98c2-4508-b547-2527b15b9b5c", "value": "T1BFF5E57CA014A7E4AA6D0B1CC5262B0506FE304FB7F57A3E37E8B685235972934CF466", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190592, "uuid": "c9d1d4c3-5e9f-4bbc-bf7b-f0827bd93171", "value": "98304:iI6kczofOVkFh2O8ckisuLKNCY4FHqW9hH8WBSfvZbOwleUqvB52ljUkeSNJEWS8:Rx/H8WBSRb/xqvLkjU0NJEWeV8Tou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190592, "uuid": "3e0fc324-8afc-48ee-b50f-c536b03efea1", "value": 3326270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190592, "uuid": "2cfb50ac-c846-46ab-a3f8-ccef099a0b31", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190592, "uuid": "2244913f-c437-4ab1-b39a-b107f4c0d904", "value": "ROQ_O 2828-501.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1b0d4b-c0e8-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791224205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224205, "uuid": "39bcdf53-3594-4b3b-9d2b-ff29e98052ab", "comment": "Malware payload (Mirai)", "value": "945ed0c8dfa24027bcd9f339fb0f0c90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224205, "uuid": "176319d9-4ba5-44f4-8785-93fe55337281", "comment": "Malware payload (Mirai)", "value": "478d4e9aad7992dff99554f6068074641b0b1255c6d8a00e5c5c67cfa71ccee7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224205, "uuid": "0c41a65f-499c-411a-96c4-e2d8b573f9e5", "comment": "Malware payload (Mirai)", "value": "636a3b032a23f29ce22aeb75cba65ce02dca7242", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224205, "uuid": "8980fc9d-5542-4146-85c5-83f8839c7609", "comment": "Malware payload (Mirai)", "value": "f7059b5368f17def0e4f1bb29c3a771972b9a00b5fe4e39c8076be2099d17ff63bcaff3a45e9fb11c6096cf64edd7ece", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224205, "uuid": "6e7dddea-7cc8-40c8-996e-07ecf94c76cc", "value": "T15C145B52FAC3C0F6DC134979605BFB3F8A32D52E4027CAA5EFA89D36C527A01461B359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224205, "uuid": "e469a6eb-948d-423a-be4c-03ee478e536d", "value": "3072:tfiwyKvYddKWPZB10rnLAkXwyBkK7YB/8kupksB/8n4KZO:tfJYikKYUSn4KZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791224205, "uuid": "590f5ec9-9cc2-45d1-826d-19799d588db1", "value": 191016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791224205, "uuid": "93748c84-b2bf-4026-ba1f-bb3a86098829", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224205, "uuid": "afabf24f-49e3-40a3-b0e8-c97c6e0bba22", "value": "xnxnxnxnxnxnxnxni686xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99567659-c08b-11f1-927a-4201ac107004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1791184123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791184123, "uuid": "cca8d743-b54e-4a91-a55c-49dbc803e8a3", "comment": "Malware payload (AsyncRAT)", "value": "c61337c8ddc16d4c2d5cbb35bb1211cf", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791184123, "uuid": "40c118b9-7368-4258-8b1f-d72fd9aa10e6", "comment": "Malware payload (AsyncRAT)", "value": "47ec550416d5740d5593508bd7088f26f1e7053cecd10851c2f15fb38e3fbd6d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791184123, "uuid": "82d71d1c-9262-4ccc-8d27-4ef011d0a915", "comment": "Malware payload (AsyncRAT)", "value": "036f1d11d4b3af6c3086ae47560af100e0e34f37", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791184123, "uuid": "e03fb3e4-f4ef-46c5-87c6-9a8ba06b9dcc", "comment": "Malware payload (AsyncRAT)", "value": "957f0fbc407b35f3f19e0b7b1869e14c439a06cb3f39aaecb65e68cc443ab2ed87d555619bc134904e62166e4fd7d57e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791184123, "uuid": "015ae11f-1c99-4ae2-a7ed-9a55572c33c9", "value": "T1AF333B103BE9812BE2BE4B786DF21641867BF1673603D94A3CC841D75B13BC696429FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791184123, "uuid": "b53e86fc-7acb-46ca-b4d6-ffebcea24373", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791184123, "uuid": "964a3eba-3f0f-43e8-b2b3-95f4009f61f9", "value": "768:NozqM7wdcb64GBklNDQ0piTYlCx0ZuTtN0bBTmHL8XrTIh/YFIvClZU2tYcFmVcl:NozqME+08g10JbBi8rTIgrUKmVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791184123, "uuid": "f5879613-90f2-4e91-baac-8dc76020d1e7", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791184123, "uuid": "f87ac312-2eb1-4cb1-8ac3-e9959eb1d785", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791184123, "uuid": "6e5b86b9-20b5-45b3-886c-243e3e81cc47", "value": "47ec550416d5740d5593508bd7088f26f1e7053cecd10851c2f15fb38e3fbd6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9f5a4d-c0bd-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791205764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205764, "uuid": "e6f975cf-c54b-4722-9f51-ce8705ad6ab4", "comment": "Malware payload", "value": "3b1b99109236c94fb6dfcb833c85b9f9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205764, "uuid": "686e0d7d-fbfa-4647-8a1d-5558712b26eb", "comment": "Malware payload", "value": "48073427089d9377d50fc3ba69da9ef467d34c27fa8674291129a880fa64b9dc", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205764, "uuid": "4433babf-6571-47ee-9df9-2bf511da1129", "comment": "Malware payload", "value": "056259a78de4b06e43b207fc16bac5308a5327dd", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205764, "uuid": "d7368514-4926-4e58-92cc-185d21f337b5", "comment": "Malware payload", "value": "fdbda2ab350b1e5451ee5d16ce8dbb86b3505a6f48e9411de20b93e9b77a68a91c40cfa8a4d4042e7517b961566b5e0f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205764, "uuid": "f29791b6-5d23-4349-8d84-03a3b900e8ac", "value": "T155283306BBA9683EF427207D365614A5C1666F87D232D5DBF039B3E47A772810780BF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205764, "uuid": "e54720e2-7881-47e7-8177-ec209e8ecaf0", "value": "1572864:HAKDT+Rv/4+9rq9Cs6rKz735JJ49Iz5YqDd8IfyLBewJG8dqOjJ8HDi38H:HAKDy69CxrKH69Iz5tdeej+r8DoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791205764, "uuid": "a3bde813-323d-4b39-99de-0d37c522ffd7", "value": 96185962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791205764, "uuid": "85fd90a2-ca04-4772-aae7-dfe8c4aa5447", "value": "application/vnd.android.package-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205764, "uuid": "b385dbf2-bf12-4416-afce-238075c0eef8", "value": "bossSlots.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c38d99-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1791190606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190606, "uuid": "27207c87-c065-4dcf-9134-fc1d281b2e9e", "comment": "Malware payload (LxBaseRAT)", "value": "fb4552924b011a371b13c8c8a4bf4721", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190606, "uuid": "d80bd22a-adfd-49ad-a624-5df147dace1f", "comment": "Malware payload (LxBaseRAT)", "value": "4879d7cf5a82445bb5d38d76e396b04cc317ae83b6a11a8c26954d1aaa1f0c31", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190606, "uuid": "d6cd28b2-6465-4670-bb24-27866a152fe5", "comment": "Malware payload (LxBaseRAT)", "value": "96705b9e6732085068fcfd1022d5af75cc4815af", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190606, "uuid": "e5a1dc1a-1897-48d3-bd85-89a1e7d15efd", "comment": "Malware payload (LxBaseRAT)", "value": "34626eebea1994ffdcd2b4d69b8c78c4d8b22d369d7a3e630feed5b1114935004813a6fa8ca089637ff694ea24468149", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190606, "uuid": "315238ca-8f3f-4508-a254-7fd7393dee79", "value": "T1FC75375203851BBDF68D0EC9C94B215B20F2D4677D291298EBB36EE7BD3B9849430736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190606, "uuid": "424e34ed-08d2-4f3c-a2fd-62fe16fdcf75", "value": "1536:65r09u4r/p89rU+hs6FUpV83oOrWjddntheRLVluK3QaQ+2Hm9UT43W9HR3o29tH:kIVps/5kE8luU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190606, "uuid": "c6b9b109-57aa-47ca-a476-fb1348ca5876", "value": 1637222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190606, "uuid": "1e959ed3-e9b1-4320-ab58-640f6104315c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190606, "uuid": "0bd7ae3c-0124-4094-a4c1-f6e62d111fb6", "value": "PO 4500272644 - R0-Supply 250787.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f29142-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218710, "uuid": "cb5838d7-e8e8-40dc-988d-f2bb24c1e51f", "comment": "Malware payload (Mirai)", "value": "808f5bb1ddab29efbe7b2ff0fb7cce10", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218710, "uuid": "60cfc59c-2e07-4aad-a719-ab59cabd2702", "comment": "Malware payload (Mirai)", "value": "48efe66ff95ceca7f508ba2be40ad5a68acd3cfabed71108afb18a6b9bd988b9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218710, "uuid": "a5a9ae42-a84b-45d3-bc20-59f93feb57cc", "comment": "Malware payload (Mirai)", "value": "ab4c6582f3dea600c102d32a6a3a8dede6003b54", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218710, "uuid": "b748f4e9-8bd9-4594-b3e4-2bf83d7c700e", "comment": "Malware payload (Mirai)", "value": "21f2326c35eff30292b664a971e1cb317723df146d72c9e49e9daf46d9a8704998926af3f93f6b5c97ba533cec935cac", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218710, "uuid": "71fa5b84-fdfe-429b-9641-eae025c723fd", "value": "T132D30916A951DF12D1C221B9FF5E425937136F78D3EE32029D24AFA0374A8FB0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218710, "uuid": "563b72dd-3bce-4381-98d3-2ed4563935e7", "value": "3072:hrUhMpy5XV9HBTYtaHLSuTf0zuhA88WFDEmB5+C:hrCR5XbhTAaVT0UAFkEmB5+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218710, "uuid": "42b2e9b1-dcf8-4162-8023-5c359c523655", "value": 139192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218710, "uuid": "f2ba157c-1642-4280-a342-e9103c9c187a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218710, "uuid": "5577938c-bfac-4769-9bca-25c631a33127", "value": "eclipse.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ddcf84-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218876, "uuid": "69fa771b-d7cf-4435-9918-52c4814e8681", "comment": "Malware payload (Mirai)", "value": "398286e250dc32da273cf16bed56a275", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218876, "uuid": "04b69d9d-c232-4d0f-8fd4-14ff1b76cfca", "comment": "Malware payload (Mirai)", "value": "491934eaa2b3697004d123fff33b92e9dec94dcc15cfecf5d9989697f1dcc658", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218876, "uuid": "ad2a65c9-a22b-49b6-84bb-2f09f0dde05e", "comment": "Malware payload (Mirai)", "value": "be4404050abdf94ae482919eff5b9db0ade2704b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218876, "uuid": "2ede29dd-77f6-4a2c-999c-57f169890034", "comment": "Malware payload (Mirai)", "value": "74cd244910f465c32d0cb2370583fbbfd036909243ffa94f0554986ac474ef4dfaa2d6d8f0445842d8c2acf467da451e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218876, "uuid": "85718f93-fdcc-42f0-b836-c38b9b3c0905", "value": "T1C7931290903C3B42CED269769B5D4FCDD4409978A25F21FB12B3D221827A2D50BB7D5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218876, "uuid": "3750032c-369c-4762-b3f1-bbb14ece8c25", "value": "1536:bwMlH1cA9UejzDmc/7UYD6V2oln+epKUxgpFnXTALwBLrX0SvfPK9NMXN1N25DFQ:XHjK6XTYYD6Vxl+8mXALw11vfsGNiDlQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218876, "uuid": "93fcec5c-32ea-40ca-a226-e1bab7acb68d", "value": 97024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218876, "uuid": "75810051-91e7-4a65-aeb8-2aa1518d308d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218876, "uuid": "d1ef6f48-412d-4bd4-a0b2-1bd969376cf3", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04279119-c0e3-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791221668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221668, "uuid": "6964dfee-42e6-43c0-b78f-d005906f4c65", "comment": "Malware payload (Mirai)", "value": "51a553adc847d57150dd8c3d79e3d9b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221668, "uuid": "ebda7893-9469-410a-99f0-51c0bd9cb431", "comment": "Malware payload (Mirai)", "value": "49963c85538f250aa56323d18d455b3ee7bf8476fecbaa08288f43611d325d6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221668, "uuid": "98328948-c24d-496b-b47e-6f4058ea1e67", "comment": "Malware payload (Mirai)", "value": "134d0abdf080f8362b4f6d0ec04f96bccc4a01f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221668, "uuid": "37e1968a-a2a1-49bb-9ad8-0c30e3f0d0f5", "comment": "Malware payload (Mirai)", "value": "3004efbae73d8e2083860522c747c4d95fca07aeda42313ef0066d16fb1ab3fb4297c36ec8294c53c06687b31dc571bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221668, "uuid": "ea848488-b6ea-4047-9657-05392049b77a", "value": "T16A057C07EF951FABC4EBCE34856F831705EEC88306C2A22561BCC96CBA8D6594FD7548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221668, "uuid": "1bd52faf-6251-4a53-b62a-698577d15e90", "value": "12288:xMjyISMWnuATlDuOT5yqdi2i+vwH8RVXPR7e6uUWdRhN4YQfBSuKMSVJ35Dcbjgd:HYQIulQDfhfHwS8tIn7GYKroDxLbbHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791221668, "uuid": "86e5c8b1-546b-4d13-88ed-2d96653ea8ca", "value": 797296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791221668, "uuid": "20355474-5ab2-460a-acfc-04719cc4bb3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221668, "uuid": "7691c435-64b7-49ea-b10c-1547186631ca", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c49bf7c7-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185913, "uuid": "d91d6e6b-bb4d-4863-bd70-7b8de25afb47", "comment": "Malware payload", "value": "abf5239ee64f82a9f2dd50644893e8f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185913, "uuid": "f8f0cb21-3dcd-4137-8b2e-ea5ac1c0c470", "comment": "Malware payload", "value": "49badaa3cb0ce54746553275bb30cad78c9aa1e00b12a90f31f02095bdc421c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185913, "uuid": "49dfc094-404e-4ff3-a7dc-e3eab59c93a1", "comment": "Malware payload", "value": "035b9ae9ac667c26c0d43ddaa4942618b7697534", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185913, "uuid": "23ddb6b7-2030-4875-a3d8-e4b712e30fd2", "comment": "Malware payload", "value": "c4d6de36bfd88ac71a1ac76a87b1217c582b5f5f1fdb22314bbb723ddb7b7b302eb9d65c9f90b0e39d753042fe483ccb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185913, "uuid": "318d1e5f-6d9e-4b61-a16d-22b41c28ffc2", "value": "T1D0A55B07BCA808AAC0AF923589B652527B71BC580F3123D72E50B67C2FB7BD06D79754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185913, "uuid": "da536e3a-d8ff-40ca-95ce-2b22af687bec", "value": "24576:Tclxg3SJZNg1BIykhZRrFcrMH9FAOab04Qm9n:TIG38ZNgfIykhZRJwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185913, "uuid": "ca9193a7-fa5b-4e18-ad3d-6f9083b7f8c5", "value": 2113660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185913, "uuid": "f2219c60-d812-4010-9c0d-eedc5bad9537", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185913, "uuid": "76a7c160-a78b-417f-80d2-0f2515c33d5c", "value": "mb.amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022765b2-c0e3-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791221665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221665, "uuid": "cf52129e-8893-4b82-a04a-f29c9ae0b80e", "comment": "Malware payload (Mirai)", "value": "78cf84273d41a693d3e8c40b73d7148b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221665, "uuid": "86bd0df9-b24a-456f-ba10-8f28f0ad0362", "comment": "Malware payload (Mirai)", "value": "49f0660e44d1335fb9828d57cc9930122a355d36e6a3bc5892066d6fde815b5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221665, "uuid": "7c8d6136-34c6-40b5-a2f7-706ac543f608", "comment": "Malware payload (Mirai)", "value": "f2a5f11f27df61979b6938feb98a94570d1006b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221665, "uuid": "cc010323-3050-4a0e-8c84-1ad8102411f4", "comment": "Malware payload (Mirai)", "value": "9b8ffa34fb7686fdea4094c142b0f8642c59599b56d421517ba862116a146835e1253bd12eb869e335bcc947a834457f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221665, "uuid": "93c3afff-089a-4d9c-8eec-5443f8727129", "value": "T1B1F46D53B7219F54E361D27005F387519EA521A20EF39482A3BCC6207E11A6D6E6FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221665, "uuid": "01c92a76-297c-4fef-9d5e-825738b88ed1", "value": "12288:vTQA4vh5OD4i2rxAXiA1f4DRGVhdCQFQ0E1VsL0lgpdg8hPd4m:vTQJ55W2+l4DRGVaQu1VswWPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791221665, "uuid": "5805b3a0-e291-479e-abc9-034277fa556e", "value": 730136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791221665, "uuid": "402f7091-63ef-437f-b2b7-a862b3f8f529", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221665, "uuid": "02bdc6ee-b150-4f3d-93ec-c8d7595d79d2", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61753edf-c0a8-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791196484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791196484, "uuid": "739c0a4e-435a-401f-bcb4-45fe7d35a620", "comment": "Malware payload (Gafgyt)", "value": "615bed0a89cf4269a1dbdecce54e3ae1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791196484, "uuid": "c260f78d-0cb7-429b-ae45-0e886bb443c0", "comment": "Malware payload (Gafgyt)", "value": "4accae06e6459df508b49b158a44a7627bc221982b7495a9e88b02b5682f76c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791196484, "uuid": "205fff53-14f1-4bb3-8f50-85d6ab8d2f08", "comment": "Malware payload (Gafgyt)", "value": "330c4a3ee4fac4378eb679c3e1edce7c2951e0fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791196484, "uuid": "fa171e4e-e16a-4ed9-8b16-94a3f8f9751c", "comment": "Malware payload (Gafgyt)", "value": "f9ca599e90a4b8e46e5432efc219b09703f72fc931daa679d05f015084fc6d93888952c0a26c2c2ac9be3827638cc7b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791196484, "uuid": "f1dff95d-d367-4fac-8685-f5857986d821", "value": "T1D3342A45FD144B6BC6D237BBFB8E428E37336B5897DB33019A246DB42BC6B991D29100", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791196484, "uuid": "d47f0815-bf3a-44a6-a75e-67de80fa1170", "value": "6144:UnvK+/c+/vGK9okrU5B4gMO0idzaExiSe1jp0vgKZHYlZSj/NH2UsMIO:avSB4NXiUEoSe/0vgKZHYlsj/NH2UsMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791196484, "uuid": "4a70e664-e9fe-4295-a1c5-2fc2c3e430e2", "value": 245286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791196484, "uuid": "a7da5340-5752-49a2-87a5-a8cdff1b7ec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791196484, "uuid": "2304ed2e-c989-49a5-8403-6f86e769d9d4", "value": "adissarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e310f527-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181669, "uuid": "012447c2-bd1a-4a0b-8043-fa5419384501", "comment": "Malware payload (Mirai)", "value": "dda6ecc6ba1965b8671e1f02ad4ed0a8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181669, "uuid": "495562d9-4557-4907-83cc-432789d32a3c", "comment": "Malware payload (Mirai)", "value": "4ade021771c523feac3c9e7682411f6e20debcc0ecf82384c10d741f41f0a8ee", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181669, "uuid": "4b009892-7f80-424d-b713-17dc55ceb672", "comment": "Malware payload (Mirai)", "value": "38b6013ddb791a773707ada6d234056ecab955fc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181669, "uuid": "72f32fd5-b3ff-4b86-8372-a1abf9e418ad", "comment": "Malware payload (Mirai)", "value": "16df39841d912765d1026ee3e1cff264ccb1a31d73e9472cba7a194e0b46f863b169f697bb9030d0a1c4bcba88649cae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181669, "uuid": "1040aedc-ed3d-41bc-a0a6-d4fba78024ee", "value": "T1F3B012C802E852E330D7852034714418241940C324420C97448D0CB3F241F04F34378D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181669, "uuid": "6862f38b-ced2-49c4-bdc2-65dd0ce7706f", "value": "3:TKH4vGBwkHA00ceSUIgwWcn3BFSLgwWc3FA:hVcenIgwWk3B4TWUFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181669, "uuid": "69f10b6b-2e53-4a76-86f1-92ca93d6dcc4", "value": 97, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181669, "uuid": "9f974f37-2c69-4c7e-98b5-90a168584697", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181669, "uuid": "ab601f1a-b69e-4fc2-9f12-bac353df0fe7", "value": "3.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c471db0-c0fc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791232473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232473, "uuid": "9442cd6f-55ee-4d5e-8ffb-fc0e61c7cd0e", "comment": "Malware payload (Mirai)", "value": "810758861f8d7048750581c71057e3b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232473, "uuid": "9dfd76d1-dfc5-4144-86b8-7fe509a6e7eb", "comment": "Malware payload (Mirai)", "value": "4adf462c94bcf0d9fd4a4544f2936e858c458c615cbe050ff921072bd67d5257", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232473, "uuid": "7006564c-5969-47a6-a46e-e14b36a03730", "comment": "Malware payload (Mirai)", "value": "c1183b96d6709d99ca6fe8a4bafd896878bd3c20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232473, "uuid": "611edb7c-84a7-4ccd-882d-ba14c1d24fd4", "comment": "Malware payload (Mirai)", "value": "d705c6f455feedf09df2cc361812dbc8f7b68daa9b2ce2446877adb0e9d856fd8950e96dd515142cfec9f78b3302052d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232473, "uuid": "05e52606-9303-4184-bf1b-714f3e27d5e9", "value": "T1FB533B02B2280A5FF9D319B0343F1FE197BEEAC035E0B689695ED7558635E332485E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232473, "uuid": "58bc3f52-c099-47cf-b043-e5f31270b229", "value": "768:PtMLxtiRFwLoDnud1kvSeq7Q4dPfGAsLmZ8BBSzjrYiyR7gHX1SPgIaalG:VMLSBq14Se4GHLTBygfGXAgIVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791232473, "uuid": "179f7015-e5c9-43a5-81e2-61905fa2b636", "value": 64248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791232473, "uuid": "2916332a-3355-4a1a-9e56-4f86bd0d17b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232473, "uuid": "41675995-c508-4591-9494-6e33110809cb", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d0d259-c0b6-11f1-927a-4201ac107004", "comment": "Malware payload (WannaCry)", "timestamp": 1791202531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791202531, "uuid": "b2da0363-fc69-498d-b8cb-45d72939e7ae", "comment": "Malware payload (WannaCry)", "value": "b499e00cc3d278a14ae18fe80adfb2fc", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791202531, "uuid": "342e2918-2417-4bd6-9a6b-2424b9101f80", "comment": "Malware payload (WannaCry)", "value": "4bb957e55360ae037e790622340f6369c94653f190fb5e533c05729564156284", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791202531, "uuid": "43ede176-0c06-44da-8d24-a0152005c339", "comment": "Malware payload (WannaCry)", "value": "0df1cf19da55c9f30474dd0eb72d382b37c76db1", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791202531, "uuid": "3f904768-91b4-4fde-9dcb-dc7d8005e3e0", "comment": "Malware payload (WannaCry)", "value": "94c4bbbe835910aea07812a2094631386f643948093e8a98c4036d28679c98a5ac6095d5fb41c43f8613fd49e510ec3a", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791202531, "uuid": "2a22be9e-95e0-4820-9210-9beafb62c36a", "value": "T12E36235976AC80BCD0061770C4F3CE25B3B2BC5913BA9A0F9B10B5661D73786F794B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791202531, "uuid": "3f5e5de3-925f-489a-9fad-d2cc58732fb3", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791202531, "uuid": "c9042e9f-21c5-4d2d-b80a-c4ddb0414d73", "value": "49152:jnsnnMSPbcBVQej/1INUpjYV8W36SA8dhnv:DMnPoBhz1aUpcN36SA8dhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791202531, "uuid": "63f74c8f-5a85-4734-aa0a-5ad1f0c03a0b", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791202531, "uuid": "5bbfcce7-75ed-4ca6-89f1-e57c87b089ce", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791202531, "uuid": "9fe6b1e4-bbed-4487-b79a-3dafd58abf39", "value": "4bb957e55360ae037e790622340f6369c94653f190fb5e533c05729564156284", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2329681-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181641, "uuid": "8db96128-f267-45e4-8fde-1b78b126b081", "comment": "Malware payload (Mirai)", "value": "916eeb277965edddb06da6ad925dde7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181641, "uuid": "992258ef-8e04-468e-9a5d-d5535c073f12", "comment": "Malware payload (Mirai)", "value": "4c479758e35dc0bd3dfa7130bd8bffa4d28e396ffa85897a54bdda241929c98e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181641, "uuid": "fb93667a-e2bb-42d2-85a0-0835fcd94576", "comment": "Malware payload (Mirai)", "value": "2a364d9e05321643b6ffebd03ab7c236c834ceba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181641, "uuid": "41bc533e-fb39-42fe-9053-424e99e16b70", "comment": "Malware payload (Mirai)", "value": "d234b5cef2e41eb61b9b1d1eb3821f36336b2bcc8302867ded51bd6b4d99b65ac6d2794abeea65a7aad8e815508804db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181641, "uuid": "daf3cf37-bdc3-471c-94f8-64fe16a78956", "value": "T189432925AD792E26C0D8B57E11F78724F2F2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181641, "uuid": "d18208ac-bba3-4b8f-98e7-b9ec4e18232a", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDP:eL0AxvSHfymp0xgunvCkV6vTMDauw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181641, "uuid": "d43431fa-9aa9-4aa8-8d2a-fe1d240cdf62", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181641, "uuid": "6bc1ae2f-f7b8-4687-8e55-ebb52d998e8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181641, "uuid": "f083b838-bc9c-41c6-96bc-b3406f08531f", "value": "87sbhas6as.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5763cca1-c0e2-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791221378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221378, "uuid": "e1c971be-172c-4450-a540-8d0cd3727f99", "comment": "Malware payload (Mirai)", "value": "bc811e612ef9190fde67b2e8dbf127c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221378, "uuid": "7ae6b030-6299-492e-b626-1ab55c16f325", "comment": "Malware payload (Mirai)", "value": "4cb65e768b01a50d5ab2a2aaeeca1e8c6d8114fee3ef37cc558bd31425c243fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221378, "uuid": "d0ec59e4-2461-464b-8aa9-9abdc1a69d3e", "comment": "Malware payload (Mirai)", "value": "d0d4a88490566bc7934ea733062fd0d73149b6c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221378, "uuid": "7e8253c8-4b20-409c-a207-d034ab8dcf07", "comment": "Malware payload (Mirai)", "value": "559a4e72f98328449123d7c0cf3aacd9d70758f673872c603455c6fea927024cd3b07bc26f02062e7f95011a544be050", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221378, "uuid": "b59a7627-fbed-44fb-ad85-c5c33e4b7b16", "value": "T1FCE338DFDA2C07A7C49B59F0AD6723F78798A5B012A1D1C4A2CBEAC407726742121FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221378, "uuid": "c9a643a2-99bc-43fc-b5a3-1bd0e5d961a7", "value": "3072:OsvDnwrvlxpTw2usawSoiJ8IffZwoRRgpD4kBoZWDahhy5:OUnwTlxpTw2usawSFJ8IHZwvpD4kBoZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791221378, "uuid": "14b01f04-878e-4a44-b5bc-69ff39677624", "value": 143213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791221378, "uuid": "addbf1ac-bbc8-44be-ae02-00df08c0c6cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221378, "uuid": "9628cc77-bbcb-4b46-b74f-99780c58f74e", "value": "ext4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0a4237-c0ea-11f1-927a-4201ac107004", "comment": "Malware payload (RustyStealer)", "timestamp": 1791224845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224845, "uuid": "c612a0d4-485d-439e-91f0-0dc8fb1683ee", "comment": "Malware payload (RustyStealer)", "value": "d6e6b089da51d3662f052cb8f5f9436f", "object_relation": "md5", "Tag": [ { "name": "byovd", "colour": "#64844C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "winrig0-sys", "colour": "#FF9CD8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224845, "uuid": "69359460-f97c-4a77-b06a-f7f5a63e73cf", "comment": "Malware payload (RustyStealer)", "value": "4cecb0e41d53ccc73078d80dcac576b7b0905f37193693f9b41cf4eb6651fa85", "object_relation": "sha256", "Tag": [ { "name": "byovd", "colour": "#64844C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "winrig0-sys", "colour": "#FF9CD8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224845, "uuid": "d81dabd7-7840-4f34-8d2c-7c236b4080e7", "comment": "Malware payload (RustyStealer)", "value": "6e033b19aeeb926db0582c09536c5f89e63baf08", "object_relation": "sha1", "Tag": [ { "name": "byovd", "colour": "#64844C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "winrig0-sys", "colour": "#FF9CD8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224845, "uuid": "472688e8-abfb-460d-85fb-a2f8103598af", "comment": "Malware payload (RustyStealer)", "value": "0e9cc455029b4371ef95017bacebb212858ea7fec5357c2dd3f777bea155a7c4fabef19db14c3c82a34ea1f86c805c64", "object_relation": "sha3-384", "Tag": [ { "name": "byovd", "colour": "#64844C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "winrig0-sys", "colour": "#FF9CD8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224845, "uuid": "c36d3815-d67c-44a2-89c8-1d44cefbe1c3", "value": "T1B7A57D03F69580E8D1AEC478C3579637EA72B88D0A34B2EB6BD05B113E26F905F1D719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224845, "uuid": "adc307e9-63f9-48a0-a479-d0e2c9fe43fd", "value": "52f0125abb22bed46e3256a59bf46104", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224845, "uuid": "4929106f-a2a2-4977-9518-e96eff7657c1", "value": "49152:LqDVO9BKpUEBzXz96joLBNyhxRvNTYIU6iJ:p+pPZJA5n+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791224845, "uuid": "b737772b-a332-4c46-b8aa-20a9c9d68f35", "value": 2168320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791224845, "uuid": "cedf9299-8a68-4bcd-96e2-8e63bf2b9cb6", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224845, "uuid": "060410b4-23c1-47db-9ba4-fd9eb0c3bbd1", "value": "SecurityHealthService.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33af4fd4-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (ValleyRAT)", "timestamp": 1791190394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190394, "uuid": "873e8ec5-b0d2-4898-af08-281eca63f92b", "comment": "Malware payload (ValleyRAT)", "value": "5c9861c1c50e2aff2d29bb2a2aeebca9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190394, "uuid": "29e83d97-82a2-4940-b01a-8dffc54cb344", "comment": "Malware payload (ValleyRAT)", "value": "4d90ee2e0ceed931717be11b0ce7f4f634d3efc8ccc1ee63156c5573ecb054e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190394, "uuid": "7c8681e7-f959-4a8e-856e-497d4928f1f8", "comment": "Malware payload (ValleyRAT)", "value": "bf5df13161d95234a21efb1823c59d5adcdcd29e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190394, "uuid": "6a04edbd-9827-4866-8191-43d8a8914646", "comment": "Malware payload (ValleyRAT)", "value": "67a3dd084a9abb422a5eb59f12efd30e2bff7fe1f51955ffd2c9d80240318ec0097e54477d86aede76ab30cb4962d0ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190394, "uuid": "57bd0fa1-3776-4ca6-bc68-2fa50c8b7dbe", "value": "T19D26023BF28B753EE02A5A367AB6D110543B7A20A5024C169AECF48CCF755711E3E787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190394, "uuid": "e1fbf66e-c9be-4ceb-afb0-47f2c3f5cfee", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190394, "uuid": "b0e93eac-91e4-4293-9b16-2cf8da6a01b2", "value": "98304:R5OOAiPE2dHr8+siEARo4FqyiB5xFzX/gL7kBO5WIw0XDR6Pkt5:LxA2Vo+YAlFz4VXI3kG9t6Pkt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190394, "uuid": "7e709303-c698-4238-8510-6662e529512c", "value": 4612768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190394, "uuid": "ed9e0361-6866-4e0d-beff-295300f30c0b", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190394, "uuid": "3c8b340d-5bf0-4356-ae3f-f93945c797bb", "value": "5c9861c1c50e2aff2d29bb2a2aeebca9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff7c5f3-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185905, "uuid": "38b84087-c2d9-4ab5-a7ee-a99b5697feda", "comment": "Malware payload", "value": "8b09f8d62b841a0aebedf1eb3d8db4f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185905, "uuid": "7bfe0948-43e4-4b78-b3e7-0e919ad6507c", "comment": "Malware payload", "value": "4db5e2ca4e456a3d3a83e97eefbd3847e5d0bb65f187584b51da35660be78369", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185905, "uuid": "e877ffbd-1071-451d-87b9-bad5dc4c148e", "comment": "Malware payload", "value": "66532eb548b8c37dfc26fac08ae75796b2cbd83f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185905, "uuid": "496c664b-d7a8-4afe-8fa8-9be73cc5c57d", "comment": "Malware payload", "value": "b58d40cb27723ba973d2903f6b7abaab9004a34cd3a83a76f1b372882680ee116d5be5f01ef91f36f26c71c3013f284e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185905, "uuid": "98315314-aea0-4896-bfb7-93e576ca5c5b", "value": "T158E539C1E9A2D21EC63C3932DFD5EBD8B3396E74A6C0968EC9C8F33C09B31558166561", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185905, "uuid": "7d75b482-faae-4335-a605-47a9c716b79b", "value": "49152:kt7vPcs46eY56NTQgpPjMu7vi/5dB6/XZ:k7vP1xdB6fZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185905, "uuid": "e9b2d25e-9438-4755-8664-98cb20e9c2e1", "value": 3080318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185905, "uuid": "8d50d8a1-c9d8-4bcc-9acb-d6f2e9805981", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185905, "uuid": "a9dc20ce-01c8-4eb7-975f-4c60e8def450", "value": "bot.s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165e87c9-c0fc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791232436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232436, "uuid": "8b686c95-2776-44cb-ac6d-3dff721f472f", "comment": "Malware payload (Mirai)", "value": "2bf2f7760364215ac4d0d3f4c9a1f773", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232436, "uuid": "c48e1335-557d-4df0-94e0-7bdb88162e47", "comment": "Malware payload (Mirai)", "value": "4e2f9e081b75afb452538cc2ceee30fe59d80dd5ce0bc43dc2f90d05b21e2f38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232436, "uuid": "18aab19c-389a-476a-9a57-02d0584a9930", "comment": "Malware payload (Mirai)", "value": "01b5cf33414aa00a4ff2701efec31ea3ecd1da3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232436, "uuid": "cf681c4a-1952-46ba-87b3-7782ba883677", "comment": "Malware payload (Mirai)", "value": "743941d33fd2e52344020cee606f875936d34024480a68f6ec96891801c87dea580181c01e79a3691bc806d6f38bd04a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232436, "uuid": "9e3588b4-62ca-485b-8fe7-1e4e5fb6ec1a", "value": "T1CAC2E0A1E1B62D89F7796E602B75D2C077B04F9EB777CCD22559AF0804A321B0705BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232436, "uuid": "ce01534c-209e-49f6-bd60-5104c9495227", "value": "768:lG959yM0HWubJsWDYcGw/4uVcqgw09S0m:tM0HRJswYcGw/4u+qgw09S0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791232436, "uuid": "bd1fdf43-c84e-4a65-ad8e-7616d0ef4042", "value": 26232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791232436, "uuid": "a8d18453-779f-4cbd-95cf-ef49ff788692", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232436, "uuid": "ac75d082-39f3-45c1-9c08-d87fae2a61d2", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f1cb2d2-c0df-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791220049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220049, "uuid": "ba4ef6a4-635a-41dc-8de1-d94be83c3da8", "comment": "Malware payload", "value": "6c179cfcbbb597f1a2bc495b7d63ad5c", "object_relation": "md5", "Tag": [ { "name": "defendertamper", "colour": "#CF699B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220049, "uuid": "2716ee96-1de0-49b7-9166-290daac291d7", "comment": "Malware payload", "value": "4f0f247c52381946db19a74c3e7bb517b97b2cbb782f9774fb175709256a119c", "object_relation": "sha256", "Tag": [ { "name": "defendertamper", "colour": "#CF699B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220049, "uuid": "e25a50ce-4386-4350-a230-4d3ddcb29fbc", "comment": "Malware payload", "value": "78619acf94627e7c1299b7f4b388836eeb820ddc", "object_relation": "sha1", "Tag": [ { "name": "defendertamper", "colour": "#CF699B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220049, "uuid": "5ff4ee63-f54f-473a-8fc1-6ec6b6635aff", "comment": "Malware payload", "value": "e8a90b290b849aaa656581ee00f9eec4e19e877fe1fa49537a1f3151350b3009141de0dad85f85856d1cfbab153fba6e", "object_relation": "sha3-384", "Tag": [ { "name": "defendertamper", "colour": "#CF699B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220049, "uuid": "93926849-8a1e-42f3-9623-571ad2871612", "value": "T17848F01663E111AAD577D178C7AB6203EB72B40713308BDB329C43652F73AE45E7AB60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220049, "uuid": "b825f4c8-6293-4808-b1f8-62aa585c60ef", "value": "9eba512b03d8cac8a6c4424e25e9f06e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220049, "uuid": "82085a51-d782-4195-888c-391e44830a72", "value": "1572864:1Pp36F/iKRz+o0EL9uXpXFxAI/MZqNrGZVOc4XIoC3MnluZQrZ8:1PpIl+heuXpX/z/5NivOcC7hlTru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220049, "uuid": "831b89c7-e161-4189-8b2d-6be5e1c68890", "value": 117297258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220049, "uuid": "67be9840-5981-4d16-a931-f66e5cafbd71", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220049, "uuid": "b8d3cf43-92d7-4a1f-b1bb-a48dc7dbd2e1", "value": "4f0f247c52381946db19a74c3e7bb517b97b2cbb782f9774fb175709256a119c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb585e7c-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791216419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216419, "uuid": "957431cf-271c-45ec-a9ff-ae7971a0e658", "comment": "Malware payload", "value": "4847dba2ba1f13dbe438bad0bf89a674", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216419, "uuid": "9944b635-8278-4dd5-b6d8-c3a26bdb1c8c", "comment": "Malware payload", "value": "4fc7313fc7ab73062a7902289af09c80d7391c0493979e025ca76a8cb0b8bb8e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216419, "uuid": "d9e47357-d7e8-4a4f-b99c-bef1f6f684f1", "comment": "Malware payload", "value": "07bd6da7dad3b26fdbbd359abfbaca9496371af1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216419, "uuid": "b47b23b7-672d-4ec0-bbd4-765cca44ed4b", "comment": "Malware payload", "value": "3453873a6d9b1838e3f4cc4fcbe3eaab6808d2553c7d04378128bc56dc5907c16feb645f8e821356201368e1ea1ab581", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216419, "uuid": "6d343734-85c5-49e1-accf-f8eaa06cf93d", "value": "T18574296062B71E31E29D4AF794AD8080177AC23C9EBBFF25514F47BCAD03356A213D66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216419, "uuid": "565cfc44-b868-4cba-91ba-6d5b4b01b86f", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216419, "uuid": "69ac1a53-2270-405f-a06a-f8c74292392e", "value": "6144:gjx6WkhCpG1u6l4uYQ9paPe/j1TGllLpgCAu9N8NOTv/OTx:gjD8+VUpa2/5yNsuE0/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216419, "uuid": "02abfd8c-271f-4d66-996f-c82cc4d1a140", "value": 345601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216419, "uuid": "1bebd0cd-fe99-47ae-87d8-a54406128f04", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216419, "uuid": "5b02c9ef-2c09-4c37-905f-bf3c333adc70", "value": "Noogen.Validation_7.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3580dd97-c0be-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791205859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205859, "uuid": "26106f5a-6f9a-4a43-b261-9e8d0a7f7645", "comment": "Malware payload", "value": "76c54e302ce27e8b68b1ef74210b57c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205859, "uuid": "92160e3e-0116-4a9e-ac21-4f146cf67955", "comment": "Malware payload", "value": "505d5a72304ef44353175a0edfbb19f80c7721c6720d23e805572be09880d809", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205859, "uuid": "1a56e29e-b047-4ed2-b6a0-e18d840c7271", "comment": "Malware payload", "value": "5468db6b8623403fc75d2f38c0d0e652afcde1a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205859, "uuid": "9bad0953-f537-4007-b0f1-54c757e21dad", "comment": "Malware payload", "value": "65dd74198d14515e046d4105e52e16faba8c696d6f10c1d33f4bcf16083b96b5276548ddcb61d91ae2f77ec5e9435b21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205859, "uuid": "a5819c58-712f-4a8f-815c-543787bca79b", "value": "T1C4246C58B3A208F5EC738239C9935602E6727C151770DAEF03A0466AEF3F7D1563AB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205859, "uuid": "f9138ac7-2e0c-4b31-bac7-fc9af99a8783", "value": "3312ae96e2123e9bc97a5d11efac2934", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205859, "uuid": "16704ca2-8880-4bab-91f3-61d3fcbc7721", "value": "3072:8reR7l+9T2I7aCLVIbQpwThO+9uYHyGpVUwe9xu5i84huWW9xEmEhrlNjQqKirT:W+laSI1hwThO+vHZ3lABe9yZ6qnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791205859, "uuid": "7413a2b6-f7bb-427b-a1d6-5658aafbbca7", "value": 219870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791205859, "uuid": "cdf6a2f5-f15e-4665-91de-1b63ea31ba54", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205859, "uuid": "a153d35b-b1f0-4986-bb6e-660fb62421ab", "value": "505d5a72304ef44353175a0edfbb19f80c7721c6720d23e805572be09880d809", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4727e70-c052-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791159714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159714, "uuid": "454dc2d3-9550-4b28-9adf-c1656a29789b", "comment": "Malware payload (Mirai)", "value": "7d5f8599070210e6d747ad73db609ccc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159714, "uuid": "90538660-e4b8-4b03-a1c4-ba985e6d4202", "comment": "Malware payload (Mirai)", "value": "507611a45de2fa9f20c1e26e4274b655faf7f47cb2688a1782da25604a2e34c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159714, "uuid": "cd9d8376-36fa-49da-bb11-0b779326d588", "comment": "Malware payload (Mirai)", "value": "2f9ffa93c8a7b99a72cda7e99a9dfbf97b7e9b43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159714, "uuid": "5f6d4f90-69f9-43d0-b84b-0e5fe8f1745d", "comment": "Malware payload (Mirai)", "value": "8bcdc879ff75f2f109450f29c015e00cba8100ed44c6d34d493f7abe6687a30c9760fc34bcb6b4ef018bde6ce7364492", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791159714, "uuid": "26cc8128-7ca6-4e15-990b-7369d163b162", "value": "T1D1A45B82FC929B12C6D06AB6FABE91CC331317F4D2EF70169D245F24678A45A0F77A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791159714, "uuid": "5888d18b-ba7a-442e-9e53-916144ca2ad1", "value": "12288:zumFN+2J4BsFLJI90MnbdkkW32+Ut3GSHCr+uaKD2sPe9mNYvUwSwSrVUg:6N2SXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791159714, "uuid": "c3da8094-9007-4e96-8580-ca46a4e0a07b", "value": 467540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791159714, "uuid": "fca60845-1a99-4d8c-bc13-4e6a2f4beb9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791159714, "uuid": "caea3a7f-36e1-4388-be01-85da13d8e601", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617af64f-c0c1-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791207222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207222, "uuid": "0554aed9-4021-4c08-9f80-765261605938", "comment": "Malware payload (Formbook)", "value": "e7011edac362bacd77557b6dd2fcd6db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207222, "uuid": "59094e38-601f-40db-8f1b-effa6d8236d0", "comment": "Malware payload (Formbook)", "value": "50de568b3bd5bdc9855aa047713706d77238e8e7c0bb3aae94123fb8456b2cb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207222, "uuid": "edafdbec-aeb1-4fac-a809-f4df7ca7c923", "comment": "Malware payload (Formbook)", "value": "7628ffba21050a7614ca1cab629418cccf4660f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207222, "uuid": "5863d4df-14b7-4158-8ecf-56415411c40d", "comment": "Malware payload (Formbook)", "value": "b3394f1084a4a014f165ec2de88b20a814166b0bb4aed3117aa84faa6cdc426ede641b95b049429a2681d8e86b6bb844", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791207222, "uuid": "a0f6173e-dd48-4839-9991-5d6eeab73d56", "value": "T1DF05F158262FDD0BD4914BB40970F3B943A46FD8A520D3138EFEFEABB93960538542D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791207222, "uuid": "4e14af17-af65-49f8-bb81-e442d32e2818", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791207222, "uuid": "ae5dd87e-4d7d-415a-af7a-aa14f54b0aad", "value": "12288:3x7n4P02THeJfwNaqQES7vO6ZJwnEYzOcsLSYC50WCgX5LhuV7x3YJUHCllE:xiTsw8Y/W+nDeS3/ZhU7J/HCnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791207222, "uuid": "21ddf9b4-4640-44ca-936a-4fa68fd38dfd", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791207222, "uuid": "5022a378-3c86-4653-b30f-f1f6fffc3055", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791207222, "uuid": "761cacaa-1248-403e-9e80-ecac480946d8", "value": "QUOTATION_2543_FORMS.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0643bb5-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181692, "uuid": "8a28c807-d195-484f-baf5-12bd38aae418", "comment": "Malware payload (Mirai)", "value": "945d7ca194418214b9280753cdb1ce4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181692, "uuid": "cf02cfb3-6359-4298-8b5b-a6f23813bd70", "comment": "Malware payload (Mirai)", "value": "51f219390a9ff6c9f0f116875c3a8f53a60f148b5f49cb0796ac249d62db9778", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181692, "uuid": "58982d7e-d7f5-4764-a4c0-edcae5dc9921", "comment": "Malware payload (Mirai)", "value": "9d71cde3d619d0e0436ca147a19c3aac8d88dfcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181692, "uuid": "199d24c0-ec7c-496a-9bba-6818f1812c60", "comment": "Malware payload (Mirai)", "value": "930e53d7d17b6e4b08042300a16516d1829887a8696642cc1c28f450fce6d2ec288b3df1b4165d15993dd995e9b6a846", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181692, "uuid": "73591358-3e48-462c-b35f-a17eba87d843", "value": "T1CB53F11266A2EF67C360D876E97F974B4F5BC638BDE1389612080D28A57C4E386BF441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181692, "uuid": "98fcb3d6-167a-4f2f-a030-d9a6a75a75ef", "value": "1536:d7wYeST0GTgoY8Sg+y5AyUDtCM9eyLqGYC6:dUYVLTgoY8d+QA79eM36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181692, "uuid": "855a401e-c2d3-4d0e-8abe-34dfd04369f9", "value": 60716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181692, "uuid": "262c72fd-77cb-486a-89ae-37d46ebfaf71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181692, "uuid": "ea29f01e-f547-44f3-8cac-f27efffcb69c", "value": "wife.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb2ea30-c0e0-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791220585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220585, "uuid": "7eb1b407-3bb7-4089-9a79-807be3debe40", "comment": "Malware payload (Mirai)", "value": "1f13be71597767be61ad8a1e792abd25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220585, "uuid": "d9678676-8315-4771-bd5c-7a2b9ad652c4", "comment": "Malware payload (Mirai)", "value": "5210965738fc8e443d1b41f9ac0f26b324095cc228a0912799e8694f1788b09d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220585, "uuid": "d818e10a-902c-4a5f-9354-c89c5a23c4ff", "comment": "Malware payload (Mirai)", "value": "83671f401b06c8f4c4099641d610d4282a9f03b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220585, "uuid": "3a686de8-9fd4-4158-aeeb-47013cf07d16", "comment": "Malware payload (Mirai)", "value": "aec45a403a72e352c169b9ff8bbe846ff22c682d40383cb0a9ab4bc7dcf32560257da2371ba2653803af5712bd515f53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220585, "uuid": "f19bae65-d7b0-4e22-a283-be3dd38fd64c", "value": "T14BD328CFD8914EB6C155BA79E9A62433071EA431170FDA8660FBE6B4430F4DEB00E6E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220585, "uuid": "81841d00-15e5-4d9f-8380-4420d8011d13", "value": "3072:8Gwg+1h4jr3wKZT/NZAl8TL9RTAoxU557TjNaGrMiHDvBoZVSihhP5:W1h4jrTT88TLkoxWrNf1DvBoZVSihhP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220585, "uuid": "cf8a886e-6f06-4511-a4eb-bb1de40cccbf", "value": 139122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220585, "uuid": "285578af-73d5-4fae-9942-5193c0313e01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220585, "uuid": "a9503873-2179-4a7f-86ae-828f67306337", "value": "watchdogd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cdf62f3-c0a4-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791194812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791194812, "uuid": "8aca7d6f-f8cb-4a86-9b03-93f5c33300e4", "comment": "Malware payload", "value": "b1bb21896eaaddd9e2ffaa451b950c28", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791194812, "uuid": "1377d857-f13a-414e-932d-ad90bc0fada9", "comment": "Malware payload", "value": "53371084bb1f341b38bf20dca934710d9ab642890a50f599564096008cea8bf7", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791194812, "uuid": "cae2f5d5-4c75-430c-a97b-cc9f3cf133d9", "comment": "Malware payload", "value": "a867b0d0465c6daaaba59ca7e5217923fe1f0f27", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791194812, "uuid": "a6200a1b-fdc6-4a67-a1fe-2571ee96629c", "comment": "Malware payload", "value": "84a41983ab8f59f269dd3dd490638bad198db6a6589db092d17767f1f8302e1426a879504499f640dd1ce4a780540e1b", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791194812, "uuid": "18225862-fe84-47c1-9eb8-ee3f0afd2aea", "value": "T134C495A5F49E5C17032315BA1BCE472A2B5A49F6D0A0A943789E80E4DF5537DCFE2B0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791194812, "uuid": "a437ab46-ca6b-4ad9-b14e-694c5b8c86cc", "value": "12288:/4ArAMC68iyY8AXg8buBwGcON4pfS1PDj/Iu7aaBzpyhj6uE5BBVg9jXINKvFsQa:3Xg8buBwGctpfS1PDvpBzEuuE5Zg9jXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791194812, "uuid": "21888b53-23b6-45a3-8bc7-e299867648e9", "value": 552678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791194812, "uuid": "08da426f-0e1a-44c9-bcf2-51d76e323920", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791194812, "uuid": "e4d63b7e-d295-491b-bdbb-b6b11aaeb318", "value": "53371084bb1f341b38bf20dca934710d9ab642890a50f599564096008cea8bf7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c36cc2c-c0db-11f1-927a-4201ac107004", "comment": "Malware payload (SalatStealer)", "timestamp": 1791218433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218433, "uuid": "a0ce6cfe-d198-4d63-a3ab-5ff6179c55c2", "comment": "Malware payload (SalatStealer)", "value": "38f0046416e3fdf6af81b5b3326e2240", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218433, "uuid": "fbade720-530b-46ab-9318-904159af92bb", "comment": "Malware payload (SalatStealer)", "value": "5381889f657250a50a62c8a629ee825ad3249a1ecac97454bbf9f0f0f30e7d6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218433, "uuid": "cacc14a9-ff16-4b6c-9327-81b49b37202b", "comment": "Malware payload (SalatStealer)", "value": "e08985a27c82d06869335f776041db29b7bc92bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218433, "uuid": "69a2b1f2-9110-47b3-95ce-b20c1f5b78a4", "comment": "Malware payload (SalatStealer)", "value": "638ebc12e554871b8d52f65420586d266514bfe86c2ee028c4648795716f18a38f766d2eee126286d8396cbc0e55cec9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218433, "uuid": "893aabcf-eb65-4693-aaef-49a9f777a7ed", "value": "T181C65C11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6AF877691187A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218433, "uuid": "6201eabb-8f79-438e-aa4f-26c09d0b484f", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218433, "uuid": "e4e35494-354a-4950-a2b0-38e57c664517", "value": "49152:tsz32ksgc7q7ERu/S955V1XCcONN1Ft9ALrFirmYMduz7VWkP59h+PlBRXJAPzZG:a3Tsa/SrPRCfNTcytrLPD54CrEPO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218433, "uuid": "ed7c5475-99b8-4f15-9864-af8e6e28462e", "value": 12570112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218433, "uuid": "d02082be-a486-4195-b88a-9486ac421eef", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218433, "uuid": "ff6dad34-6aec-4885-ae09-4ae4fcc49b8c", "value": "FTcheck.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3cfa0f6-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791216433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216433, "uuid": "ff5e856e-eadf-4db9-9ca6-b10a57c7c2cb", "comment": "Malware payload", "value": "e2c0c47d04220b2483aca048ac5c82b6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216433, "uuid": "f32652c7-3007-4743-853a-d66ce0880ea4", "comment": "Malware payload", "value": "53caff59c3f97a8b642e5708f279c9e2af3447afe805e6637bf57b79558d3e0d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216433, "uuid": "8300d7d4-c394-470e-9f23-a53ecfffe6db", "comment": "Malware payload", "value": "31ba3e656c71d62d1769a0597dff0dd9a2c9dfae", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216433, "uuid": "dc6ad8b0-641e-445a-8ce8-1e0ddeda4dbd", "comment": "Malware payload", "value": "5e8c6697b787e072ca02e6582d5504f000b80925589b6519809c307bd11cefb98f7fea166e8d05d4d05356f5edb4ab57", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216433, "uuid": "b1b1de41-5ae1-4d15-ad2a-104e7abd1097", "value": "T197B49E6025B31F31E7994AF7D1AD818403BAD17C9EABFF2A541F06BC9C02356A323957", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216433, "uuid": "ba497494-fb40-4137-8adf-33adf20afdc2", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216433, "uuid": "d1a75a76-28e3-42dd-88cb-42f33b83166e", "value": "12288:hibxgFO2qtRbzwtSUi5WqqcQZ3RtviiO8PK:hiWFOp7zwtSnWqreRtv9PK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216433, "uuid": "e5e8f524-ced2-46df-9cd5-c7aa0471ae58", "value": 538625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216433, "uuid": "d651217b-6b90-4ce8-a210-f62e8f37f93e", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216433, "uuid": "0ec3650d-636a-4445-8dd9-f4ebf640340d", "value": "Noogen.Validation_8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5064b4a-c09e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791192303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192303, "uuid": "e2b418b4-3255-4f25-ac3a-26c969850768", "comment": "Malware payload", "value": "c0ba49016d72d19922330601dbbb1d5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192303, "uuid": "23f35f52-3f81-42ad-b59f-105668db4dc8", "comment": "Malware payload", "value": "53ec7db0631adc87e6cd114fd2845c1802c8d3049631a4eede74a614727724da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192303, "uuid": "f840bafe-77b7-42e5-9edd-b1a64bd08573", "comment": "Malware payload", "value": "4c911a75513fcad5dde74b564b68c86116e2d9d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192303, "uuid": "a0a68bef-9900-4d82-bfe6-38b4558eb3be", "comment": "Malware payload", "value": "9907481cb200306a1755f7c43154ffb5f5ec53f82517fd9d0f2dad7439f2ec8c634b28f479dca20502296e897fc6301e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192303, "uuid": "764ffb70-cb9c-499a-84b0-b553376c582f", "value": "T1B28623261E210C9EFDA68CF0C43673D66DA1CC5B17D4A929DE2BBD44332360E63D625B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192303, "uuid": "3d52feee-46b5-4ae9-9a33-8d08796c2a5c", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192303, "uuid": "fe545292-1ed1-437d-8116-fc26aed0cf21", "value": "196608:5HjAGXTFkxQQAFPquKiNAJQwo93lqfPN9l2yc9:5HZhDEuKiom3CRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791192303, "uuid": "f252d00c-4bfb-4e78-b453-fba6455e4363", "value": 7936568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791192303, "uuid": "4b6e5a98-28f7-4415-b17f-71ee0949e0ae", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192303, "uuid": "9033b89e-c309-4639-8dd5-77823246b6a7", "value": "53ec7db0631adc87.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a784b4d5-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791190589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190589, "uuid": "6fe60817-55ea-4bb0-9407-b47bdd7108ae", "comment": "Malware payload (Formbook)", "value": "b746c32e444f316fa8a56fba3fe7586c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190589, "uuid": "e5b1c12f-f5d0-48b9-a0d5-db1eebc1115d", "comment": "Malware payload (Formbook)", "value": "559e4d862c44df0c5ca92abfc350b2a7484eb3ed65440728e67a67c24e36f424", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190589, "uuid": "0e74b303-efc8-48a3-9a29-581585b87f6e", "comment": "Malware payload (Formbook)", "value": "abac1f1a5a158ad8d79e83b86643d5d522769bcc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190589, "uuid": "7ae27bc8-70e2-4013-a265-ba40070adcb0", "comment": "Malware payload (Formbook)", "value": "033112e2cd676d96274d9b60bbedd65005c9726e80b08e7895f000c27a3ec848af218a041c05e32ef5653b007a1255b4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190589, "uuid": "c679e138-8f7d-4cbf-8969-be1dd2a87eb1", "value": "T123230B444D85748423336B7ABA2AE4E5F7BB0A6B0194494BB87C7484EFB0D18DEE4DF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190589, "uuid": "2c2cd5f8-3d09-469c-9fe0-0a06255d7100", "value": "768:OoT6s0rdUEVDLCi3yRB7eeU4bl3A69euqtZvUJPT+E3UTcxDp9wThIuq1sd1R/e2:OpUEVDLrW7pP7+Ay70C00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190589, "uuid": "9aaf4b95-229c-4565-8a2b-0cf2e155975c", "value": 49619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190589, "uuid": "42c9fec5-3710-4bb9-9047-f1828c915930", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190589, "uuid": "c3d068fb-57ec-4c0f-87df-69cb6418405d", "value": "1C26TLL_00001453.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b9becf-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181622, "uuid": "ca225c19-7375-41ae-aaf3-fdea9126457e", "comment": "Malware payload (Mirai)", "value": "92f177071179f2546ab44ab4adc14799", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181622, "uuid": "8e1af4da-4558-4994-9d80-b9464b60f855", "comment": "Malware payload (Mirai)", "value": "560a760e402007886e946e6094ddd83442aa62974a907d4d2f2f6654e25321ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181622, "uuid": "53bd8653-6a33-48e2-9164-d25e2266d1c7", "comment": "Malware payload (Mirai)", "value": "30a6485f49785a7a3eafc89744d8f13fabdc2585", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181622, "uuid": "6f10f9ca-93a7-4c07-b7e3-b3e7077a951f", "comment": "Malware payload (Mirai)", "value": "51f2196f38bb3f6631aa5337747fad78ed99bc0f32f2ee1d00cb3645d27fc2929b7f19c15de4b5d995344586bbe4ce72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181622, "uuid": "629e1bf8-d271-4d5e-8adb-1fae79d668c0", "value": "T185935B22FA76192BC8D4A97621F30331F2F6478B25BCCA1ABD710D8DAF6465032577E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181622, "uuid": "0fd6debd-e54c-40ce-a8f9-71cdb80754f8", "value": "1536:45YLnQgcm7uCo9AgnsAPWnVJCxed0X23yt9lq5wJqTOYYpN3t6YcR/d:4aQgFuEgnnznl6wILl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181622, "uuid": "d01c7f13-a4f1-4ab5-b37d-fcf53ceed936", "value": 93872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181622, "uuid": "388173e7-5a18-4ab8-9a3d-f518dc8fc62a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181622, "uuid": "8bdc424d-cf0f-43e4-a70a-e60480b99626", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc9ca0a-c0bd-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791205766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205766, "uuid": "e2748504-f1c3-42f8-91ed-560ff3503c67", "comment": "Malware payload", "value": "f7d61bcc8cd780e354a844a1c3db9287", "object_relation": "md5", "Tag": [ { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205766, "uuid": "c1b7acbd-d1c4-4c67-b536-3f6fef10f804", "comment": "Malware payload", "value": "567f6c24ada59778362d5987681439bb34d0405d6ef4fd454aef92309b7da08d", "object_relation": "sha256", "Tag": [ { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205766, "uuid": "2189eeed-2e8a-492b-9134-b2cca299515d", "comment": "Malware payload", "value": "0c25b46a910c96fca03ee91ac9e793db07ff579d", "object_relation": "sha1", "Tag": [ { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205766, "uuid": "b8cb57d0-a076-4cd0-b3b1-8e340f3637ac", "comment": "Malware payload", "value": "1a4c21654302266987b52e8a6941754b4090aa4316f9854505543e9b6af1793fd0793019b473e3aadec734527f82ba04", "object_relation": "sha3-384", "Tag": [ { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205766, "uuid": "a4504b00-c02c-4e56-9962-39738a510f5f", "value": "T1F7F547249BF510D6F4BBDDDF4AAD9868EDFEB1205E4A202D10180B834FB1F52DC61A5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205766, "uuid": "aba2cebf-6357-4c7a-9a1f-707d0510d59d", "value": "1536:tIni3RzhgiNkhI3lHUbokQA4GGnjWb7EsXWeU3zX+wTuxtQbicRkLCkHvodaOUS2:mY+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791205766, "uuid": "7c6a59b0-6f9f-4505-bf94-ab5345135d3e", "value": 3647030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791205766, "uuid": "f7fc67f4-2267-4686-ac8f-fe62289202b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205766, "uuid": "3b760cb1-c71c-4243-817f-70bdce3d886e", "value": "567f6c24ada59778362d5987681439bb34d0405d6ef4fd454aef92309b7da08d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ad2964-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181652, "uuid": "7c5383d1-6297-49a9-86fb-fd71b7317d90", "comment": "Malware payload (Mirai)", "value": "236c39b58b216ddb49da77a54d9ce9f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181652, "uuid": "23820352-7f4e-4d41-b59a-9cc3752ca177", "comment": "Malware payload (Mirai)", "value": "56eb3c9a2dd27acefd919c517fa20c6b368723266bbb4fad0acec4d0839b9e16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181652, "uuid": "24d0c988-bf54-476b-b879-e569079f4337", "comment": "Malware payload (Mirai)", "value": "e6caa55a71f4cd0235158348b50c37c54afc866e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181652, "uuid": "b990b867-e04b-47c3-b5d1-8c0be670f189", "comment": "Malware payload (Mirai)", "value": "f12ef26ccddef3a69b9f175c24df92926c66bb46403f701235295963a9515e67d4bce7e95e7d4255fdeee156b85d7e6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181652, "uuid": "27cdf344-43f5-43cb-8916-24f1312543a5", "value": "T1D6D2F1016640FEE1C5B00232E8278A9B72253DB9C1D134FB973C0EF8A6E961D47F8A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181652, "uuid": "da479924-6ea9-4e2d-9724-30e69810ac7c", "value": "768:EusHfRavjynNKnjFcZIhQzhKMXg379q3UEL7S:WRwynNIOQQ1KMwKLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181652, "uuid": "36d3ed89-d5fd-4558-8b97-954700ab74e3", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181652, "uuid": "1ad9b650-0609-4fa6-81b3-2458d62a495b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181652, "uuid": "920301d6-3a84-4c9a-af47-f3f6dc8591ed", "value": "87sbhas6as.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea196200-c05e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791164931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164931, "uuid": "ac093bf6-15ad-4f83-b825-ccc4a8c45f3f", "comment": "Malware payload (Mirai)", "value": "b3e9c43289cc003764c029531818d427", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164931, "uuid": "c9af09f2-9525-461b-b2eb-1dc061de71ab", "comment": "Malware payload (Mirai)", "value": "5718c56f7378113dccb2e8aa3576a024f0f760127fd756fbfac239ee0c62c2a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164931, "uuid": "13f2c3c9-224b-403e-ac09-9e333d9bb890", "comment": "Malware payload (Mirai)", "value": "29ed4a22b779be05078e870a9e6dbdd1d6c1be37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164931, "uuid": "e6a8e783-7831-4673-8cf7-40ae4dd6f10d", "comment": "Malware payload (Mirai)", "value": "d71d512232a7c2707ad9fcffe55e518b2898d503437e7ebd914f7d25de6ca74b75c2bbfc2a6f9532182a3c12a2123df2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164931, "uuid": "2afcc6bf-94a9-4ab7-b348-7902f4f972de", "value": "T1BF73188578869A1AC6D0537BFA0E43CD372573C8E2CE3203CD619F6176CA92F1DAB191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164931, "uuid": "473e0a2b-9e48-4e87-8592-62ab32f6fcbc", "value": "768:w8XP/urX5fu5X8o27o3MoMPo+l5Zz70ba2cmGcwBJyxqLNIKmmIsqeknu1StVTXq:dXuZaGDFXUaxXlPywLWKggID/gP/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791164931, "uuid": "5191839b-4ce2-4cee-b11d-a80f6d94522e", "value": 74880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791164931, "uuid": "8e90084a-85e2-473b-81d6-2949078dfbd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164931, "uuid": "b9bcb904-3d56-4f35-b659-e3d70dd0dc9e", "value": "winki.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b843bb-c068-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791168896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791168896, "uuid": "819a17ef-63f3-4f1c-bbad-fd8ddc7f95d0", "comment": "Malware payload (Mirai)", "value": "39e06eab7a3278472831b788f6efdd3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791168896, "uuid": "5fa48a0a-4cce-4c86-a45d-f4ef06974333", "comment": "Malware payload (Mirai)", "value": "576fe0330127a7b33250efa3e0697928d4c515acf65bbe1d58fb87dd265b8462", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791168896, "uuid": "3af2390c-a456-496b-b72f-84073a4ed77e", "comment": "Malware payload (Mirai)", "value": "e4f8e4dcfcaad0f26059ac174e7e44299eb90ac9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791168896, "uuid": "53441092-fc5a-426d-aa31-1bd939c98c79", "comment": "Malware payload (Mirai)", "value": "2adfe49e0d843edf1a03d3c252a4e3f0693773b2d3fd8cc6de1244ad420e1bbc8b3666228d671430b5764adfb6e190ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791168896, "uuid": "1a9727e3-b12d-4f77-913c-9c9e5404509e", "value": "T1A2144957F1129E81F14206F4256DC7F03F12A5E723372CA1E9BB82F95B4389ABC15B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791168896, "uuid": "3d0e969b-7f28-4f27-8100-f72c0d16b47d", "value": "3072:vvxg2TRLEUbKvgXGeSUB/41WLBc8xOUq:32ARLEnvg2eSUp41Wi8xOUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791168896, "uuid": "79ebed8f-131e-4d07-9409-543de2364ba5", "value": 198456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791168896, "uuid": "911dd58b-2670-4b76-a014-9ef974416a04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791168896, "uuid": "f20e498a-ad82-4a73-ac40-b9e15c9a36de", "value": "576fe0330127a7b33250efa3e0697928d4c515acf65bbe1d58fb87dd265b8462.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e40b1368-c0e4-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791222473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791222473, "uuid": "ae94ae80-f00c-425d-ab75-04cb01531e0b", "comment": "Malware payload (Mirai)", "value": "0c0098c5e4cf0b9b6185d8210bade681", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791222473, "uuid": "9484861e-ab88-4ffc-aa24-c856786e4841", "comment": "Malware payload (Mirai)", "value": "57fe54e4926c37f30dc0ac7cde87851528d5e8876746421d40e64bd2adbb9f8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791222473, "uuid": "7639dc63-8132-43ca-bf9e-0e687cd45e03", "comment": "Malware payload (Mirai)", "value": "c63745fed3101a78e7a156d05decf98fcb6b0f34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791222473, "uuid": "e6771dfe-90ac-47e0-bec4-7dce26c94e8f", "comment": "Malware payload (Mirai)", "value": "2c8e64ee9d67dcc3d88fddca43dd3503c8a65f0c697e9907a8e261c7e34c3e0b523ccaeeaba6946dcba29f8c1340641b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791222473, "uuid": "d93954a8-6964-4bf1-8876-371bd795c34d", "value": "T1C6053A076F509DF7C86BCD3306B5CB2624CCB4C332A53B6A7678DA48BD1960B56938B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791222473, "uuid": "d87e89f5-3042-4049-84a0-9e02620cfe99", "value": "6144:FNa7uMZoGlCSnu9zaXSaHp2lccR/8Bm1s+veXXe3WIYZ7HECneDb96h8H9r:nxKCSnuNaXLksVOGTjReb9C8Hx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791222473, "uuid": "3e20c11e-e86a-4aac-9cab-c5b50ac945f0", "value": 858228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791222473, "uuid": "c84f3b7f-04ee-402c-9761-67ec9cbd664c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791222473, "uuid": "3a9c491a-d919-4577-b094-e0b2c40b0a9b", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f04deb3-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218921, "uuid": "6e454392-d5bb-4d90-a5d0-908cb3a44b64", "comment": "Malware payload (Mirai)", "value": "1374d9f542062494695e7a599d45d0dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218921, "uuid": "529e1d4a-2257-42ee-9f25-9700b5de22e7", "comment": "Malware payload (Mirai)", "value": "58af92ea0cc6475978a1d9762a26e3966e3ea36382ab6ddab30442774dd99bb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218921, "uuid": "78fdabd3-e46b-4c42-8526-db733dfc0773", "comment": "Malware payload (Mirai)", "value": "0a7167e0a1a982767d1f1e28b28e1e13fc3e331f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218921, "uuid": "8edb2b32-fe08-4000-acd1-c068b08ad3ea", "comment": "Malware payload (Mirai)", "value": "dc701692d76d0b613b2443694a100e6ad92a65aa67c87a97f087fcbd7c6f57647493b414293009eab606e47bfd51dda6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218921, "uuid": "06b602ad-b3a5-41f3-a346-1571cdfee203", "value": "T130343956F8815F12D5C016BABA3D518E33131778E3DF72129E24AF64778A87B0E3BA05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218921, "uuid": "c389d7d3-775a-4d27-9af9-5af6b08559fe", "value": "6144:a03dd2y0ozQPw7XjegvXMNafkNjNQUdU:n3dQzoP7XygvX2asjNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218921, "uuid": "e637fb25-c566-4b6c-a88c-849a923a1bac", "value": 244572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218921, "uuid": "b3c1d853-a77d-4b9d-9bba-7eaeb0792083", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218921, "uuid": "a1686c9a-e393-4eea-a7a7-b83c85ec8ea4", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c63678-c10e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791240401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791240401, "uuid": "68bd8ef3-c62c-4507-9ed0-91fe9c2af3be", "comment": "Malware payload", "value": "4233ace020dcbf7e1204dc2101d3c155", "object_relation": "md5", "Tag": [ { "name": "579cd0", "colour": "#2C4032", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791240401, "uuid": "2c87a8a2-55e8-4078-a3ad-5fe9bc9ad724", "comment": "Malware payload", "value": "590ab5582e6a308af953a36e8cdad1f823d12b8f4a1c2181ce077450c8627942", "object_relation": "sha256", "Tag": [ { "name": "579cd0", "colour": "#2C4032", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791240401, "uuid": "bda63e3d-eb09-4d2e-b8ec-38a57e11de9d", "comment": "Malware payload", "value": "cc70376fda872305d2aebe86c4cb5aab0961d8a7", "object_relation": "sha1", "Tag": [ { "name": "579cd0", "colour": "#2C4032", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791240401, "uuid": "fcc4decf-5e64-4900-b401-018f2801d75d", "comment": "Malware payload", "value": "c3f921199f7274976a89029baeb028adb266b4d757e75e72e24acf300a4bca3f6abbaffb1977d9c97e736fc0d9f3ceec", "object_relation": "sha3-384", "Tag": [ { "name": "579cd0", "colour": "#2C4032", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791240401, "uuid": "e9d12f02-8b6b-43f4-9bb4-24062f981777", "value": "T19C447B1972A90CF8EDB7813DC9525A46E772B8160771DAEF03A0426B5F236D09D3FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791240401, "uuid": "2b9b05ee-b348-4f80-ac91-82ce36617baf", "value": "006572e9009ec6d03cc9f702cce285da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791240401, "uuid": "b767ce84-7465-40af-b101-51bf11917c4b", "value": "6144:2Wy29/imQo0iTp9rUQNQd/yEswUh8JohVsgSH:Ve9KpOuSy2oC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791240401, "uuid": "1521fc42-3c7a-4022-b9fd-811eec41c6e4", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791240401, "uuid": "9b3f8633-3984-428b-bd71-feda421fca43", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791240401, "uuid": "5deb8f3a-0da3-42f9-86bc-8a2e1cf424d3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3926a334-c09f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791192551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192551, "uuid": "46d56fc1-5fb4-4896-aebe-21e2a503f16d", "comment": "Malware payload", "value": "5c7a42ba06acab5297e510ea2b6971a0", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192551, "uuid": "5f6a3f74-a9cd-4f25-b824-59fe2397901a", "comment": "Malware payload", "value": "598d4275943265e6d53955ebc55d7fe2cb5d2633d4c3cbd31fc5ec31245c1075", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192551, "uuid": "6b7d91d8-d73b-4e8a-b604-28e8619e3478", "comment": "Malware payload", "value": "19208133a21266653a33a0740b33072a10539c43", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192551, "uuid": "bc14357a-29e5-4c1a-b2c5-54f34abd9381", "comment": "Malware payload", "value": "6cd86b2e2574a851b05533df73e8a34346953b65db609fb5a4831a22af212da55ca5abf4a3e2c6828c75eb8102f1b98a", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192551, "uuid": "621a4697-3d57-42fe-83dd-4766b057579a", "value": "T1A9A4232430C0DC67D1BB89BD88E4C213B11AFC969FE72C07B24B335F4A376954A5B969", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192551, "uuid": "b56cba78-c2e8-4ff4-8585-d8701f55dfac", "value": "6144:A+MWp/gRH8oCM/xV19jpULb6zWp5chJymus37JeMoYXq6gHRUm16/hVmMOzTKvgX:tp/6Hf32gWb/mjJeM1Xq6gHKRSMZgZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791192551, "uuid": "1ee3a6db-14f3-4ce9-9a2e-e66345b520a5", "value": 455680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791192551, "uuid": "3820f1bb-c4e4-4d98-80a0-4ef92b935c70", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192551, "uuid": "e88dd7c0-e486-4a14-bedc-64552761916f", "value": "RFQ SP -0202109-26.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516d281f-c111-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791241554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791241554, "uuid": "ed0d85c4-e04d-4264-a351-287cf05a7524", "comment": "Malware payload", "value": "40d5034d249ea34062421ee2d65d7e50", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791241554, "uuid": "5d21b56d-926a-4b7d-95f0-06a637181b6d", "comment": "Malware payload", "value": "59d730d6904629c9c30560cc5b94b52e97684683416955e7a3bf88ebcf5854fc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791241554, "uuid": "5037bf74-91ce-48da-b39f-62d801508292", "comment": "Malware payload", "value": "8ce5e9aab75af5946778db725106b74d27ed159f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791241554, "uuid": "517f5e5f-999f-4a97-bafa-179ace4f6625", "comment": "Malware payload", "value": "85720fc0f38b207a1270149f877205e4bb86e4531d9ac13800235599a386c5c07ea58b757109eb89f78eef2577b0feae", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791241554, "uuid": "de70e1ce-8141-46a0-8407-0d21692f5516", "value": "T128B1C18A2478D63CA47FDDACB9E54740988D45E232B23F39AEB028531CC9970B359F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791241554, "uuid": "5dc05658-63ce-47c6-b360-9622d4c9dc24", "value": "96:ODpl/8HvLiPLxF6eAN3xodPYjLy+6Fnh4iQ/dtSbBmLoTQ//iVXrINFL4Nxuxfdr:Il/8HvLiPLxF6eAN3xodPYjLy+6Fnh41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791241554, "uuid": "71757de1-24de-45c5-a6bb-e84cca577f6a", "value": 5244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791241554, "uuid": "df5eb245-d31e-42da-afa2-780dd39b006e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791241554, "uuid": "d66691f7-d04e-4094-9719-973ca805a4a2", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a6673e-c0e1-11f1-927a-4201ac107004", "comment": "Malware payload (NetSupport)", "timestamp": 1791221006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221006, "uuid": "20585c53-e12a-4639-aa0d-13d6fab3cf2d", "comment": "Malware payload (NetSupport)", "value": "f5de4827c9c3a85418939a3111dcfe4c", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221006, "uuid": "debfd612-8e37-4cce-a780-85cf93c9b072", "comment": "Malware payload (NetSupport)", "value": "5a9501fc85fb65db7f2afc288d3e1853c6a098bc7149f51fc01bb3b65ddadee6", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221006, "uuid": "e20447a9-a0f3-4433-bad0-7315657d5804", "comment": "Malware payload (NetSupport)", "value": "6c6fdff54973ebdb305446650d92d9e55415c45c", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221006, "uuid": "0db25396-2b18-4ca5-8401-5238a3fe2cda", "comment": "Malware payload (NetSupport)", "value": "f51a3c8a26cb401053824f036114515c8dc41117c1f7fd5aeeac222391f503e34387b13c452427613a64fa7b8f44f5eb", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221006, "uuid": "0b003a82-12c3-4d6b-8312-d64e04227dd3", "value": "T146F53397B5815FF1C62EF4709CBA560904392F528B24A8E37754B30837FB6B43A722D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221006, "uuid": "75ddbd7e-503c-473c-823b-928408a93ffd", "value": "98304:zR5ysZz1CF8FhVrv2peNw7boU7E3gfFM33t5M2Fgw:zmsh1aMVrv2cwQH3txFgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791221006, "uuid": "f021f8b3-3763-4660-ba93-ef2d167ff08d", "value": 3620352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791221006, "uuid": "1ae057c9-b449-472a-ba76-047b5c78eb04", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221006, "uuid": "0bd6e6b8-b935-4bc9-b31a-ef54deaa8fb5", "value": "quickb.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9289ad-c0fc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791232477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232477, "uuid": "79933d9e-6b39-4c37-8534-16008641108f", "comment": "Malware payload (Mirai)", "value": "9044d057fc85cfc4f0f14b525f4c5cf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232477, "uuid": "57e33af0-cb56-4fae-a8a4-c7c4861cad2f", "comment": "Malware payload (Mirai)", "value": "5a9e384d35ecfb3a9d982c2e6e9abbf3d66e5d2108008a2db5bb22ce70abf846", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232477, "uuid": "a08056c6-b7b3-4200-8200-02361e2acd16", "comment": "Malware payload (Mirai)", "value": "678c2ac27e353ecdd97e0d884ea1f6a8ba56aaa2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232477, "uuid": "4f6c27bf-28c8-49fd-8af0-24b612c91c93", "comment": "Malware payload (Mirai)", "value": "2162a19c0480fa1ea3a6598faf770925de4de81fc62228108dbb8e096f889b50ef97c40d98336e43a6b686e4c4a3e1d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232477, "uuid": "29643884-9fc3-41ef-98b7-54dc11464649", "value": "T1F783C6297E218FBEF79D823947B78F22964837C637E1D581D15CDA005E7028E641BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232477, "uuid": "ff6a7bd0-130b-4763-a291-86d833f52af8", "value": "1536:E6/iw/0w8HoQ5uy8NxqlcJ0vXxh11xYqcn6BZOpkMoASgR:x/8RHTgMcJ0fmqJZOpkM/pR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791232477, "uuid": "f852db72-e080-47e4-8d38-7dd14d920b59", "value": 85312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791232477, "uuid": "799b1532-53dc-406d-98c8-5517e6f47d79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232477, "uuid": "e3815d9e-9392-4a8b-89d7-589e2da0d2ef", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecdd9634-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791216475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216475, "uuid": "11afcbcd-2637-4140-90d7-cbd6db8fceb6", "comment": "Malware payload (Formbook)", "value": "822086e8cca3a86d1845e0c86cc249a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216475, "uuid": "b44f7200-6e56-4a28-841b-7062a608f94c", "comment": "Malware payload (Formbook)", "value": "5d010b50c9cfd89d091aa90acf4b1ffc8f1659e89d1993dd54f76498fed3cf67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216475, "uuid": "8699443f-d6da-4f70-8ec0-f563e204dd49", "comment": "Malware payload (Formbook)", "value": "5441f2790a3efc2769c3fd84ccce8ed773427b8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216475, "uuid": "8b4128f6-002c-4da2-b6c8-115cbc335885", "comment": "Malware payload (Formbook)", "value": "51fb211fde4ec1049bec0e3a83282175694f338a0dfbe14dc04810344afa4c5fceb1d179e319c20b688b9dd99f18e554", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216475, "uuid": "41f6169e-9b36-443b-92d2-6f0fa45383d8", "value": "T14B542317D1E304D6F6B5257EB92B420210EC8A38057E6FA372E467092210F96797E9FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216475, "uuid": "c84de36d-4a2a-487b-940c-68f93748ffb5", "value": "6144:I0jd90Q6PCQZLE/0voYJu0sCYZCfO6VuOSblLTh29N3+qid8LRc0:39PGCQU3WYOulL12zEeRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216475, "uuid": "3dd47c50-919c-4aaf-a5fb-2e82319f73a5", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216475, "uuid": "d10f0691-1ef9-405a-8291-ae3ae3452a96", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216475, "uuid": "93e1ca74-777b-4f38-8312-2276a4597b81", "value": "Probable_Formbook_2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3111b9a7-c0fc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791232481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232481, "uuid": "db61db0c-872b-41a6-a533-a14c5a764e88", "comment": "Malware payload (Mirai)", "value": "154d0894ec1a0cc3fb3c7bb4547350d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232481, "uuid": "cb01a291-d70f-4421-95de-ad986307f6a9", "comment": "Malware payload (Mirai)", "value": "5e1328970673de87a853b7a4bcafd23ddf88f35e1c312d0e3657b3779aa5d3be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232481, "uuid": "d3e55d44-1cb6-4bd6-9a40-7840a6ddc4ad", "comment": "Malware payload (Mirai)", "value": "531ced708cf2593b5cbcfa644b02877d8aebb27b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232481, "uuid": "e2df3994-3c0f-4c96-8a3a-d51c3f1f3136", "comment": "Malware payload (Mirai)", "value": "8ed5a8093185677a3d08a0e906296f285eb5ae4ede8e9551faf9aa6b579c88ab12756cdd95df3c3a55daa3f08befd6ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232481, "uuid": "323f65a0-b09a-4933-896a-aedfcecb6135", "value": "T10F730A85B9819B25C6D513BBF91F018E331657E8E3DE72129D201B607BCA91B0E27E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232481, "uuid": "b273dfaa-6dee-40d6-8e53-4e4e733463c3", "value": "1536:q9KnGSGYfkiu/ZwQNCJEHQXglNU6bO3d5yAMw1f91uwcWIWinluUsPMrQ:CEkiUZJNZHKMNU6ba4XwtsluUsPMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791232481, "uuid": "aeffea4c-fd6a-4a95-b39c-f807df4dc318", "value": 79764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791232481, "uuid": "688ae560-444f-4c1a-af06-46fade648aad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232481, "uuid": "6d680ff2-9a08-49e0-8157-f5dc39d6cdd3", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3019b2b7-c08e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185235, "uuid": "0b455042-b01a-441c-888e-8409b7b3be62", "comment": "Malware payload", "value": "eb6bd1577cd977385032608fefc9b563", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185235, "uuid": "7585ac16-d8e0-41e3-bf62-c17cc305bce0", "comment": "Malware payload", "value": "5e31d02d1c652d31d51b9a8e7344fe95e7188480771957351e937bfc916641c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185235, "uuid": "d0d2fa93-cb79-45b3-8736-3f5858978cc9", "comment": "Malware payload", "value": "9a5a9b957f5fc7071a6a8d8f1fb476db64a68f96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185235, "uuid": "24631c9e-dea8-47b1-822a-9609030a2c72", "comment": "Malware payload", "value": "28b66956d9ea1c74c8bd5ba7a4866b9e266b1b4e43678333a9fa1fce6cd4eb53257ac84b0946aa19b9740637eb1e9332", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185235, "uuid": "8c48339d-ea77-41ea-bc49-eb756a8978e3", "value": "T1E252D1C0C1B7092ED1A7C2F45E84D844725B9BFAA441D5AFD25DF47644E48FE2C2870C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185235, "uuid": "25550c97-2b7c-422d-a387-c09a44708ba5", "value": "384:m3Lq+syj0w+rg7fh5+LT8BOM5OAJ/leMriCIR7ip:m3Lq+sg6rgzQ8BOMIAzVQR7ip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185235, "uuid": "38df7b26-3c25-4c07-8dd5-968574665494", "value": 14480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185235, "uuid": "5106ee61-20db-4321-b8cb-b43dfa33c222", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185235, "uuid": "ed71004c-544e-47ba-be23-f21e5c637cc2", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f22bfd-c0b5-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791201996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791201996, "uuid": "0b0ef44f-edcc-43c1-ae92-aee2bbee0ae4", "comment": "Malware payload (Gafgyt)", "value": "3781e0ca381bc36bbaf42be62248892a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791201996, "uuid": "01153f26-dd1e-46dd-a812-25e94e86256a", "comment": "Malware payload (Gafgyt)", "value": "5e8bfc03ba47d1c00643f4ccb7d8b7a3dafcbb180d15248e74e095f205b922c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791201996, "uuid": "45ae9796-4aa3-43a8-a2c2-05ec1a043f93", "comment": "Malware payload (Gafgyt)", "value": "ffad6024a6bd845b6c025bd3b4e7bf1df2b2ee75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791201996, "uuid": "34cc8dea-0ca7-4192-b9c9-429556e6cb26", "comment": "Malware payload (Gafgyt)", "value": "1347d6b3417bad58d34ee2f214334f9366739d5c6e1b8a736c062bcbed764891331380e5d4b2837c921d3b1b41ddd163", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791201996, "uuid": "b3fa268b-8b49-410c-acec-2d03d7f9167b", "value": "T149644B05EA408F5BC1D11779FB5E428E33339F68D3DB73029A24AAB43BC6BAD1D29115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791201996, "uuid": "5405f0f3-91d2-4357-9c98-b70f639626db", "value": "6144:L2fyMUm52lBXCZzAaOcx1iyAmye/VGNj6cCQ4lmyz2c4yZGVvmxUNt:L+oXiAaO6ZAmyechd4lmyz2c4yIVvmx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791201996, "uuid": "7f6a19e0-2576-4614-a2ba-736e1a66f5d9", "value": 308216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791201996, "uuid": "48d63536-60f0-44d2-9e3f-a9658b9ff066", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791201996, "uuid": "ea1eff11-d046-4e5f-83a9-940a945c6250", "value": "dissarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996c5a7c-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181975, "uuid": "43ed56d6-6243-492a-9f04-282cf5419c6f", "comment": "Malware payload (Mirai)", "value": "2c23d923f08091547e5e09f2f892711d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181975, "uuid": "122f4c66-1ac9-4f57-947a-04faed3aaf08", "comment": "Malware payload (Mirai)", "value": "5eb74bf311c13853769ebe3aced3d6afd2804796947670f1915d8a5dea7d9869", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181975, "uuid": "979c5246-64b3-4af6-99f2-ac8a0a286792", "comment": "Malware payload (Mirai)", "value": "720772895a87c6c73ebfca30ba26de37c0fac651", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181975, "uuid": "46a0be88-3ee1-4239-8a9c-110ec486b23d", "comment": "Malware payload (Mirai)", "value": "6c9d998371e6cacb09115f57946045ed2a998fd0e168a201086d68fd55cc563226c298f3fb2789e438007a5f6b8878dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181975, "uuid": "18061ab6-2248-4b99-879f-5ace26b5d708", "value": "T19BC2E1DFF49A3985C91C5CBC258C56D116A9A2C3234B9F0837202DCCB6B645FF89C8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181975, "uuid": "613941ed-e016-453c-9521-739e676da29d", "value": "768:MLCUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdB2W+:oCrJgHiOJrfwmQrctC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181975, "uuid": "6edb1eb5-0099-45ae-b9dc-e82b8c78ecc4", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181975, "uuid": "b72e41cc-4f0e-4583-9e97-5d7da29d1ee8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181975, "uuid": "3edcf30f-69dc-4d28-8220-9dfa347027a3", "value": "87sbhas6as.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72888c40-c0c1-11f1-927a-4201ac107004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1791207250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207250, "uuid": "fa91ebc1-81f5-476e-b9b1-efd08514fc64", "comment": "Malware payload (AsyncRAT)", "value": "385dcaaba75b0953a5108277521cd830", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207250, "uuid": "1e2dba04-df1a-4001-b8ac-88ea25c5b953", "comment": "Malware payload (AsyncRAT)", "value": "5f12438f708cb1b78262307a5357870c3915a9397872e7fb8166c60ab58ea3ea", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207250, "uuid": "aee712c3-e24d-4c0a-b75c-7e5792cb930f", "comment": "Malware payload (AsyncRAT)", "value": "abe5d93566b6604a0ece61414fda0613dd6b6bed", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207250, "uuid": "d8f1c46f-6def-4f39-b8ba-eaf3e174900b", "comment": "Malware payload (AsyncRAT)", "value": "ceaa5b778db0fb39f294fee93d3d250eef5d4b853099c1ec194ec5c31dc16e40f8f0f444aa4670408b3f0ea0e6464efb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791207250, "uuid": "89bfe9b2-b4d1-4122-9119-85c30ec969d1", "value": "T1DB234D0037E9C12BF2BE5F7899F27245867AF6673602D64E1CC401DB5623BC29A425FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791207250, "uuid": "5454c19f-2f23-4f72-9d12-f93913f32e8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791207250, "uuid": "ac1f7579-7707-4028-ad14-ecbe59e5bb08", "value": "768:guwpFTAY3IQWUe9jqmo2qLu2uVkHT9PIKblANB0bexiuQNiIl1ucBDZQx:guwpFTA4/2f2zHT68l0WbeIZiG1u6dQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791207250, "uuid": "f205826c-7c97-4b78-9414-363f2595ea26", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791207250, "uuid": "aa094d17-cafb-4aba-8fa3-4d7ff6ecca34", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791207250, "uuid": "b31bcfd4-86eb-40c4-906b-12501f424a7c", "value": "5f12438f708cb1b78262307a5357870c3915a9397872e7fb8166c60ab58ea3ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae78b53c-c0e8-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791224101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224101, "uuid": "83ea0e68-298a-412d-820c-cb477172f308", "comment": "Malware payload (Mirai)", "value": "f4d296cc3499ee98611c256595d21660", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224101, "uuid": "a427bd30-ee49-4acc-a0a3-54913fd23101", "comment": "Malware payload (Mirai)", "value": "5fdaa36b835482b95d7cfd5cb414376d48e92cf1f5657d6b2e59c1872073785d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224101, "uuid": "a94d880b-91c8-4e65-8615-0df5122ff114", "comment": "Malware payload (Mirai)", "value": "7a14adb5f1b7efc50f693cb58a9312338a22af8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224101, "uuid": "d03a1f9b-9c45-465e-9f05-4c6f74ad69ab", "comment": "Malware payload (Mirai)", "value": "d6ee7ef90a3b85164108568ba81dacd7dfeb92a0ad17ed2c2e23f702d4dc371ae06e8b5a767ec8a2977e9cd17a1e06f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224101, "uuid": "8a4f654b-96d9-4ced-ada4-9ae078af4cae", "value": "T1A36312AC831C49B8D1CA487F1496CC8AB991DC078661D6C35F81BFFA611E8D502BAFDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224101, "uuid": "ddf5d602-ea34-4272-8da0-4046720dd24f", "value": "1536:xMEWA3m3a+uNzyFTSblYyBABSH3AGd9w2xrPA:xMEWUm7goTECyBCSLd93xrPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791224101, "uuid": "93a93003-0763-4dde-a604-7bafc652b450", "value": 71564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791224101, "uuid": "652d09f2-8655-4289-95ac-9e7f2d96b7fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224101, "uuid": "f8cee928-be83-4698-81f0-8509a1616e99", "value": "xnxnxnxnxnxnxnxnpowerpc440fpxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7741a24-c0e8-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791224116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224116, "uuid": "5a188004-4664-4337-b7d7-f0ccb6be85cf", "comment": "Malware payload (Gafgyt)", "value": "b6f28068dc74cd953bda1d75f8ab6e05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224116, "uuid": "39355f84-de62-4398-8045-3229030df2c7", "comment": "Malware payload (Gafgyt)", "value": "603afdd045f84118bf5de847af269a52a2234f184ac6ead42f8a251813b980a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224116, "uuid": "bf787ada-17fa-460b-a38a-79d3a823ad8f", "comment": "Malware payload (Gafgyt)", "value": "93d57835ecf1af6c3aab9d96f3215ac25815ec97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224116, "uuid": "1521935c-7fb1-4efd-b2b0-51c5666141dc", "comment": "Malware payload (Gafgyt)", "value": "9ae2556937efbbde7d4c9250c5f9fc4243cbfc6da5d82f0491031e79a3f2e216e599b714dcd0fec6350dc44f662f1997", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224116, "uuid": "14993ea1-ebd2-4032-932f-7277c6af245c", "value": "T16873021C2389EE47AE3D83359D695188705BD8F1FACD7C0B8A50DE8D0B7A78C44267C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224116, "uuid": "fb041e0b-80e1-4a83-a579-8eb2454401d9", "value": "1536:oUXbf4V3/56KPaBgVowZO28rSFEg/vMU8r37EfTMUpueH6:1ux6vBgOwA28OxkhrYTMfw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791224116, "uuid": "7bf5ddfc-f62f-4123-a32b-ae902b310523", "value": 76860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791224116, "uuid": "9c81811f-11c7-491e-bf1a-b522a8ecac88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224116, "uuid": "955816bf-f9d5-4083-8794-d5cb47f28e4b", "value": "xnxnxnxnxnxnxnxnarmv6lxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f39a83a-c089-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791183086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791183086, "uuid": "8d0cbdde-8dd4-4449-b932-54aaa0083645", "comment": "Malware payload (Mirai)", "value": "d7529ac69bf64d91a45dde7068b8f0db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791183086, "uuid": "8deb41a4-d420-4586-aa3d-c84f2767fcd1", "comment": "Malware payload (Mirai)", "value": "6042692fe287bad031e574712f81c41ff464e306e579d20d9f6c4c75c9202169", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791183086, "uuid": "59e77c97-39b0-4ec0-a292-556a1343cc07", "comment": "Malware payload (Mirai)", "value": "b0908634b267588db81e41b745a83a8b2ab54fdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791183086, "uuid": "f9c6d623-44c9-4451-87a9-6334c30a0fc3", "comment": "Malware payload (Mirai)", "value": "cd2374f477003ddb707f99ccfd0e37f80b25ebba809fd095a31a2615217823bbb3d6bdc63bdd4f1791769f419827d9ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791183086, "uuid": "d124c8e8-7792-4e2e-9b26-adad70ab88df", "value": "T17A541908FE408B5BC5E137B9FB8F424A33339B58A7E7B3069A245BB437C6B595E25101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791183086, "uuid": "40c065f8-9469-4451-9e1b-059e1fbe850a", "value": "6144:u0xIeOWoNL+hkp0P9Ta2Mnz+E52sSHG370rMDiISJV/Gy2Cmc28gvIgS:hGCY0P9Ta2q+E5dl370rMS/FmcFgvIgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791183086, "uuid": "ae8d56bf-e347-4730-8566-2fe2b5fc0fc8", "value": 280325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791183086, "uuid": "8d5bd52f-d81b-406e-a24e-e5c8fb625be5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791183086, "uuid": "3504e932-3a90-4052-b9a3-300a902ecbb8", "value": "dissarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3c4539-c0a5-11f1-927a-4201ac107004", "comment": "Malware payload (NetSupport)", "timestamp": 1791195268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791195268, "uuid": "3fb19cad-77cb-46dd-974c-6a5e99b11330", "comment": "Malware payload (NetSupport)", "value": "07dedb76dbc6b034435227224e2066f9", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791195268, "uuid": "92b2f265-86ab-4e2f-be69-f84674d9e6fd", "comment": "Malware payload (NetSupport)", "value": "60490b084bf209e4d3ac1c071c3168da2e17af7ea7c6b8f046fc9b37294e2c95", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791195268, "uuid": "58789247-3508-4476-b308-ca048523e323", "comment": "Malware payload (NetSupport)", "value": "abd4025960b782fef46137c3fd8bfe908e2c58d5", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791195268, "uuid": "ad4b43b9-45e8-4a57-aa89-f36276d4c4b7", "comment": "Malware payload (NetSupport)", "value": "ad03a2b4506a08458f77af90d8ead0aaacd9edf2eb320da47371a5036ec9261a69cea1219ef1133f81596b8b42dcb9cf", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791195268, "uuid": "e8ad40c7-ff99-412f-a0ee-cbead41db265", "value": "T1095606927FEECE10F5FAD67A106EFAD98C491A0A7F48283EE4253BC1752C594845CF81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791195268, "uuid": "0c57a958-689f-4c85-8148-ce6f7e11ec99", "value": "61fa20e04a6d92b332b9552404fa2577", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791195268, "uuid": "2f1220ce-9d0b-44d7-8cac-c05724dc72b6", "value": "98304:jb0RCPk5vL4trzhAzwSa1DQu3eNcf6NvDUSsOyMFxdU9jL0:tPlQxbsNMFxdU9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791195268, "uuid": "133ace4c-8e3a-4750-bc8d-84484779eec4", "value": 5989888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791195268, "uuid": "ba0348af-3c6f-42d5-8a8d-4b204bd6ca93", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791195268, "uuid": "dc8cd4ad-64d0-46fa-bada-368a9e9cd5f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b16f2c64-c09e-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791192323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192323, "uuid": "a85cb43b-ebed-48c4-9829-ad2883ff1159", "comment": "Malware payload (AgentTesla)", "value": "41a318a1daccf9d18e10ea6cabb7ad87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192323, "uuid": "8c601ef9-6c52-46f6-b8b8-e3f3b48aa0b8", "comment": "Malware payload (AgentTesla)", "value": "605cbc240f1245aecf968dfce6e639573fa63ab1f7bb145a83605e0b22fa5522", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192323, "uuid": "c847c452-4561-4d96-ae68-3d5e06c08d27", "comment": "Malware payload (AgentTesla)", "value": "0310b8c67a05bee2f14054ce2b97f015ec34ff8f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192323, "uuid": "e4bcac56-6c4d-496a-8112-547e50b0c398", "comment": "Malware payload (AgentTesla)", "value": "0aac793094303bcc59fdee3d209260ce4ad243e714581e39ef9d8026f1f3e62b4fdccc47ba192390578b69943e11465d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192323, "uuid": "ffe635df-3e2d-470b-9d71-8503b44ca8a1", "value": "T19615D96A2C56EB997871E21EC1789D82E002DB7367446C4235FDF8610FFF181869CDAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192323, "uuid": "debf0052-0a84-45b3-94fe-cf2e67ecf8d3", "value": "12288:C+hbjm+g4VlMZul6wMf22DlTxcSIAVjn5OUyi:CAs4V1Mwd2Dll1IWei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791192323, "uuid": "4775968f-b934-4163-8c0e-f405d4cffdbe", "value": 915791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791192323, "uuid": "9b9cd94f-8631-4e75-be9a-63c06d7749d6", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192323, "uuid": "26e0e849-2f48-493b-b6af-e656ebc7a52b", "value": "PO # 49388.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e2827b-c0c3-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791208169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208169, "uuid": "68c68ddd-1639-4a2d-a13c-7ec486579aaf", "comment": "Malware payload (Mirai)", "value": "8f055e6e9dafbdce216c3036a6bbcd49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208169, "uuid": "79aa3357-a606-4e8d-af92-2789366ec154", "comment": "Malware payload (Mirai)", "value": "6092dd852620333d161dbbdd487a35e127601b03737107bccdf819f208424203", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208169, "uuid": "7a7f9c21-d44d-447f-9efc-ed2f8f5d9b4f", "comment": "Malware payload (Mirai)", "value": "93654f8d38b0e5d0536632982a7771e46d3ec7b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208169, "uuid": "eff64894-29fb-4d96-b2bd-4ccf9e16a461", "comment": "Malware payload (Mirai)", "value": "aa1c23b730b4be181226d2d9758693a96b06f54fa00e2801ac21b6ee9fc6112291087b7233fa4933830a102bdc7697dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208169, "uuid": "1f10b077-c922-4aca-9ea3-afbdb7d51615", "value": "T17DE3C4BFE7271E23C0C51071D1E30233A4B9D77938A9D797A8D3EC692E1A98434157EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208169, "uuid": "d73a1c33-9615-41c8-8e24-c6c58cc92e43", "value": "3072:rdmMxAc9zm/WN9ELpfY0DPhBIZ4UbhTr5:rxxp3cQ0DPhBIZ4UbhTr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791208169, "uuid": "f96d2b9b-7bca-45fd-b068-ac7ae88c8838", "value": 155304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791208169, "uuid": "c4908ad0-e587-4dc9-bacb-996e8a673a95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208169, "uuid": "912ca9dd-739b-482e-81ce-ab59a10652c8", "value": "6092dd852620333d161dbbdd487a35e127601b03737107bccdf819f208424203", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c3f6a6-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791190668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190668, "uuid": "eb3f44ed-e9bb-4947-9b17-41876ca3a06c", "comment": "Malware payload (RemcosRAT)", "value": "58b2dfd82eb23f65590b8cd477086891", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190668, "uuid": "5cd729f1-f73d-464e-b8de-4f50a69fe3f1", "comment": "Malware payload (RemcosRAT)", "value": "6105c1758a2d533a0f978ffe5f07ccfcd33c72074429fbfea61245b0a6aa8787", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190668, "uuid": "dfd4a69e-3eb5-4ec5-92aa-bea2c1132ebd", "comment": "Malware payload (RemcosRAT)", "value": "fb68ee475fe84bc38481c0d8085a9e17a6c1524e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190668, "uuid": "841aaa90-e603-4e8c-bf03-e3f2cfebbcb4", "comment": "Malware payload (RemcosRAT)", "value": "9456595497ab139273fa99d9177b1f23ba9af039217dfe76f3d13aead9c26183a6a198d2761d0c9a75d9dc85d14f6ff2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190668, "uuid": "a4375210-830f-4921-9c94-d255aabf8099", "value": "T1A4F06D92F3E4621D70B3AF24BE71112106BEF695EA794B5C01981A4C15F264885A3F63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190668, "uuid": "5ec033af-537e-4280-85c6-33bbb91637a1", "value": "6:Qq3fMExYlfmji4VVq1lOiNQyXOOwOIYlO6PASdElCXyWlOmlg80DANul1lO6JDjD:QqTYlujiDOHQFlO6MqJOmlR0O6KoleY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190668, "uuid": "d201ed94-b62d-438e-ae59-5e56dd3a3c19", "value": 452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190668, "uuid": "88d9b69a-f26c-45ee-be41-3526f84c87ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190668, "uuid": "22d87989-8020-49a8-9fd0-4ff10bd7424e", "value": "order specifications and datasheets.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589e504f-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791216226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216226, "uuid": "1d3ec4cd-e487-43ef-bea5-abaf44387654", "comment": "Malware payload (Formbook)", "value": "aa39d7d443af0951576d1214dbafa33c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216226, "uuid": "55980610-aa3d-4789-933f-8e85a8f13d68", "comment": "Malware payload (Formbook)", "value": "6158bb236d98187b9d7a267bc4ce36e8c053e8c487c25df844cc7c7d0345c34a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216226, "uuid": "bfcd97e6-1c21-4970-81e9-eb41ab2b1e00", "comment": "Malware payload (Formbook)", "value": "24abd815c6959168b25f44965cedb4e3aaee87ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216226, "uuid": "ff00707a-c616-4499-9f7a-ebe84b91ae0d", "comment": "Malware payload (Formbook)", "value": "2d5304817e4e6d57253aa2ad93308bf13c83c3c1a214a0b4c786034b954e6f8730ff8ee8a51a82df16fde7cdf0c75b81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216226, "uuid": "25ee17c5-dab6-4b25-9cd2-7997bdcc90bb", "value": "T16F0501402359DA03C9B52BF95871F27807BEBEEEA521D30A9FD9ADDB7962F004C04653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216226, "uuid": "dadf2215-795e-48ce-b977-cf15740c3828", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216226, "uuid": "e12b618a-4652-4d6f-a146-bb7329f3e346", "value": "12288:f4hmD1SOCjb3OEBFac7qe+5EerZ2ct+6ugGZhX/mHBihk8dH9FE:f/Dg/jiEBF7MEe1Ttle1/mhixdHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216226, "uuid": "85db0bd0-ce4a-4fff-a3f0-ca6d8a67b955", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216226, "uuid": "f0ab08ed-9ad2-4c50-b9d0-25a0eb97f168", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216226, "uuid": "9936c5ac-b802-4ec8-aff0-333fed63c027", "value": "6158bb236d98187b9d7a267bc4ce36e8c053e8c487c25df844cc7c7d0345c34a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c57a9cc6-c0ee-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791226717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791226717, "uuid": "2d1697e4-386c-4920-b458-36507aab90ce", "comment": "Malware payload", "value": "0cd0fc30e2edbd3f32e259a6c8fec67c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791226717, "uuid": "239f7e7b-e798-4076-aa74-d208e9efe63f", "comment": "Malware payload", "value": "616d1758c993316d6b72fbe2c18b441d6003c05bf82d3c179e69550106b6369f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791226717, "uuid": "61a3692b-e7f4-4b7e-9a6a-f68f1c6091d2", "comment": "Malware payload", "value": "bf26f978310169229e3133e3b2c915aface52758", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791226717, "uuid": "d151981e-8599-40be-ad4d-8446ef2a4995", "comment": "Malware payload", "value": "14b1b6515a5988b0bc6d855d7b774cffb5e6a94de0e232805e574759338d823cab8e48a581e2d32494c07d1962ac86d7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791226717, "uuid": "9ceced47-0a5b-442e-8636-5cb8bd710d7c", "value": "T1CF93C722398559B424CCDE6C49FB5C502739C00BCA1A2D2CB05EE5D83F76A78F5FA2D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791226717, "uuid": "ddc20e72-ea58-4472-a3bd-b6291e4b8673", "value": "1536:mUEDcQPyTuvb6jeFFn5lRUH5Dvf003RwOEo6uD:mW0NFn5lRUHV003RwOEo6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791226717, "uuid": "4dd2955e-5cba-40ab-be32-5da7aa150fcd", "value": 92610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791226717, "uuid": "3a6bf07d-1e18-4341-b0de-f479cfc51023", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791226717, "uuid": "bf54fc92-b88c-4b0f-b9f8-ea2d8d20df86", "value": "install.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0157730-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185879, "uuid": "86501999-2ab5-4185-9fe7-5dc7b80603d1", "comment": "Malware payload", "value": "09c9da5989dd8a274b493d62b82a0ecc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185879, "uuid": "5ff07c52-5bc8-405a-9e7f-b872e54013fc", "comment": "Malware payload", "value": "61a73c6d4936daa32446b4aedcda7af0829e766887cf1bb70e8c8a4e4b99c9c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185879, "uuid": "1b890fc9-13ba-45ee-8d5a-244b09fd1451", "comment": "Malware payload", "value": "44480059364c61d41ac3ad46313214cc42d70c24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185879, "uuid": "00f6d441-ad0d-4fef-a359-70de93921784", "comment": "Malware payload", "value": "337f27d703283370ccf82bb64a5177023c792b58208c16cd24030576e9863caa820071994cf8b76d1fa017afeda77b7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185879, "uuid": "cc774084-2798-4fd8-ad42-fdf0da5b3284", "value": "T14DD4239BEF3C05A593718B12C7BC84D0C7D1FD9C22442CAA569250EBAE24A8EF3D5D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185879, "uuid": "c6fc657b-bbb9-4117-b587-0fd22a3ab47f", "value": "12288:Cwt1Gy9zVvvafaoecXPNsE4kR1PQqQHphOtxymS1TpG23nWW3u:xtQIxvgcoPNsEPEnOtwmS1VG2nWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185879, "uuid": "60f116cd-b547-4bec-962b-31277a6239ea", "value": 625108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185879, "uuid": "00dda4fc-12fd-415c-9b86-eeb562507cab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185879, "uuid": "b5b06322-64b8-465b-90da-13dece398441", "value": "mb.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e140cd3-c0db-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791218249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218249, "uuid": "52036fa3-4809-4aa5-be69-ce08daeed6f4", "comment": "Malware payload", "value": "67815e5604748bf734ce9199653a57cf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218249, "uuid": "b8ca331d-3869-4eff-9617-759128f5c8ae", "comment": "Malware payload", "value": "61cdb398e6cef582514436fdc1e3b02dc1d1bef1544d6c129fa10fc3e23702ee", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218249, "uuid": "87a6fc75-384a-4ff3-8881-cd0980673265", "comment": "Malware payload", "value": "57128426caa7240042cdb613fb1cdb31f4f943fb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218249, "uuid": "2f8b3c50-9a45-4105-a87a-f9812f85e491", "comment": "Malware payload", "value": "b6b9e55bf90297aeeeed62115f00114614aa9bab1ce7ea42d5622102d9432cf14c162b2cfe88cc87eaa0e81dea46ae34", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218249, "uuid": "60bde21e-4aee-4eb1-ad54-975caf649d99", "value": "T1DA841A4F7E44FFA7C0AC8F30D5AEC72310E461D19991622F73648E9DBA663622D5B4C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218249, "uuid": "03e53061-f51f-4eb8-bfe2-75eb372929ac", "value": "3072:vosDg8p2ilU8b5m2bEmuvJq771MrX6OsYMRs7+aQTcNEhB6bjkGnLvwZa1eY3+Yr:vHgStUQ5m2bEvvDT6Oshx0bhvwZA02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218249, "uuid": "8c2d572a-b979-4195-93bf-bee638e09a68", "value": 397612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218249, "uuid": "d04c3a56-c2e9-4fa5-95c3-9b803f37ca86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218249, "uuid": "f630e8e9-4dfb-4110-ac79-885048078bd1", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3104d0e5-c0e0-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791220455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220455, "uuid": "0f024296-183f-4622-b69a-6ef2f159ee9f", "comment": "Malware payload", "value": "fa0d415180688af38c1d057508a40862", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220455, "uuid": "8cededa3-abef-4f6c-a338-c413b9e8b89f", "comment": "Malware payload", "value": "6242be85ad2aa59f001b50710260a733bf94f7ae5e30b1a500ccd8c284094ee0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220455, "uuid": "45a762db-4756-4a95-95f8-52424a5338bd", "comment": "Malware payload", "value": "7e769fbc13ce45006723bf1bcc29f21e62c63000", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220455, "uuid": "6c703902-39e5-44b3-b1ac-d1f2aab45fa2", "comment": "Malware payload", "value": "943b123bdbc6bb336c71fa4edd7db953626a0ae3863fd124a08684f0a194bcf6f117ed29e7c033b2e5e542ac264bd179", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220455, "uuid": "f3b243fb-9c12-433a-ab4d-f40f2800fa33", "value": "T15177BCE1736BAD5EA0063A6E80185756CBD87E523B71C3F49EA0DF7F25EE5408CB8580", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220455, "uuid": "3f34bdbb-e4c5-452a-bb4e-a8975d770c1c", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220455, "uuid": "c73a4466-c534-4a11-9dae-53910d99e9b7", "value": "786432:8TsVX6hdizccDKMQE6dCmD5p5MQPZgvc/XS8hGx7txlVgFzwDIvRTL:8kDQZMR6UmDu2gU/XMHVIvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220455, "uuid": "bbbd3a0a-9511-4475-b1b3-f506dc573b73", "value": 33412608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220455, "uuid": "38676c9b-3e66-4fa5-8610-99cfb369b383", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220455, "uuid": "c6cb39c6-f613-4a30-8b04-15d38b95e1e2", "value": "Newtonsoft.Json.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2042082d-c0fc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791232453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232453, "uuid": "1d98f7dd-6f73-4292-9e5f-b2e1e5d52ee4", "comment": "Malware payload (Mirai)", "value": "3639f827604fa7870c94fde268de3c47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232453, "uuid": "e28b531a-4683-49f3-bb04-e95fa064b8e5", "comment": "Malware payload (Mirai)", "value": "6247c47284d093904d395e5c7bc31994a50babe10ae84095ec8311b3db8c3da1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232453, "uuid": "fe46eb12-69a7-40e4-ac88-e1b2fa57bb1d", "comment": "Malware payload (Mirai)", "value": "61dbfe4ebb54b997290d50b32ef46c25b70abf13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232453, "uuid": "a80e05f0-12b7-4822-93b6-6badac79d6fc", "comment": "Malware payload (Mirai)", "value": "095175ecb34aa62195114614add1b0afb8cbb7347dbfcdd436e67a56cad124715ff0717c71e63bf25f3708ac092983c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232453, "uuid": "9eb8686c-c1f6-4b8e-b640-64b97e3b7565", "value": "T1D6B2E162A1463E72DB70313EB97CCA0017AB57FCA4EA72753124B7AC4BE2C47547814E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232453, "uuid": "bca22108-ed93-4c86-9cc1-23ed4bed232f", "value": "384:MZUX11S49enZh57fYONQ/yQVQbFxD+ckPvDxqSwPzMvdlhhymdGUop5hKb:nX1De9kONQG5xD+jHMDzuzs3UozYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791232453, "uuid": "a6cd0771-d000-47ed-939d-eac9ed1bd6bb", "value": 23732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791232453, "uuid": "ec9e0813-1d4e-449b-aa73-37dad2130d43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232453, "uuid": "842a05bb-11b7-4c0a-b220-ab95d2c26609", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd43498b-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791216449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216449, "uuid": "494a73c1-6871-4e02-92f1-774d9670e555", "comment": "Malware payload", "value": "de568d8e0106a2dac076077eb97a5614", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216449, "uuid": "5cfbddf2-a2cc-478b-abcc-956277c3618f", "comment": "Malware payload", "value": "6248ec3495d5d099d62d99806e583d487df327ccff205a272122965ebb3db042", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216449, "uuid": "14e59079-0c7a-4844-b44d-6daaa96d99b0", "comment": "Malware payload", "value": "da2554552af2eab641cef1410ef999552dfd1d4c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216449, "uuid": "c59502a2-43d1-42c7-bf5c-783695c873a1", "comment": "Malware payload", "value": "ba9a834d9eb2b4e23fd6a5d3d8d774723461e2b73668258665b8d09bec51206a28a018404b1ec010f1dc3a764647a437", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216449, "uuid": "6a32933e-3927-4760-9d79-1d9c65e36659", "value": "T1C8743B2162B31F71E6584AF790ED8080077AC27D9EFBFF29904F67BCAD02355A613952", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216449, "uuid": "6d39310c-6d7d-4964-bf99-1e426477cca7", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216449, "uuid": "94613cc1-3e8e-4c81-bea9-8c0ee4beac57", "value": "6144:ZvudWpFh/Nu6iBo+SCVW0sR5E9u0rDgVV+poMrE44eFDmyUH/uJhhhhhhhhhhYik:tnnh/Nb+zVW0U5EQQ5wyzUHGJhhhhhhy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216449, "uuid": "99f5a882-2e8b-4c26-b565-3bdd9c2b5e4e", "value": 349697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216449, "uuid": "84e6dbd9-bf98-4c48-a4e6-fec14c3dc3b8", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216449, "uuid": "9279b6eb-0396-4b6d-af99-7234df96c682", "value": "Noogen.Validation_9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f00b6d-c0c3-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791208145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208145, "uuid": "0ac3544c-d96c-4764-a751-47486e5234ff", "comment": "Malware payload (Mirai)", "value": "558b60df42934e331174bb8bddeee5d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208145, "uuid": "c2b8934b-a489-48f3-a114-a473a858bd10", "comment": "Malware payload (Mirai)", "value": "6264c928f5ad1da7332a0cff2f3e24d7065c0f8aa6ddacd6d360c379f26aad90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208145, "uuid": "c97ed0ba-e082-4d58-a6da-553a847108bc", "comment": "Malware payload (Mirai)", "value": "9e9c72a8a31d62cfc6b625c3d361bb0c1d06a8a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208145, "uuid": "ee58f7ae-8e28-4f13-82f9-11eb8669a772", "comment": "Malware payload (Mirai)", "value": "a70f6bcda80f90d410303ff5a1c1df5b4bd23b925d656b5bcd9c1e763657a2e60c36e40aacc48bd12397156cbddf427e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208145, "uuid": "d878e0c9-52ea-4b36-afe3-853850c75d24", "value": "T154242ACCDA504B5BC1E227BAE68A42CF33324B78A397F215497BEAB437C27594D31191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208145, "uuid": "5912d014-2112-4561-8306-4382eac7ff08", "value": "6144:rgz+EFa1+yrx9jRVloIzmkqM/9SdNjPWmMXCwgUXzF2:rgz+EFa1+yrx9jdTxD/6hWmMXCXUXzF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791208145, "uuid": "0f7337b0-8344-4023-ae5f-12ecf0b356f3", "value": 211593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791208145, "uuid": "09d7458e-de64-4e2f-aa06-bedec4b5ec1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208145, "uuid": "ef747d08-2477-4bfd-997c-456ce3f1bd71", "value": "6264c928f5ad1da7332a0cff2f3e24d7065c0f8aa6ddacd6d360c379f26aad90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0067f23-c0bf-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791206602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791206602, "uuid": "f78157c9-3ca3-46c9-bf7a-8a055bb28117", "comment": "Malware payload", "value": "1a36b7298f7720735a3d96f38469e39a", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791206602, "uuid": "0a588509-830a-440f-b961-9a5955e2cc68", "comment": "Malware payload", "value": "628a881e2718fdfe2a9304a2c744862b47cec0c57655dc432592babbd596f396", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791206602, "uuid": "6aae825d-1c14-474d-b7d2-9f902c308734", "comment": "Malware payload", "value": "fafa74a9aa144d4a982c0b0322aa5957510cdfcc", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791206602, "uuid": "a69f04c5-e588-4671-88c6-29177e1ca90e", "comment": "Malware payload", "value": "69141bf4c6d07f4e4038238e56a806f1f351726c54aee18540392fb71bba34c850ce1e3cc2f428be0b651e59d2a502a1", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791206602, "uuid": "631a4c14-7c4e-4723-b8ae-7b412ccbf2df", "value": "T127E1BF72C2E3E26BD94BE4BFAC21132714AF59DB16EF8C827528016C654E4CD9D39323", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791206602, "uuid": "e8bfd9ea-7938-4657-8742-d2102d0c9ce0", "value": "192:GO4slxtroGhzPwX5hdnf+mOFIx/L9Tz/KDk:GtslYGhzPiUmOFIxjFbKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791206602, "uuid": "9d472940-678b-4334-b3ce-b2151a6b6b3f", "value": 6823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791206602, "uuid": "622e3fb8-f113-4653-97f5-c27a3011be7b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791206602, "uuid": "80e644a7-91e1-4358-85a1-3e15bd8fb6d2", "value": "5ada9fd3-ca37-4249-b478-d7fb7bd17429.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14a6417-c10b-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791239219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791239219, "uuid": "5ea5bdee-488e-4916-8fc7-68e02f294ed5", "comment": "Malware payload (Mirai)", "value": "00757b8c922349d54045afdc4c50ffcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791239219, "uuid": "9eddfac7-97ee-4519-9758-8363be46bedf", "comment": "Malware payload (Mirai)", "value": "635f46230f91ec6734d98c33eeabf84129ab7898354e3f5a98d9b18c8da7eee2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791239219, "uuid": "7733b62c-fb39-4600-b8e7-59900a7568d6", "comment": "Malware payload (Mirai)", "value": "f7e493de20922b5b8b1670a94bcb97e78b0c4dc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791239219, "uuid": "ba6d28ab-e5a9-48f9-ba24-c969d47d67c8", "comment": "Malware payload (Mirai)", "value": "2d0f81aa7b10b5a6ab708b4df3d495e41b64943e0c8360f3b3af4d632b7bb29b80749a46c08438858ba15bcba4aaa98d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791239219, "uuid": "1e9bf7bb-6855-4d51-845f-ea1b106eeed4", "value": "T1E4C3E946BD418F13C5C721F7FBDE42987B166B6DD6FE3102A9257FA033464D60A3A212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791239219, "uuid": "6cf1c9d4-7165-458f-b863-9e764fe05e66", "value": "1536:6TVv+6CTOAfHK4VWv679dLA1TO7U5Fco9+wxZWOjl/DwywXrRGdQpvB1NeOlBfnn:6UFTO94A6pdLAsyjx0+y3IC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791239219, "uuid": "a7309d66-098d-40a6-9a4a-e72e5f534837", "value": 121556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791239219, "uuid": "a50482a3-0e8e-4ca0-95fd-9b7e0c82a0d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791239219, "uuid": "2590b19f-8034-4587-baaa-b1786ea789e8", "value": "SecuriteInfo.com.ELF.Flooder-AEG.12488275", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e92887-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload (XWorm)", "timestamp": 1791216282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216282, "uuid": "e35c294b-43fa-4abc-982e-1fba4499649b", "comment": "Malware payload (XWorm)", "value": "61ffe1fdb60e5a2d6efacbe983fcfb17", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216282, "uuid": "0d9c89c2-eb16-44bf-a406-dab3c8888914", "comment": "Malware payload (XWorm)", "value": "642e4327be8a180badbf198d01eb5366134ba90afbf3a46c0836a27e62080efd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216282, "uuid": "1e1c0098-2d61-49b0-9e4d-3c066e1cc79b", "comment": "Malware payload (XWorm)", "value": "f0633bc5564f2b0219be4fa4231f0d701ca6c93b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216282, "uuid": "0cafe8c2-5330-4630-a5d2-c06e0b725215", "comment": "Malware payload (XWorm)", "value": "10061bd7d583aa0872de76d81eead13a58d955eb9ed79f608eb729873b43cd49fd2249277823ea6403ac40568c45c705", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216282, "uuid": "6bffff3e-cd81-4843-b1d4-12f28141dc4a", "value": "T1CB633A4EFE199B25C01E177BC813524C82F991B7F522F27B08ED5C912E26799C18EE87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216282, "uuid": "76b37f76-0249-49aa-837d-c1cccd0865ee", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216282, "uuid": "a83ff490-b5dc-4595-b54b-25cb5ca68122", "value": "1536:5/v2kUXGYlOKHeREtSbiSY/VZkQjWeZRzeK9vAWyy/iS:NWGnK+RiSY/VSIWitecAWyOiS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216282, "uuid": "a51dd376-35e0-41a5-9c3c-7c5e1a18ee81", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216282, "uuid": "e12d2baf-0cc0-4a99-a456-3631a4cf96de", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216282, "uuid": "55621281-6c52-4ac7-a1d1-79b250286a70", "value": "AdvancedSokoban.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99c7a34-c085-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791181627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181627, "uuid": "3c0e513f-dc5d-4625-9677-772db66617d4", "comment": "Malware payload", "value": "e6b12b4d67fbe7f38776bf10dc1abbf8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181627, "uuid": "dd713550-20d0-4d2d-8495-de2bc5886a17", "comment": "Malware payload", "value": "64324105868648331c88755dc80162c503e3b19dccfc3dcf277e5682926b4c11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181627, "uuid": "3b93a71f-3f56-495d-935e-6ccb09df34df", "comment": "Malware payload", "value": "e6450ff148be848317aa81b7feb3a2ab478a4b64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181627, "uuid": "72023354-7106-4f67-820a-89f6e1dcda17", "comment": "Malware payload", "value": "b870c7ef3d0fe7e1811dabff427b3a5b847732a059921a3058e9a8ad01b4c7dc0856abdcb3ab4b226b1ec8ccd59d6294", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181627, "uuid": "25cbb91d-d650-431d-82a3-504fd5453dac", "value": "T14F934B02B31C0E43E1676DB03A3F17D5D3EAAA9111E4FAC9691EBB4581B1E325582FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181627, "uuid": "0664ffb4-fb19-40e2-b5f3-f62bf90431b3", "value": "1536:aWTkKr/zkJNRvrXKV8cg6W7ZNL+RFnk/nsz9BjpaJd4Ku:XTJvVe/zUnasfKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181627, "uuid": "ab3ca9ef-8a20-4f8d-b92b-f0ae4210f2bf", "value": 89048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181627, "uuid": "29e8f66b-45d7-44cc-8a02-b8197ef82225", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181627, "uuid": "520e5a63-4e48-486b-ba14-8088406124eb", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acffe73f-c07b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791177284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177284, "uuid": "ce50d6d4-597b-4702-8c58-84c73a4e902b", "comment": "Malware payload", "value": "44551e2b6b3c049cdc0411f4d9b29bd2", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177284, "uuid": "c77a629e-1961-4e93-a496-4f7e457e82a7", "comment": "Malware payload", "value": "643f1129eb68d2ba93306bdf17ed1636d81de9f95b2a57a6ea7ed942565247db", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177284, "uuid": "cf47e7f7-2c57-490b-99ab-aee4220cda9e", "comment": "Malware payload", "value": "7fd3c4ecc133e2e71f925d47d6c6c1069199d52f", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177284, "uuid": "ee825cae-b13b-491c-8c43-50c5bb08c1be", "comment": "Malware payload", "value": "d4fbe1994b98bd578185dc4e2bce3eb00e1150ab5cee8dc14f59779197e2dbdd5c1d0361a6ff23c1b7003a3812377234", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791177284, "uuid": "66b1cd31-4b49-449d-937d-5d14cbc5e28b", "value": "T1FF42085CAE9161B4FB1707DEB3AF28690228A0C7240DC484F54CDEE87F46BDC8A57B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791177284, "uuid": "e0faae39-acab-44ea-a442-3cdc8b03f3a3", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxz8fbqFtCLSbRUM:sXX+/DV7k/38WFtPRUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791177284, "uuid": "5c7d29d7-7a1a-466e-8b10-393980143249", "value": 12073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791177284, "uuid": "1ffeb4e1-0dad-48d3-b9d2-c15794ea95fb", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791177284, "uuid": "307a5786-0f40-4c91-93a4-74e6c4918cb8", "value": "ttt.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "332c1d48-c0c0-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791206714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791206714, "uuid": "596250d3-d64e-49c5-85da-dc658b754ed8", "comment": "Malware payload", "value": "e19e8beddea5958105c95ae58c18f274", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791206714, "uuid": "2d65c36f-328e-4fca-ab60-c4759f5aba2a", "comment": "Malware payload", "value": "6516223db6338b7a702d3a2dd961628c53e0de37dee401701ca612335c15ee75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791206714, "uuid": "c74ac733-bc9f-4042-bb1a-81d5d66e235c", "comment": "Malware payload", "value": "02b4aa4986cee86e48438865a8fb280e506d356e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791206714, "uuid": "01bc8c10-017b-49ba-b497-a128266c54b5", "comment": "Malware payload", "value": "a540bab964531ff802ccf3f9f6ff027332d8f36f373cd378be929da604c72384508bef61e2196832fdda051d961ed584", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791206714, "uuid": "bf32df8a-e97e-44be-ab8f-fbb3f71ce812", "value": "T184E31827739245FAD53BD23386DA93729572F4421320B70F2A29DB223F14D689B1F7A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791206714, "uuid": "27a878f7-5451-476c-8470-91fd28e8d4c4", "value": "f022c041bd8aabb8e09bb6bb34da8f97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791206714, "uuid": "3a415133-6928-4484-a0d8-5f57325b0cc4", "value": "3072:kVGJqVglEDECSxTl5x+Jbm5vXErU0FDH3ai:icqCE4CSdlwbOUrU0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791206714, "uuid": "892273af-4e7d-488f-9ce6-21ec2feee4fa", "value": 153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791206714, "uuid": "e6d29647-c0f6-4329-97c8-19be6ffc9c02", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791206714, "uuid": "99498f0a-21cd-476f-9db5-7933ddbe01a3", "value": "6516223db6338b7a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc14c2ec-c0f8-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791231050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231050, "uuid": "59e31950-e3a0-49f6-9304-97ef72905502", "comment": "Malware payload", "value": "9f6443fa53bb69ec922a32133e4b0952", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231050, "uuid": "e8d22b55-1d3a-4d5f-af27-6ae2154e128a", "comment": "Malware payload", "value": "65725b8ff13efa57e3ab2945f551c76de562ab65c3d46b39e830ca45b720b9cc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231050, "uuid": "5fefb0c5-88bc-4f37-bb9b-0da523239c25", "comment": "Malware payload", "value": "a33c9ab8ebfcd874b9fff3cb439979b8934d7a77", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231050, "uuid": "e5178645-cd01-40a1-8f08-a2d15fe41b60", "comment": "Malware payload", "value": "e5c6a4a5686b9eacc8b7e28815e34af0bfbc583da197337ce5cc939fdfaee48da2c70c1ad02bf98916ddf474484a0406", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231050, "uuid": "47d40647-570f-4036-be1f-1bb23015505c", "value": "T1ADC1ECCD36E1E447138E1F63BE157BF7E0B68C7A1984A403921CF98EA0A841BC67D971", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231050, "uuid": "c6585fcd-66e5-4efb-b816-03440c587407", "value": "96:jZKG7LqXc05bK3gSe6PIIYLW8ASOBXcfhPyfu9j+qc5dF2BboBMTmCHLY:oCWcwK3u6PIvAS2XmhPqClKkBbeMaCHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791231050, "uuid": "b64721fa-7edf-4253-9d69-be2b8a05732b", "value": 5652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791231050, "uuid": "90a77801-4de7-41a9-b1c8-5ce7587af499", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231050, "uuid": "74a93c30-2140-43fa-a96f-50ccb7b45f85", "value": "Chrome_error_report_149635.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9db8e6-c0e0-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791220608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220608, "uuid": "824afa0e-30d8-4630-beeb-ac2b22327063", "comment": "Malware payload (AgentTesla)", "value": "d4f58ad30273baf54d738605ae3d3968", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220608, "uuid": "050a236c-8f3d-48c4-8b06-4a88b32c635c", "comment": "Malware payload (AgentTesla)", "value": "65789cfdcaf5e8d7b5f8ddae8f472ee9b8d27d12d7b26b054a2a16fbc1efc958", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220608, "uuid": "68ce0b84-2d1f-4b59-b769-87e573fe44ae", "comment": "Malware payload (AgentTesla)", "value": "5a1fed5ab6ccde6cc3810413d86f775adc368e56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220608, "uuid": "60e71bde-c0e5-4eef-a192-f38019dcde60", "comment": "Malware payload (AgentTesla)", "value": "a48a18d6fbb26118321dbf35638f0a8a426dc9e9070a67fd1b80321d83e315c21fb380ecbfd0191ac2a12cd6996ff88b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220608, "uuid": "28f87dcd-692d-4c9b-b9fd-510944c78c88", "value": "T185E227DA53FB820DB2B78562A8F030A3D46F5549642A93CE2D103DCEFC16EE8DDA3515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220608, "uuid": "6cb60d68-e873-46c9-a435-7439e91ce772", "value": "384:p8R9pKu95fUfXQu3E3K/dEjyqqToeqN/yG:p8ePQ7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220608, "uuid": "e366b42b-c5b7-4508-9705-63a1dc77cdb8", "value": 33180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220608, "uuid": "de108058-a3bd-40cc-b661-de16c4d65746", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220608, "uuid": "cf3ae95d-1f7f-47cf-a597-901dd5bfe01c", "value": "cotizacion_A7303_THC.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19daa3d-c0ac-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791198417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791198417, "uuid": "4902b2fe-9123-401a-bb92-99efd571649b", "comment": "Malware payload (Gafgyt)", "value": "1963677292efd88bf60d0c687cb0382f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791198417, "uuid": "3c19396d-495e-4ea2-9685-8ba9e9f96699", "comment": "Malware payload (Gafgyt)", "value": "661faee0e7c5c959724dc0db30a76ba67b5c8ef2dec7180eb2f649de77bf79ee", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791198417, "uuid": "df0a5911-fa79-4929-999e-9aad50d3f0d9", "comment": "Malware payload (Gafgyt)", "value": "579eaa357d3f31b15f0fa1da52eba97f98bc6a29", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791198417, "uuid": "55e95100-6be0-4707-b8fe-b73dbd3526e6", "comment": "Malware payload (Gafgyt)", "value": "6a9cd9ab817e860e63ed2066fc4b90b5000ddcc44559c71a4712d2c8a159db096f319180373ab6f2de13def8bfdec1f0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791198417, "uuid": "c348d4eb-b733-4df9-a148-60f4564d8b42", "value": "T15F213ED751E20A36AC65D877B4AF8CA434D0E4C645E1BF0818EC38F4648DE59E481B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791198417, "uuid": "5b225799-4055-44b5-9ff0-7fad108f8229", "value": "12:q0F2kV3sbVHW0F2govvo0F24tDX0F2JgfX0F2RzB+RFX0F4DO0F2WNI3ewkX0F2d:vKVeJbI/s+VG+4DLTNIpks2KYBbIKAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791198417, "uuid": "cd6f4762-428a-4c17-9daf-6e2a1d174ed3", "value": 1214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791198417, "uuid": "241bb372-1989-42a7-8d2a-83068501f8a9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791198417, "uuid": "ff734659-c2b9-4fb0-ad34-cd8513c8b3fa", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf70e74-c0dd-11f1-927a-4201ac107004", "comment": "Malware payload (XWorm)", "timestamp": 1791219403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219403, "uuid": "44748ff4-b37c-4eed-87ed-ca8505334afb", "comment": "Malware payload (XWorm)", "value": "80e804d1361240f30e121dca2593acbd", "object_relation": "md5", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219403, "uuid": "c5df96c4-ed5a-46f1-aa9b-65ef107c1ed7", "comment": "Malware payload (XWorm)", "value": "66a76420bba2c68bd832f22b8af4f01061c1de5adb1828fc3dfa8cab24dcd49d", "object_relation": "sha256", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219403, "uuid": "c6b84ef5-95fa-42d9-acc8-8945d2d46d69", "comment": "Malware payload (XWorm)", "value": "bd3b1ce8d1df07e5f69a27688f7f3e07df1c8244", "object_relation": "sha1", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219403, "uuid": "24c38c0a-3a8a-4d0a-aa2d-f3263e3549ac", "comment": "Malware payload (XWorm)", "value": "2e294403ed8fa8020347b21c733058e4a7332f56bee387a68b788a5515bff8b4e0ccf284b65af0b633956f2c32978ce7", "object_relation": "sha3-384", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219403, "uuid": "7d59b95c-c3f0-4ea2-adf9-a4a04c954124", "value": "T1FBD38DEA7C022DBC050B8675CC6A054F7FF8C933850964613E1E22A91F674B9E395FE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219403, "uuid": "c9544755-edc9-4e4b-ab34-692edb2804f9", "value": "1536:AR4dRR88AEhG6+aKyF8VqiCGttj+EAqNLVcozGVHwrrhdKBq0rmXiu4oGhOoSi5j:6yCcNVlPoGmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791219403, "uuid": "df54e9f3-de6a-40ec-a9f0-757457cc56d1", "value": 140602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791219403, "uuid": "f8af12a8-2a48-4e8b-a2df-b71701bfa965", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219403, "uuid": "3a5456c8-3492-4a22-bb64-23718c17f6a5", "value": "proceso.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "695d2964-c09b-11f1-927a-4201ac107004", "comment": "Malware payload (QuasarRAT)", "timestamp": 1791190914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190914, "uuid": "79337a50-e998-4a9e-b523-262a1ff99b6e", "comment": "Malware payload (QuasarRAT)", "value": "91ed4c3bee3d9c075114bfe8e7e797a7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190914, "uuid": "3844579e-a258-4d2e-aa08-b4fbbc47869d", "comment": "Malware payload (QuasarRAT)", "value": "66ce401dcf02a33356935a720557f4d1bff62ee6c41e71e4d1b936854e29f005", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190914, "uuid": "ffc92e56-714b-411a-b787-fc895a5ed30f", "comment": "Malware payload (QuasarRAT)", "value": "4edd5d289320bd77059caade8dc2105855e69d94", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190914, "uuid": "0f1a2809-e011-4422-9f6a-a4ed4db50c10", "comment": "Malware payload (QuasarRAT)", "value": "c5b95557cc5ae4c955e2d251aef1d08fecad784be3c1f47a744c18d13c9dd601d2c49fc3914caeb671cfd1634803ca32", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190914, "uuid": "f75ad6a8-563c-4064-8850-3e7b290aa79f", "value": "T16BF5315DA6769BB90B9CF287493CA86D3E4DBEA0C13010B5BC3EB25BB15CD18D15B12C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190914, "uuid": "ef979366-d4c1-44fb-88cc-eccb1720a45c", "value": "24576:oyYdh3/V0eaEKxqGfDzH+XNSK33i6RolYDCrbvDfaVhOkgYwTQTQXaomEGozw8NQ:oD5nGWAiNR/hRqToQGlJvPE/xl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190914, "uuid": "ee58afda-10be-4a44-a43a-e50f82ee1ff8", "value": 3367480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190914, "uuid": "32d9027e-c615-48e0-90da-d0d7386330b7", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190914, "uuid": "2f9ffe01-28f4-4151-a7a5-e86836d2c1f7", "value": "NEW-RFQ-ENQ1929-SHO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a94742-c10a-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791238454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791238454, "uuid": "99cdff99-71d0-40bb-b61e-352756dee6a6", "comment": "Malware payload", "value": "6a1e3a4a217b049eb7e6b8ce83e86729", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791238454, "uuid": "08e550d8-7a9f-485b-8161-6ba816361a86", "comment": "Malware payload", "value": "6742df2aedbcc735ea27210f7e6bcd9f4f648e7f66d1c1ad01a49396235bec29", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791238454, "uuid": "d53dc79c-ac73-46e0-812e-b3bd9cc240f4", "comment": "Malware payload", "value": "48b77de6681bf4c05a1fa9ca4350930101540854", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791238454, "uuid": "0841fcfd-0f97-4ecc-97a0-dac319f7de6f", "comment": "Malware payload", "value": "a8d0a1501cba23c1461547ad0129df24c5807b91ca80d840850c6d37b9552bcf9342ac33e0fd6c93b588eada66956d4f", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791238454, "uuid": "26e884c5-b165-4477-8e2c-a4f49c521678", "value": "T11AD6123FB28B253EE06E1A397972A110583B776165134C16D6F4C88CDF2A1B11E3EB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791238454, "uuid": "349d446b-bc98-46a3-9aba-8017d0233636", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791238454, "uuid": "fe25cdac-71a6-43a1-be9d-bdb402105465", "value": "196608:4z4pvHLXksEgSJ9PdlJ1oxWSgAeag33RVVnky/LUV+:4acd7sgJagHNkyjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791238454, "uuid": "7f4c477e-d240-47ab-8f1e-3fed51c2124a", "value": 13022965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791238454, "uuid": "45e2a3b9-b835-4ad1-9c03-1f8f3fd197ab", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791238454, "uuid": "1d0d2778-f4ec-47af-b820-39f5250f9fe8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919430de-c0b8-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791203437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791203437, "uuid": "cca9a5ce-2660-420c-82b4-43b35ca79119", "comment": "Malware payload (Gafgyt)", "value": "ab0aec12dc6821cddf15ad7ad3f7d258", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791203437, "uuid": "ba11d363-d7be-490a-aa27-90f9a55cde62", "comment": "Malware payload (Gafgyt)", "value": "675f3a21dc8913a31dc21cc2d8a20eb3310ee3219f3533eb14cf649a363dd268", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791203437, "uuid": "7d1526a3-4c6c-4e94-9e61-3ac3ced8016e", "comment": "Malware payload (Gafgyt)", "value": "0f53a5ec8346b43c86c47760c944e03d1aa761f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791203437, "uuid": "366908ae-6cbe-40f7-90c5-4c4ff850211f", "comment": "Malware payload (Gafgyt)", "value": "f0d335cf46224c2fb659ace1aeafcae05064d87b1e24f6773a4f8fdfb95322609f1f354f2bcd610da9bc5f37d1dca40c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791203437, "uuid": "4e9a521e-d950-4d3a-8e32-399ca758be7f", "value": "T179341904FD544B6BC6D23BBBFB8E42CD37336B5897D733019A246AB42BC6B991D29101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791203437, "uuid": "3c61b997-f69f-4b45-9dac-3ab0f6a809a9", "value": "6144:Snv6+/7+/US7lFM7qawq4bXUTHtk4RI9+bjNQv9KZHlWZgs+7ojz3VpO:MOywq4bkT7S+Cv9KZHlWms+7ojz3VpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791203437, "uuid": "2856c111-469c-450f-9087-131fe7941ae4", "value": 252869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791203437, "uuid": "ae3f7259-3766-48e0-a0a1-a4440cba1a9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791203437, "uuid": "da029f5a-98c3-47ad-89d8-28a7bd0293d7", "value": "dissarm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5db7ebb-c0e7-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791223791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223791, "uuid": "ba075941-b4e5-4c0e-80c1-1bfcf051cb0b", "comment": "Malware payload", "value": "34d6286bbddbf926bfff099a3c0fc187", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223791, "uuid": "9b9ec2d0-eeff-499a-9eed-d410a4d85b86", "comment": "Malware payload", "value": "67624862db40b3e12242a34d2df0b7fa7cbec4661b6456dc8f773fce4817b10a", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223791, "uuid": "349a3dd2-6143-46df-826f-6167684b1c6b", "comment": "Malware payload", "value": "7836a9663dce52061d2b74c53dcdca01be748c47", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223791, "uuid": "8d75be95-a3a6-401a-9c32-8062f244a15a", "comment": "Malware payload", "value": "e1daff4036bce6ac69062cde1ef9ed92e68edd598fa014566d0a923ba5a9d41e3234a5b19763bf2d103c0f5052bb1593", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223791, "uuid": "244ff9e0-3652-44f1-a374-7ac21e5e462a", "value": "T18E4833247806CB13F215E2B5D63BBB1CC7813A50ABD5D8CB1517F9196CB3AA067B821F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223791, "uuid": "35694980-a54d-497d-990e-45bbc1098492", "value": "1572864:Qz73TbGd+sNiWYZ4U7sMTuTstkM0TJ1sFKUC6t8ogkJV7pSsU1AZBfi+7LrXptHv:QzrTqvizZaXjxKbpSnei+7THGL7rWBfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791223791, "uuid": "d0ef3c5a-74ff-4371-8750-0286c1077094", "value": 113025065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791223791, "uuid": "229734e4-036b-46f9-b110-c54fc72a1745", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223791, "uuid": "80304a10-2759-48bd-b932-1ba7f3132c25", "value": "DashConnect-2.2.0.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853bbc43-c09b-11f1-927a-4201ac107004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1791190961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190961, "uuid": "c5f52a67-2d99-4d07-93a7-48499c6041a5", "comment": "Malware payload (AsyncRAT)", "value": "25a37674d531a7c7061f42ae2187bcef", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190961, "uuid": "b6550295-a869-4d6e-8ebb-a7ed9141d612", "comment": "Malware payload (AsyncRAT)", "value": "678e957e8261d31d8ccf17fdede8a79feaac2b17491df99d7ab6eb052a1c236d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190961, "uuid": "60fc9f9e-c61a-4a44-be15-d557b31ed387", "comment": "Malware payload (AsyncRAT)", "value": "2984c96791dcf168ff4d9f0a7d645459675aaa47", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190961, "uuid": "5193aa46-96c4-4712-853e-301533f12a09", "comment": "Malware payload (AsyncRAT)", "value": "eef4e8dcc72db348c530bbecbc547e2416d11dc9f1498f060ed9e009d1c4771070452885b3eb7411e1be79764d92ba8e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190961, "uuid": "8e325487-821f-4b68-862f-8c2e95689991", "value": "T147365D3EFCB9F9BDDDA394293E917B498CB480605593F11808D5D04E94CF6EC4AB8AD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190961, "uuid": "211b3e1f-1109-48ec-83b8-755b11bff936", "value": "1536:Gdnd70l5A8ETM0dKCqVrbsU71ywlNjVoW5j31bbYPkKub2DY5khxlUSkIpeyj4Me:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190961, "uuid": "c1419508-6e7a-4b1e-be38-9a677e3b9f8f", "value": 5198026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190961, "uuid": "4d395dab-aa52-4e26-a4a4-bf58edd0d7e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190961, "uuid": "16048281-c2fc-4edc-bc9f-f25559e33a7b", "value": "PO#3434.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858d066d-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218879, "uuid": "55f3fd2e-56bf-40f3-92d6-dd71fdcd9b02", "comment": "Malware payload (Mirai)", "value": "1b43f85f75123441ae27ff63a25a2d50", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218879, "uuid": "a997887a-96fa-4ebc-ac54-10f5cba2de55", "comment": "Malware payload (Mirai)", "value": "679585c56a8c9de8cf14f3315e1829575d88d4e54e67056ca34290e79182a376", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218879, "uuid": "619ce992-0824-4598-8729-118e57e1dff0", "comment": "Malware payload (Mirai)", "value": "2a1f03294d0821e1e4acd95de7d8bf37d3bd561f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218879, "uuid": "478e9408-c5f1-4cbe-9d56-76aed4a98985", "comment": "Malware payload (Mirai)", "value": "6f6938ecf43a83a567f93b9c73d765b775590a164ec953737f852165b86cc726a426c840d33880812edf3f0171df6356", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218879, "uuid": "0e5d8216-48cd-4514-9ad4-8a7a0caafc44", "value": "T1524302F1839E3AF1D2F0C537AE35D78289E599B505BB7232A08055B5F0D2C2A255CA8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218879, "uuid": "56c99c9a-7bdf-4b0b-aa32-6a314ab5e78e", "value": "1536:BKufiTlBw2O17dA4vmoHSekMDvJPDSFpzb:kvpa17dpvmoHFzh0p3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218879, "uuid": "a1a6037b-cfd2-4e49-bf67-e6696b275adf", "value": 56968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218879, "uuid": "973b2be7-08e0-49d9-983f-7e9aede86ed1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218879, "uuid": "39b3d6b4-e1cc-4707-b1f8-df3cf17896fa", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f1fa80-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181973, "uuid": "55fbe9b5-22de-4d75-9769-8670da0ca70e", "comment": "Malware payload (Mirai)", "value": "0ea823aedff37e8cc6268768c55b7dd4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181973, "uuid": "1bd5a4a1-c066-4907-9c41-d6de9cca0e59", "comment": "Malware payload (Mirai)", "value": "679b4e80e1f725edc7912a8d12cfec66d13622cd145b30d6495420ef1e9d7d3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181973, "uuid": "c760a21a-a92e-4a30-82f0-3d8dfdebc8a1", "comment": "Malware payload (Mirai)", "value": "b611b889c7924e6c00117eeb650ca2924116a013", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181973, "uuid": "f5f1b376-ab47-4e87-9ab1-45541209f041", "comment": "Malware payload (Mirai)", "value": "ae4eb775091f0a3d5616ed975a023153ecce4810f6cb53e85c1f88a3540e16eeb1bdc0aca26cde9a2d5266f06b1909fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181973, "uuid": "91e6a2ff-5520-43ed-9e55-880802e1efd8", "value": "T11C2302F37A916FD2F11D553A0AEDB0136D21A10C38C584BA5DF9683BF932E248C5C683", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181973, "uuid": "3a4babf2-35b5-48d2-a859-22401c46d418", "value": "1536:2yv2/PU3ZYEqiLRoBnME2tLPZB7nouy8p:2yYUpaieB+tbjoutp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181973, "uuid": "39e8cea0-77f7-4f91-ad22-0f980b5f65da", "value": 49944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181973, "uuid": "6db65067-ac52-4460-9589-6f06956e51a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181973, "uuid": "21c31298-0f75-46c4-b383-d78b555dd571", "value": "wife.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862f292b-c0c3-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791208142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208142, "uuid": "dd572502-2c3b-49d9-9ac7-ecbc1ebf1808", "comment": "Malware payload (Mirai)", "value": "2d6cf4e0f3c84d7976c07a8294d165c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208142, "uuid": "ff553c56-e3f0-4827-be10-39c0486cc2b9", "comment": "Malware payload (Mirai)", "value": "67e823012241f46e78bf12ced9526ce9719ca21a0a4b3b4f52db62f16e5ec557", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208142, "uuid": "087f3e85-7ee4-407a-8102-43d06ff505a9", "comment": "Malware payload (Mirai)", "value": "d61f5fb663e670c46e19311e3c78ecf260fa76df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208142, "uuid": "87f03ed1-d2bf-44a7-b0c4-bf3f61324ebb", "comment": "Malware payload (Mirai)", "value": "4921842551a69d20bfcc509a6b5552515487f29f36954d3df590d9669497ddb1e8b5e2111f36741e241e91a2b08c3b51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208142, "uuid": "225a9bdc-fc4d-4cab-ac3b-9e792ff6aeed", "value": "T153F307CCD864576BC2D223BAF64946DF33321BB8938BF32159A7EAB417C1B581D38191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208142, "uuid": "0461c65d-da76-4dbd-9ea3-803934e7dfca", "value": "3072:CkIdYRNkCI0gu0gj2kqn1hP5LfL1tBqPE3EHsNH9QQrUQu0PMLgocAiENoesdpmH:sjeNpRla7t1r7Kdm2XVWm+tisQTzXQ72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791208142, "uuid": "22002b22-23bb-4cbb-8de2-71c57069e13f", "value": 170072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791208142, "uuid": "26617be3-8cbb-4236-96cf-807136c910bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208142, "uuid": "3fa8dd0e-3d70-45ba-bcff-5c2cd0bd6eff", "value": "67e823012241f46e78bf12ced9526ce9719ca21a0a4b3b4f52db62f16e5ec557", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0301d69-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181664, "uuid": "cbe8438e-4cf1-435f-8808-c1c9ff755763", "comment": "Malware payload (Mirai)", "value": "229d647fc550dd7daf4843b20f6acee3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181664, "uuid": "9415639c-4ce7-4f85-88bb-66548a730976", "comment": "Malware payload (Mirai)", "value": "68621e22d99802a211dc435a333a17047dac14fa51d66faab4e1470aa8a9d61b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181664, "uuid": "8dc77a9c-78a9-455b-866f-ef94db29a3cd", "comment": "Malware payload (Mirai)", "value": "dbd66a12e0c241a397ea0d3900093c625d530b1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181664, "uuid": "5042910b-257e-4fd1-8e2f-af436fc66a95", "comment": "Malware payload (Mirai)", "value": "77e4f5320f5a6ca00c18e9e1ed3c547c83c21512336c2501a29c6ec0031a9b73277f13219ec47fc5667a39ac51a1a167", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181664, "uuid": "6aecf330-6ad5-4132-998e-c21b0daaff75", "value": "T1061418C3F901EE76F40BE37644A30906B630BFA219520AB671573CAFD97A0D5152BF86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181664, "uuid": "40cece2d-2763-4bd8-bdee-5f561796d50d", "value": "3072:UcChFY8FZo3UntDXQBODy3wkl8ec5itB173x2QKX1V9jbi3Lau24eLK:9ChFYYRA8y3ll8ec5cBTpKXuLLDe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181664, "uuid": "561d509b-b0cb-4f7f-9053-79d97ff35246", "value": 202536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181664, "uuid": "3e23ab0a-7ac0-42b4-a80b-72476c7c55d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181664, "uuid": "bfb43217-e120-4d5e-a2b5-b2fb76059c43", "value": "wife.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9409f2-c09f-11f1-927a-4201ac107004", "comment": "Malware payload (MassLogger)", "timestamp": 1791192882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192882, "uuid": "ee8cb991-7b5a-4b5b-96a7-0840f093181e", "comment": "Malware payload (MassLogger)", "value": "0fd5de402f9aa2202dfbbe8e4e5400ab", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192882, "uuid": "c3d2c4ce-8c35-46c9-8c6d-8e4cd3565da2", "comment": "Malware payload (MassLogger)", "value": "68e75e46bbea3fe2960f10cc64225b7bd59afdd8eecd835db0f87cfa99d538b0", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192882, "uuid": "0bffacfe-5df9-40ee-b57c-cf11d93ab79c", "comment": "Malware payload (MassLogger)", "value": "a72d0ec66e181b66b72da319e0561fd186c8a5d5", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192882, "uuid": "81bda700-3bea-4710-9dec-c73e37aa3107", "comment": "Malware payload (MassLogger)", "value": "ad7d3ee458cb40cd9a174e5fa8a533ae11ce9fc16e84e820064815918e37b827f74bd80acfad1828c1f191c9012dc147", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192882, "uuid": "a2fa8009-8005-406f-8e54-2cff533efebf", "value": "T175452398DA1E26FD0A2152F2F41D6ED875E1B34200C757BE077C8BF03EF41A85A66D62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192882, "uuid": "ebb48fbd-9cfb-4d85-8690-9a25f9b5dc63", "value": "24576:28SMdOVMhYJzLFahdGIZk8WpbZZIkfwTy/GFJ2Nmp:2TjL1pCyap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791192882, "uuid": "8313cf9d-fa78-421a-91b4-36053867b289", "value": 1216199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791192882, "uuid": "54807bf0-53c6-4034-8d9c-2623eb6a3735", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192882, "uuid": "b217ebb5-a64b-4d33-a1bb-760313779b08", "value": "secured_stub.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1404fde5-c0a0-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791192918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192918, "uuid": "e2fad361-97c0-426e-807a-fb969b4d89e4", "comment": "Malware payload (Formbook)", "value": "a5c784aaa18cb3d8abf3d8feaf7b4203", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192918, "uuid": "e6878108-102f-4e45-abbe-9f6f6ef51daa", "comment": "Malware payload (Formbook)", "value": "69a482c5823cd333423121c9eb9235d445467018d48a964b634ed4cf3754c37b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192918, "uuid": "7550ff63-53c3-47a6-bd84-fc6763c1dd77", "comment": "Malware payload (Formbook)", "value": "da6bf419e5110a9eedc74fabe2138fafb8c55894", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192918, "uuid": "1e3cf978-a30e-49f4-bfbc-e02a7a9bf91c", "comment": "Malware payload (Formbook)", "value": "29ba3a2fe169c5932e6b53e8fb1aeb6a272eebe27b5c672164496053d86d8f56adf6324d44d2c9e94d4e5f1703aaa94f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192918, "uuid": "386e74f0-ba60-46cf-9731-466035ca614d", "value": "T184150118325EDA02C4B557F40C30E7B507B4AE69A921C34B8EE6FCEF79367516A042DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192918, "uuid": "b59a6f63-3a05-4953-a281-dcc53357b3c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192918, "uuid": "50441f7c-430f-460f-b0e1-8cf44acdef8c", "value": "24576:h6dXIEsu50p3b4KHp6fAlerKZoaXkg9ZPMGbr2Ogqa9X6:h6duuy3b420YgrWLZEGbzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791192918, "uuid": "2b2fc4f9-522c-4ed1-9960-1a5f99a726df", "value": 936960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791192918, "uuid": "69976a7d-bd31-49f6-b5ff-e6c273b2da92", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192918, "uuid": "30f4b2ee-5e35-47ea-b6a5-332e81c9d776", "value": "PARSAN KISH INQUIRY_pdf.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1638f36-c0fa-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791231864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231864, "uuid": "b7c53f8d-d499-46e3-bf44-bcfdbe497263", "comment": "Malware payload", "value": "d01e44fcc94f9d58b8ec5e3a22ef6595", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231864, "uuid": "0027614f-21cd-4a51-a3ae-667ca16704f8", "comment": "Malware payload", "value": "6a4d08d95ccd572125cec50d5f46324ed54ad48186db913a6f30c8501c4db130", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231864, "uuid": "d124efd4-964f-4024-bbab-c387c1a2b8c3", "comment": "Malware payload", "value": "29e40634a9fcff3b5484fd1fc8f19cd7c68d1f14", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231864, "uuid": "84137826-bc8a-4498-a972-14498da6ccf4", "comment": "Malware payload", "value": "ac81a16d4f113aebc4c57077fbf8f98466bfabf39ace145b0e4401ca683e97041b6ffe0732fa26daa0e06ce80287ba2d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231864, "uuid": "b94432f6-ced4-4020-a01d-2c7a4fc1f429", "value": "T124753306996CA413FCE34274874DB3F9CAC5705B0C84966B5E7582218D9FF980F3C9BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231864, "uuid": "1686111b-3467-4cda-8924-c27322e2c4ba", "value": "49152:aWiYkuloeFpiBV9L0o04CxjdWyb73OWSt:PiYQeFpiBV9L0olC3WaSvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791231864, "uuid": "8eb7a08a-7323-4c9e-adfe-c8e2417df507", "value": 1584664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791231864, "uuid": "696f21af-0215-4465-99d2-8ec98d066d48", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231864, "uuid": "9f0108bc-8cd1-4bda-b64e-765061b527b5", "value": "6a4d08d95ccd5721.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f217d9-c0de-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791219792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219792, "uuid": "c347683d-aa3c-435d-bab6-5a143f0c6698", "comment": "Malware payload (Mirai)", "value": "c8f5f379297441da898f754329b5baea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219792, "uuid": "b3d3d573-e516-4947-a743-0506ed1ddebd", "comment": "Malware payload (Mirai)", "value": "6ab288eba5f534d0457764fec6c5089bb12ecaf743c7289f01c38e9d93e0a7fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219792, "uuid": "febea015-54a3-4596-af25-83957ab52745", "comment": "Malware payload (Mirai)", "value": "ce7ca877f48ce2d994c6be9b077c074b4c033147", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219792, "uuid": "f1e6d198-aae7-4f44-83ee-fce4fb0b69d9", "comment": "Malware payload (Mirai)", "value": "4cd07021032b9b5cdf3d700bdb318da4d0664d3cf5527c422c9f968fc635997639a7282e1f60cef852532f21fdad97ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219792, "uuid": "41670400-7a6f-4b87-bcb0-41246cb51a2f", "value": "T1BAC49D07AAB3DDB1C4A380B151526FBA4971D536147BE94BEBD62CE4EE101C0A71C3BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219792, "uuid": "95cc97b0-61b8-4c20-b30b-fc6a1f082d54", "value": "6144:uVumrkAQfrH3mYPWSGxsktw7+NoAIKrvwrjyidVNnkwC9TJvO:RmrcH3muWSjEvbUTkwC9NvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791219792, "uuid": "235dcc98-fcc6-4b40-a3e9-faed2defa761", "value": 582552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791219792, "uuid": "6e9b3432-1ea4-4ecf-b55a-5e6ab5a27465", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219792, "uuid": "16f6bb2f-0cf6-4802-ab57-0b91d6544cef", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2652d6-c09e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791192313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192313, "uuid": "aef0ec9c-5a35-407c-824d-092d9ba96ce3", "comment": "Malware payload (Mirai)", "value": "17050a12da5db0f86d4b8edcae3c563b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192313, "uuid": "fe4bea03-32ea-485e-a7b8-28a3747c5da8", "comment": "Malware payload (Mirai)", "value": "6ad7962bb545eab340c23f4fe61511d99a04c051d9c5d4db26f47ce99244c030", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192313, "uuid": "b9192680-ce93-4925-bd99-30211ca671b9", "comment": "Malware payload (Mirai)", "value": "266511d78a2b1c63f4eb9bc786bc526293bdb065", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192313, "uuid": "a1db2542-1b82-44b2-831b-2aa9270b18e8", "comment": "Malware payload (Mirai)", "value": "d0745cd5bbfdb1b7445ba0ddc8c257c3e582d276c9b06b5b5b614f3622a61f8e45f0c33561920d8f3a867f350b5bbc83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192313, "uuid": "261a4410-0856-49d2-8f0f-c09c105c3466", "value": "T1DEA3122480143E51924A047BC6D54F0FA26E9D7CF7B53BE170E18324AFDFD622EC91A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192313, "uuid": "ced28ee7-eca7-495d-a295-0c8ba6672655", "value": "1536:QVtLqRaU17iTZKZusNqF3KkgiHQscv3Q7IDC8+94ZVLK3BGyaEr9alivrb5Mfv:KLE117iHixscv3+IDi4ZVKGrEAYjOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791192313, "uuid": "c5c4dc7f-fc2d-439a-9da2-435a7ca11d94", "value": 103164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791192313, "uuid": "ceaf4429-38db-49c5-85c2-d83e9e3d9606", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192313, "uuid": "fc31b72b-b61e-4d26-a186-178829229d25", "value": "6ad7962bb545eab3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df8d1f6-c0df-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791220047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220047, "uuid": "46079d12-f72b-4e7f-bc6e-a4d89c127ae1", "comment": "Malware payload (Mirai)", "value": "e67d74dc55d28ba38a56b8c070571df7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220047, "uuid": "5529d758-9dbd-4758-99f8-26d29a5613e7", "comment": "Malware payload (Mirai)", "value": "6afb2de29e95077dbc59ed0cca5b8d74ee9152a83ad3d5b8d0d3a0e0342473a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220047, "uuid": "d89ad788-2f94-45a2-bb10-db9ca4216cda", "comment": "Malware payload (Mirai)", "value": "9033e0f89928e604aa7d2e794a48db3cdf7970e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220047, "uuid": "13db4d39-0997-4663-886f-3eb2a6fbed4c", "comment": "Malware payload (Mirai)", "value": "a0def0588d5fefdc384b9db02506ff748123da74ae77fbde3c31597ea2c76be2dbe3d901b9c6385d9ca9defb8ee19a8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220047, "uuid": "5196ab31-e264-4157-bf80-54c32360c8fa", "value": "T167D47DC7BA60DDFAFCC6D336441306245020F2E255A29B2FE15E7DA5DB2E1903539BC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220047, "uuid": "8755a0e5-1788-49a3-be3e-43335904c0c2", "value": "6144:gex3W0HPesYqDdbGRmWoF59pMW8WFtAlTEIBGm6MyDRQx15LWzpJLbL1gu0HYLK0:gu31HPex5RuFLpb8L3etzVgtHY2deX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220047, "uuid": "dd66720e-839a-4c25-8d7d-4c9dc507ba0e", "value": 611252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220047, "uuid": "2eea595d-be2c-48a1-a002-0a3dc7a35feb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220047, "uuid": "0777ef19-51e1-48f6-aaef-762c79abb956", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b04e208-c08f-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791185843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185843, "uuid": "66cba046-9f49-4079-8b7e-21a18d9fd374", "comment": "Malware payload (Mirai)", "value": "438f8f02746e103860bd0643f9813b78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185843, "uuid": "89c20a05-25de-4b7b-a950-9bc2414a7b0f", "comment": "Malware payload (Mirai)", "value": "6ba73c5e125c7f7c9d7e51f377c924ee248bb5b7721ee34387d2c1985276031e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185843, "uuid": "ff3e2125-720d-416b-8021-304c5ea75d27", "comment": "Malware payload (Mirai)", "value": "741c80e8a7c7188276521f495d0ec8688497656e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185843, "uuid": "32264cf1-380b-4318-8294-3a0a3ecd84ac", "comment": "Malware payload (Mirai)", "value": "c0e78d0dd04e7e20870724b5994a4165a76a07a0ef4815e00da586923144b3cc42280f60260bc3ec0bad5ae99b2643cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185843, "uuid": "be3c4117-d80f-4c6c-b6aa-a34fdbd3a36a", "value": "T106832A8377108F92D275973105F38B93ABEA26D217E29546F36CDA016E2135C682FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185843, "uuid": "a4bffe30-6378-45d4-b16b-540513db8270", "value": "1536:5B5rVw3vD7ki+RUbgMMYFXKnMg0IhJ63O0bzVvrdd:1Vw3vDAixbgJY3Iw3O09jdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185843, "uuid": "c99aa8a5-2545-48fe-8587-f9d9daead503", "value": 88388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185843, "uuid": "1a11a36d-eed8-452a-82d7-e6cce3332456", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185843, "uuid": "bd471971-5460-48b7-a990-f4b86ec7dc01", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab8d5bc-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791216176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216176, "uuid": "6b1b60a0-59d1-40a5-a51c-c0abbdbcadff", "comment": "Malware payload (Formbook)", "value": "4eba03f203e9a6a0410b8993da3da528", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216176, "uuid": "1365d2f3-376c-4c7f-ba7e-875ca2ad58cf", "comment": "Malware payload (Formbook)", "value": "6bad5f64830f45abe2775306962aa6cd98ab3d54977f8a662c35b3a407377ffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216176, "uuid": "768d2439-7e9d-4b42-8b1f-16498de33316", "comment": "Malware payload (Formbook)", "value": "6bcd42731c83df7598a04dba7f2233b5faeec129", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216176, "uuid": "e4aaba1a-9ca3-4fb2-ac17-75b6a2c32318", "comment": "Malware payload (Formbook)", "value": "84808ddf19f780483c5d296015371bda6b5ce4e41a259b9c327b8852de96e9efac89f24f77ee144fce1299802cf507d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216176, "uuid": "61a26831-5d47-4b1d-b15f-d0c76fe02594", "value": "T12405019423699A03C96667F51971F27917BA7EDEB521E30A8FD9ACDF3822F044C00793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216176, "uuid": "c9e4a7af-557e-4360-9887-2b7e60138326", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216176, "uuid": "24e7dc2a-5ddf-4041-9e7b-fd5553c5a476", "value": "12288:iYhmT3+HnZn326vf0edXoc328gKZXCukFvs/s21WrqstWqecna9fl+sX:ifTmZnG6bdYWNZ8FvsWT9kf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216176, "uuid": "c060472c-2532-4f47-8f1b-b68c25b60261", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216176, "uuid": "87a69ede-30d7-4322-ad8d-f27fd2469bc9", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216176, "uuid": "3f94690c-dc99-4678-a8ae-6706f0cfeab3", "value": "6bad5f64830f45abe2775306962aa6cd98ab3d54977f8a662c35b3a407377ffe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41af5be0-c0a4-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791194713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791194713, "uuid": "133f111c-bef8-41e6-9ab2-49ae5b91d407", "comment": "Malware payload", "value": "2aaa2370984af15261e51a730e800ea1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791194713, "uuid": "08983eaa-eb02-4cca-84c6-f32efa97f3d8", "comment": "Malware payload", "value": "6bde7ba7c5c9b5f000c2255dd3f87340a96ca9fbdf2b2d4688251c9adb4b88a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791194713, "uuid": "bfa17588-5701-49dd-94fa-9eaf0f306451", "comment": "Malware payload", "value": "dd111cc3f948496a120abd5efc780f1783c0176d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791194713, "uuid": "c66662ef-04e3-486c-9d39-1b2916026bd5", "comment": "Malware payload", "value": "e5fc80ef87f50c797c6b0bf8e76f276a9fd26e9d999dfbc90b2cbc66ea811f54cb155db13a8062eaa24c3050d993b939", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791194713, "uuid": "280d60b8-48a7-4801-b963-e4f79e35defd", "value": "T122663350B7C2C032D62B6931A879463A85374C71ABB695D7A3ED2D4E5FA29C0C338377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791194713, "uuid": "2ceafcf7-8960-463b-a04e-8497b08228d7", "value": "9ce03500daac3cc5bd62c70b89c90bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791194713, "uuid": "00beb0b0-c865-489d-a2b7-101619fb0f59", "value": "196608:HV2dr6fzL5GxJGfsPWKWSlfX3+7XqbvQ4BcFl1zO:wd2n+JveKWSFnsXs44B63O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791194713, "uuid": "4487dae8-b4a2-4266-b857-2dd9962076c0", "value": 7038000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791194713, "uuid": "c4262a28-f735-42a3-8e5d-ad6aca9f3ceb", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791194713, "uuid": "69f92707-1ea7-4752-b7ad-4d70e3496ba3", "value": "Silverfox.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7132d00-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181649, "uuid": "0cce145a-1ae6-4d97-9f8b-e92d5ab90438", "comment": "Malware payload (Mirai)", "value": "fc5389746c280eb7b254f80e3f51f684", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181649, "uuid": "d0acbe0e-c7a0-4d0a-ba79-492e0620842a", "comment": "Malware payload (Mirai)", "value": "6bfb3809e867a569b35317c9efc786516786439b53d5f7c660a98241a4c6e273", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181649, "uuid": "a552bc24-cbc8-4231-9d42-e6de9eaeab10", "comment": "Malware payload (Mirai)", "value": "b7579191f68a1a100a5e3b74bd90b30742cd42a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181649, "uuid": "95e69fab-67c5-4c5a-ad53-6412dcb49e55", "comment": "Malware payload (Mirai)", "value": "8ff342fbfb77cca012f75e933c3488221b2520b9213a6d9117c37992249be51612f759948037f62ea18a4542c7636c8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181649, "uuid": "88db0e6e-00f4-462c-bda0-1604b116401d", "value": "T187332B027228494FF9D61EF0393F0FE093AFE98024E0B585694EEB458676F771586F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181649, "uuid": "40b80e06-c405-4024-b099-ba8207537895", "value": "768:opgPdUwOe1Po/7wni3RiAPSnPfDPK32JjcRlgaizjrvVwipnpBX9QeZ3:D1FOe1Po/kcExm9Mai6wvXeY3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181649, "uuid": "9ae2df2d-f602-463b-b226-916202c57810", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181649, "uuid": "9a274579-7f95-4e10-8995-86a8cf352db6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181649, "uuid": "cc5dbee7-e877-476e-8ed5-4e98557edfc9", "value": "87sbhas6as.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eeb595c-c0fc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791232450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232450, "uuid": "eba92ffe-1938-4db8-9a5e-64c7ab430048", "comment": "Malware payload (Mirai)", "value": "1c44c4abf6b1bd699616efa84e1109cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232450, "uuid": "42bd979e-9020-4895-8a4d-a6762273fdf0", "comment": "Malware payload (Mirai)", "value": "6c1b74b22c44b02114fe6d43ceb77d984546003b2d53629a46e3e54d6f57fdba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232450, "uuid": "20cbb7f1-f660-40f7-b679-6385698c25c1", "comment": "Malware payload (Mirai)", "value": "d5d48b148c2e6b01397e99417b9ad05a19eedc12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232450, "uuid": "f633e6f5-ce6d-40b0-842d-1a9d8304f1ce", "comment": "Malware payload (Mirai)", "value": "66501e95129063bd17879432586612273d8b2fc4dcd701b01e493727224ca9c7f6e9d6ced140a0e017a3be20d3c980b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232450, "uuid": "612d9f72-5f6e-4eea-89db-d532d05ec483", "value": "T15BC2F1694218D472F1B45836FDBF0503673ACFF8C6AF362622144735E087D2796B9A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232450, "uuid": "effa1608-a783-4800-8690-a47979dcc490", "value": "384:XH2HEdV7UQDoYQHXxcjllK5+AWaFmK0MF9lz7X6AGexXVzonBY6plNnXhymdGUoM:myNUQUfhQllxlaH0MFjlOnGsts3Uozo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791232450, "uuid": "7cd2c298-3a9d-446c-a933-d3a5e0e5c683", "value": 27352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791232450, "uuid": "b70559d0-e5f3-4a0a-a7c2-7f2e7a80b74f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232450, "uuid": "1954e754-54a9-40b4-b179-d6b008d54d93", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d14bfc9-c0c3-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791208154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208154, "uuid": "f3a3bec0-6785-4485-8749-c31a5c100a8a", "comment": "Malware payload (Mirai)", "value": "e5d3cd10183cb2532aed57aa89106343", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208154, "uuid": "cc9dbac2-ba13-44f6-87ae-6b18b5d8aa46", "comment": "Malware payload (Mirai)", "value": "6c39373dfe5228575d4d49a03b3c5e8f80f77c4bb9bcc5716471fecfd936f9d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208154, "uuid": "9b80402d-b855-4b72-9829-60cd8ad212f8", "comment": "Malware payload (Mirai)", "value": "d4b6cd69625fdbec18db321bb7b0adc0c608edd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208154, "uuid": "cca455b2-3ebe-4e0c-939b-761c05df6a0a", "comment": "Malware payload (Mirai)", "value": "46dca94e32815da51c7831228a9323e2694e4a76cf507ba067a9faff6dc281c150def29763927ca34a3297913c8beebf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208154, "uuid": "4d09887f-ebf6-42ee-9ecb-efb94848386f", "value": "T13AD3F8CEF801DE7AF40A967AC8C30A177270ABB50A12D52672DBF5675A371C43816FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208154, "uuid": "d5555688-201b-47b1-b345-e5642119a004", "value": "3072:n4w4jrfvLcyoTCmaeHMWxj9GrywG3hlDABoZWUohh25:NKneHhxYywClDABoZWUohh25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791208154, "uuid": "d2c4fa4b-7d32-4793-a4af-07e65cd5e117", "value": 139558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791208154, "uuid": "0072c31c-82d4-4e1f-a6a0-4a2ba7185435", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208154, "uuid": "895c322a-6634-4632-961e-f72040d9b48f", "value": "6c39373dfe5228575d4d49a03b3c5e8f80f77c4bb9bcc5716471fecfd936f9d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd455960-c0df-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791220287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220287, "uuid": "f9684f5e-a4ce-46c2-9b3f-bd52cc91b489", "comment": "Malware payload (Mirai)", "value": "c723a5867298e151abf89c86e51b30c2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220287, "uuid": "1c5cb56a-c0ae-487f-8479-45ae92e41516", "comment": "Malware payload (Mirai)", "value": "6c6628d008830d2e2eeb16889a1d7612621a210fa0527f39bc70ee41e184171c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220287, "uuid": "14497691-b34b-431a-a320-a63b4cf3548e", "comment": "Malware payload (Mirai)", "value": "c1298a0b445d04b8be59ead150daa2c977f7e9f6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220287, "uuid": "25186dcc-eba8-48c2-996e-7e27f11bebab", "comment": "Malware payload (Mirai)", "value": "98d814eb9a4f72d577057a0fd6223fc38b4d53ca0c5bd75629e1ea7db84f560552e1d2eb98ab2b05921b954c46c9ed35", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220287, "uuid": "3a17b44d-f2ed-4db1-a702-0d5f89df9ef2", "value": "T1E8462811FECB50F6E903193145ABA26F63315C058F25DBE7EA447F29FA3B691093221D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220287, "uuid": "7b446c82-149d-4942-a9d3-be85b8e4f65e", "value": "49152:mFDcKNIGQSt4dAFRqCZxzfix//opiKo2Nnmk8OSnL4BT85E9:UAKjQStPFRqQG/opto2NoHE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220287, "uuid": "4fcd7922-e30d-49a9-898f-93b4ac93c690", "value": 5841080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220287, "uuid": "9a342164-1a38-4e2c-aa11-d9d5bee36b4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220287, "uuid": "5d36cefb-3d91-4b03-8dbb-bd0879440548", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dda5c00-c0ca-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791211108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791211108, "uuid": "0a897c22-ba3a-43b6-b7c1-119e576faf66", "comment": "Malware payload (Mirai)", "value": "8e3007b6b2b35f332ff29f1cd6c68910", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791211108, "uuid": "d94ab471-5372-4e35-a9f9-41f37340d891", "comment": "Malware payload (Mirai)", "value": "6c66da6a88feed930e48fd0d96927a19686a66260483ac5f2c6e536e4df4b073", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791211108, "uuid": "c952d211-a569-4fe5-81ba-2bfae5f4df8e", "comment": "Malware payload (Mirai)", "value": "163fb4284e13dd1db5a1439b2ad9f41aea01b791", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791211108, "uuid": "0d8bfdb6-7896-477a-890f-940495260fe7", "comment": "Malware payload (Mirai)", "value": "0b06431b69bbe929dadb5b9b15716d04d63dd3d4a03259d366f48a542c66c87d026e4a5df7ea156abb739983d920727c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791211108, "uuid": "9fd42073-1978-40b4-81ae-03aa04efb011", "value": "T1C2D44B032B2D0B43E3D74CF0777707F4879A989620F9E589EA0AADC69771870615E6CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791211108, "uuid": "d7019279-6136-4b0f-ba0c-1fcc39fc009d", "value": "6144:zH85Xgj8PSDJ8n3ZExAtjfLcWwlo/VkVmyoQjtyI8NE1czGUoGCxhy58fclvOS96:zWXgj5DJ836VmCjd8QFRfclmS9uBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791211108, "uuid": "4906727a-c42a-42d6-adff-c133ff44d858", "value": 641892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791211108, "uuid": "6d7a636c-a058-4495-abb4-0b4d79f966d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791211108, "uuid": "2cc2e7fc-e555-418a-9557-87c8c3766918", "value": "powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3abeb28-c094-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791188086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791188086, "uuid": "8a02d7ad-8ccc-4ef3-a51a-3dfa5910bb8b", "comment": "Malware payload (Gafgyt)", "value": "14a04b7659e8e9acf28b8f56938afc6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791188086, "uuid": "18c00aad-9f72-4e2a-9291-59185b90d724", "comment": "Malware payload (Gafgyt)", "value": "6cc5fadd255dbe4a2ba75a297a8e714e47dc85ec1acddab3be3d37866e918872", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791188086, "uuid": "8580cac8-e4cb-4e9a-806d-9ac8e444c09f", "comment": "Malware payload (Gafgyt)", "value": "03db8665edee76c0796ac7096a616f357e192536", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791188086, "uuid": "16e83dcc-7d5d-4575-bb4e-9349bd82280b", "comment": "Malware payload (Gafgyt)", "value": "c65d49dee496cd04b29ba70fa7b7e816e1511b7a1d7e2c3bd8300e2d1e179ed6c703c5a2994497b246ef618de693fade", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791188086, "uuid": "c00bfe27-be39-44bf-bd9d-26a0d88f8d0f", "value": "T1D864C62A7E61EF6FE678C73107F38B74879521D22BE19346E26CC3181E6028D585F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791188086, "uuid": "8f6527d2-668e-4dca-ba34-628e27b72ad0", "value": "6144:RrLXMiMaXCx39D8z+a+sTiEJBNDt1ALnhvYHtjGL5Fh5V/qOAYP:KaXCxlad1YhvYHtjGL5Fh5V/qOAYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791188086, "uuid": "b57dd0c4-2a88-4299-b056-fedbcb72334c", "value": 337037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791188086, "uuid": "40b8ea4c-ecec-40e6-94b5-ff40e910d2f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791188086, "uuid": "e840b76c-cde9-4bfd-9a90-bd4a806c0f7b", "value": "dissmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00bee68e-c0e3-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791221662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221662, "uuid": "dd93a798-caca-4ac3-ad18-8adf590f6ac0", "comment": "Malware payload (Mirai)", "value": "8c9b8981310b14d6be6af5809cc4b11d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221662, "uuid": "78de076e-2a7e-4196-ba75-e04e017ff0bc", "comment": "Malware payload (Mirai)", "value": "6cc6e4b218bf4a9c97b0a95fc007c17de5687fa3f4fbb04f1d5f71b3f099ef7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221662, "uuid": "6f33d818-e3ca-48d5-9399-120e43151457", "comment": "Malware payload (Mirai)", "value": "64c35d013ab59affbefceea7598bb07990ff075f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221662, "uuid": "96377acd-6356-43ad-aff4-cfea0b2ac1bc", "comment": "Malware payload (Mirai)", "value": "4b7646bb1681ca96927b044970d14be2afb25756dd1f91e1e23e0eefe1d1d4133bd164a08a38427096410b371467009c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221662, "uuid": "e78154e2-c3b9-42f0-8669-0e7abf01e6f8", "value": "T1E1343A03768185FFC486D2B457DF5D369D31FC2D4A36719A73D0BEA22E18AA06B2E710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221662, "uuid": "08833963-b97d-430f-b10e-b882fb876975", "value": "3072:T0Vfj1hbL41XKcb1JrNd0FfQ9kQA4BWaAD/quJeTXvUOi/WQKSM:T0VL1hbUf26b03DsSWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791221662, "uuid": "89391a9b-dd6b-43a3-ad90-7e5d3dca11f8", "value": 239664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791221662, "uuid": "1291ad0c-1010-4604-9a2d-1c04126f5f21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221662, "uuid": "ed38bf7b-248a-4b1b-b167-f15b53fe29f9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c28da6c-c06b-11f1-927a-4201ac107004", "comment": "Malware payload (WannaCry)", "timestamp": 1791170142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170142, "uuid": "f05fba0a-8d73-4a54-948d-d87bab84bd05", "comment": "Malware payload (WannaCry)", "value": "60ab33b01081d37beeeb3c62ae8e3333", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170142, "uuid": "a5fd0f90-667c-458a-97d6-f410a304e6b0", "comment": "Malware payload (WannaCry)", "value": "6d69d14d77978195334345025800554e5505d2b9158ad21d78f4b9e3c099453b", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170142, "uuid": "3c7e5c37-f9bf-450b-846c-c9e81aaf22b8", "comment": "Malware payload (WannaCry)", "value": "4965d46257b87fec0f130efce1fe600eae65a70c", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170142, "uuid": "f05a9008-68f7-45a9-8076-68a8544d5e39", "comment": "Malware payload (WannaCry)", "value": "617416cbb4aa4d7cbb9d66ee163bfb618e1001943ca5e815986b4ada0a1207f1743dc980371fc77c9d90a447e130bcd6", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170142, "uuid": "324a2381-c79c-44f4-a252-ccc84280db96", "value": "T1133633D471A890F8E1020AB488B74E15F7B77C3923B75E0FAB804A7A1E53F97A754352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170142, "uuid": "0c788b63-449b-4235-b0c3-0fefb73f7e27", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170142, "uuid": "6bfab9f7-ebd1-4106-988d-bd67231ac8ae", "value": "98304:D59PoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:D59Pe1Cxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791170142, "uuid": "131cbd99-bef7-4e06-ac6d-a4d65fb450e3", "value": 5187584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791170142, "uuid": "aac9d63e-40eb-4958-8512-94bc14d710f3", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170142, "uuid": "83dacbda-99f9-49ec-85dd-ff225902a053", "value": "6d69d14d77978195334345025800554e5505d2b9158ad21d78f4b9e3c099453b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a5f023-c0e8-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791224107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224107, "uuid": "a6af0b16-3f77-4b19-a7d7-673128286d01", "comment": "Malware payload (Mirai)", "value": "5e6baf40ff17a5ce7c9c434ad420a959", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224107, "uuid": "13958110-866b-44a1-adb4-a2f8f88f95d9", "comment": "Malware payload (Mirai)", "value": "6df0d390f40bc88769dadc113f99a10dc34772110195b8bf0b2bf7c6a35192b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224107, "uuid": "3f69eed6-6585-487c-ae12-6e95e598e161", "comment": "Malware payload (Mirai)", "value": "c612ae753647a4cf512008a071e401d8612071c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224107, "uuid": "55051022-fa39-4e62-b9fe-a5db95f96904", "comment": "Malware payload (Mirai)", "value": "856cc6af0c1cd49e9f046bb49c4bfe63380a28be1706dcbc8c8115a8354dc45df77de87e2f4c01b1d0facf5ba9884d5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224107, "uuid": "33384a8d-3113-4fd7-afea-fae455c540d7", "value": "T1AC149D72C8A56EE4CF5496B4B1B1EE7D17E39A1440470FBD68A6C6384087EC9F6093B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224107, "uuid": "63171c32-4414-4bde-a5c8-9e150b100e99", "value": "3072:j1WH0+4SLRUlLSTMpqTOTkpBiNupS0C96AkbHtRWqRvsX6G:j1W948xcfT8BiNupZTn8qRY6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791224107, "uuid": "0be6bf64-07d1-4fef-9b15-2c0c53c525b7", "value": 207708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791224107, "uuid": "30029905-bd65-4367-84cb-053b7c8e78ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224107, "uuid": "42969de7-fdea-48ea-ad92-03ed416a56d3", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff27dea3-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (PhantomStealer)", "timestamp": 1791190736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190736, "uuid": "96bfd723-1b6e-4f0f-a2a0-1610ea92e874", "comment": "Malware payload (PhantomStealer)", "value": "0f80b1c3d5ced6b5b64b2c0839229d0a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190736, "uuid": "26321a29-f441-44b9-ab32-830e3254c410", "comment": "Malware payload (PhantomStealer)", "value": "6e3cd90bd300c392902c9848e4d317b964cc5941b9302e06096b23a9536180db", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190736, "uuid": "9588e49b-aa22-4c7c-a059-7c607390f1bf", "comment": "Malware payload (PhantomStealer)", "value": "bfd47d40b4b5d668620af5a1606162362f940bc0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190736, "uuid": "fe1e93c1-9c5c-4875-a1e1-20a6425aa89e", "comment": "Malware payload (PhantomStealer)", "value": "ba3db94eb35768d1a9b2a8b71906c388f44384a8f524cb76e3c639e72a2ec8fda0d1d0f592ac2fb1756476e1c66daaa1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190736, "uuid": "e2013102-4a54-47c9-8b24-e72c8fa68e8e", "value": "T15E16F67A1254C1B1B3AD6B1CD23A96A09AED340335D59B3E30ECF645334DB46378BAE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190736, "uuid": "e85cce96-0d75-44e7-9759-a8ac8d68b2de", "value": "98304:mnnzdaQVEaLIKbO1GbCK1oid+w7jCbZu9v7u7HS1AYUkSxGlDE1JgPlfVXcLli2P:j7K1td+u9v7u7HfkS8lYQPnC31x2LwA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190736, "uuid": "1c3d7ee4-cb91-4cf7-ae3c-671a24a3ca55", "value": 4386472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190736, "uuid": "10881060-af73-4d41-905c-36c2d14ccb46", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190736, "uuid": "b1a3d72c-7a71-4329-853c-2b2c41e2bc66", "value": "QUOTATION.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da27eb91-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181654, "uuid": "ce91bf87-90f7-4c0f-93ec-2224245dc981", "comment": "Malware payload (Mirai)", "value": "d3f69cda9af4f8781ce93cb32918b9c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181654, "uuid": "2922692e-2b1d-46e4-bb32-026ea0951a35", "comment": "Malware payload (Mirai)", "value": "6ee8bcfecb35f12d4dfbf7a39cf6d18ba2bab5df7cbf1051f05b34339e3923ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181654, "uuid": "bc09159b-9e30-42c6-a8c8-e3c815b083ae", "comment": "Malware payload (Mirai)", "value": "208e9b238d216d01ebae6302e7ba54f69bd9aaec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181654, "uuid": "f64f6563-9404-4d9e-9e79-6d93ee45e4a9", "comment": "Malware payload (Mirai)", "value": "88d65750424d4260216851168f589dd5ae19d3be015fbf5955b76422f63e01c32350f4bb2bb59013f003cf24f969672a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181654, "uuid": "882297f5-11aa-4ffc-8f9d-cd774bfe7ab1", "value": "T19D53017B35C09E15FFDA82B325E435980B291706E158B69FE1D871E98CE0FA72771243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181654, "uuid": "fce10526-cbdd-427a-9a55-07e4e57eee05", "value": "1536:GCZ4QtJP1K3zhEtQK0Xrp0r+c/fADGiIwH7D+Nnouy8U:GzQtJP1GzTKgKI9H+1outU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181654, "uuid": "1283a17b-4e7d-42ec-bd4a-bc2727f7b218", "value": 60948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181654, "uuid": "d1afccf3-64ff-4ca4-8055-e675db532ec8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181654, "uuid": "f0e3ed28-1134-4711-9956-72dbe845a335", "value": "wife.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9261f756-c0c3-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791208163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208163, "uuid": "dc06590f-a302-421a-b150-d32f4cfa4790", "comment": "Malware payload (Mirai)", "value": "4c762c041b5263dae15f5f5fe05f0b9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208163, "uuid": "469581cc-d0a3-411e-8a9d-268e27f9e2ef", "comment": "Malware payload (Mirai)", "value": "6f7a9c10270e942b41d1203b5f023f5685b86d9c91b844bf65850b0c3d0f7a04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208163, "uuid": "e6aab860-3eb1-444f-8e68-00f8fffff05c", "comment": "Malware payload (Mirai)", "value": "35cec1fa64a962466075edd1acf760b75ef46981", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208163, "uuid": "7db4a652-dde3-4c4c-8104-e2b431f72315", "comment": "Malware payload (Mirai)", "value": "956735579a719c7877befe246cf78ab300aab9f0af60749a57925f0c728a89ed191908571f9fc648a6d41034c21e308e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208163, "uuid": "28007367-fe89-4127-b55e-e3d0ddcf40ff", "value": "T15EE328DFDA2C07A7C49B5AF0AD6723F78768A5B012A1D1C492CBEEC407726742121BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208163, "uuid": "40a5eb41-d446-48c7-8bad-258de0472463", "value": "3072:6MSjtr7J6dPwWSQWwiwyoHJUcjvZwoRtg9LD4kBoZWDahhy5:65jtnJ6dPwWSQWwiNoHJUcjZwTxD4kB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791208163, "uuid": "d02757b4-05e5-46ff-8aaf-062149c8998d", "value": 143210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791208163, "uuid": "e80a08be-137d-4cc5-a942-2909b7997dab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208163, "uuid": "cb660e1f-79fa-4c74-8fbd-d778d51e8557", "value": "6f7a9c10270e942b41d1203b5f023f5685b86d9c91b844bf65850b0c3d0f7a04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "966fa5ab-c086-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791181970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181970, "uuid": "08358093-dc4a-450c-aaf9-d62db31766ba", "comment": "Malware payload", "value": "d59809603a8cdb3d579d7029b81d4b17", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181970, "uuid": "86a4fe8b-91b4-450e-a7c0-74fe3ea569c9", "comment": "Malware payload", "value": "6f87fe31ec8fad25aaada655ed70ef724bc8e3672b6c2202356157267533a91f", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181970, "uuid": "74a7e63f-e3b1-4846-bdd7-2e425ee2dd60", "comment": "Malware payload", "value": "eb338a8a360bfb7bc82bc17ff21badb07bbf1abc", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181970, "uuid": "98d0b3df-11c3-400d-8339-aa64cfab57cc", "comment": "Malware payload", "value": "b46e45023a693591ffec7165c076f32b1c6e7278e957374d8f9b47b23b9b3870515777f94769973416a6024320a9e634", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181970, "uuid": "e4ad0c8b-9b5e-4d1d-ac90-f899ab47d5f2", "value": "T1D301F48CA1BCCB81099DC9C6B7F05904458095C7A1F897F5F28E0D246F48A49795220D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181970, "uuid": "c85c138b-cefe-4eec-8d02-03f775936df5", "value": "12:FzY8id/7JAC7akxGWi2jX0KTkcIICjWSlx7kNnv:FzY8k1/sWi2jkDpJk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181970, "uuid": "4f3513bf-24ed-444e-b0f7-e124213d8645", "value": 684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181970, "uuid": "b93f8873-0bbe-466b-8e07-9df022dc997d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181970, "uuid": "164d3c15-aec4-4ddd-922e-a8a604649928", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf87139-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181765, "uuid": "2bb71b95-95e5-4130-b1dc-b179e71ae721", "comment": "Malware payload (Mirai)", "value": "ce767018c2eabc6092b65d19e418ef9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181765, "uuid": "25a0d6c3-87b2-4861-bda9-e3fe57b5681c", "comment": "Malware payload (Mirai)", "value": "6fb9fe92dec1525a848dd9e29d435c7d34632ff043250f7e46269bd943d8e37a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181765, "uuid": "2539868c-43d6-4f2c-965d-23ced1821954", "comment": "Malware payload (Mirai)", "value": "9fd8f0c692cff748ed545ba946333b697907167b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181765, "uuid": "56891b9d-fdc5-4112-9681-79eaf4a66bec", "comment": "Malware payload (Mirai)", "value": "5f5fd4daeec6d3fe90483d4fb631c6a1449942cdff3821feea672f0952c9918551a0ebe68685b7ac81d991d887cdb432", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181765, "uuid": "68c5ff0b-7a6d-4fa8-8c0e-efb0c3d176f5", "value": "T152042902BB0D0B43E1532DF0277B07E1839BADA629E6D584750ABECD93B1DB16506ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181765, "uuid": "38fa1426-bd5c-4c97-835d-d4fa8e22746b", "value": "3072:jNiXEIY/sJzDuCqxGv+mtiaK36GjDqbrcH4K82/g6:s3wspqx9mtiaK366DqncH5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181765, "uuid": "9aeab6b9-7ab2-4246-b31e-4753709e3e50", "value": 180200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181765, "uuid": "08509533-ecd7-4eca-95cd-0d6161c36a23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181765, "uuid": "f0138614-ea41-4b10-bca8-50c6da4c8ec9", "value": "wife.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a897723f-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185866, "uuid": "8fe7aa76-5215-4dc4-a380-5ed5281f5db0", "comment": "Malware payload", "value": "2b4298d6559cf86182d6dd9ecaffc4ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185866, "uuid": "4b1e6313-4326-4fc5-b39f-82bfdaa64d3e", "comment": "Malware payload", "value": "6fe60eb5af3084ce38e9ef5031c11f2c0914ba773f6ac159b7515de9780c907f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185866, "uuid": "8e06e5c6-046e-4125-8c30-f9da4f202cc1", "comment": "Malware payload", "value": "6f0a5d2898ae830a733f6d55ccdd735528bae9c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185866, "uuid": "c60d90bb-bdf5-43a1-a316-a733ffac7678", "comment": "Malware payload", "value": "a8cb339c7ccdb98a473e588ad6f256c11a7282eaad2405eee4fb12411008f17137a8b5358373984b987f2cee8af2ae64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185866, "uuid": "f77a7055-8028-46d1-9b16-5d4104888242", "value": "T1A4F433DF6281105CECBC33677ED7BF45EE40961A959307814AD472FFA431EA84E4B2A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185866, "uuid": "498146bf-6202-429d-85e8-88f453b083a6", "value": "12288:tFnsdDcqFIHABGWaYFZIiZHbsSLzk0H7d0RDnIgjP+0PHUysCCBhxZ3HujUGno+d:tFns1cqFIgfaYFZrZHNzkKhQ+0PHE/ON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185866, "uuid": "df3f8948-3857-4050-99b6-00f65796e86b", "value": 724840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185866, "uuid": "ed7730b6-d25e-4af3-9393-ad1801e71cde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185866, "uuid": "bf2832c7-7f74-45e3-9d65-054f93daa3f7", "value": "mb.amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb9e1b7-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1791190655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190655, "uuid": "067f4cd8-6203-4701-942f-3a28ee3320fc", "comment": "Malware payload (AsyncRAT)", "value": "a335856b648eff78adf93f7867662ceb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190655, "uuid": "d06675d0-2f02-446d-a82c-bd7f76178306", "comment": "Malware payload (AsyncRAT)", "value": "6fe8d443083a204dd43f06ff1f78770b63128af855b40c8155c3792ea54c0d68", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190655, "uuid": "7facb737-1341-4a74-8812-28aee363b754", "comment": "Malware payload (AsyncRAT)", "value": "a89c3a073079a29faac7590fc7313def4cc80c5d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190655, "uuid": "804b41d0-e5d8-4c38-80c8-25e337a8d4e4", "comment": "Malware payload (AsyncRAT)", "value": "089577b60784f943af3e96241e2bff4b93171d454266b78882a3343047ebcc9bdbba425f8331746a1f4190f6d8b5b429", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190655, "uuid": "4bc80b2b-4bff-41cb-8ee5-b8870a5df801", "value": "T168465B31D30C8F42DF065001E9B59A648C43C649D738E9C87E2E25E2AA5C7B73B9FD66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190655, "uuid": "8e7740d6-de1d-499b-beb0-81212ee97031", "value": "1536:wXK8Fd5RPoHyAbF/zw8KTBoLDVGXxO2ajgK/+M9DFmOk+qMoLZhPAz5L/YyFH36C:uHIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190655, "uuid": "894c18c1-60d1-4d67-a6bd-5cc684a291f3", "value": 5788784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190655, "uuid": "fabd4aed-2964-4233-8775-c0fe9ab03b72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190655, "uuid": "ef357ce5-4c57-4aab-ab01-e6c39d2007ef", "value": "YouBuild-Payment Advice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bcaedde-c09f-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791192636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192636, "uuid": "ea79e3f6-5dc5-4d78-827c-072cfceb9dc1", "comment": "Malware payload (Formbook)", "value": "176717c80c7fd0eff63434b05aed714f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192636, "uuid": "237206a7-e1d2-4db3-b8a4-e33b7f7a1114", "comment": "Malware payload (Formbook)", "value": "6ff069b653fcba8ffe8bcdc8463d38ab02376f4281b1c1b5183b7909d8a282bd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192636, "uuid": "0833829a-84ff-43ac-b6c3-27f8d2b4b79c", "comment": "Malware payload (Formbook)", "value": "75f51902450e6e3e0dcb90285190defe459e27f0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192636, "uuid": "f23aa1bd-f8b0-4697-9de3-acbcdafe08e0", "comment": "Malware payload (Formbook)", "value": "6ba68fd6141b2fce4c74e53917a327b0747324257ce9614e559bf0368c6e4b3ea11b904234e641567a181c05c641455b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192636, "uuid": "ce09f11c-2275-4d0e-9662-f5f4cb3c00d5", "value": "T1BFE5305DA6769BB90B9CF287493CA86C3E4DBEA0C13010B5BC3EB25BB15CD18D15B52C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192636, "uuid": "b03fab14-3ac7-4a98-8e92-24af5028077e", "value": "24576:TdsvHC5Xve2OZyQ+1ojbGmDyqKa/XoxXDFvDyys55vQOXGESV/eKLe28eQcsFeOG:TdGWX+VkMzMteKRi9VSXBR90AnyJqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791192636, "uuid": "fdcfecb7-0d80-4977-9965-dc92d2efc012", "value": 3235512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791192636, "uuid": "cf0e891d-2d66-4e98-822d-313cac7ae2e0", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192636, "uuid": "dc32c7e5-133d-460e-a465-40aac832820b", "value": "PO7780804959GHMCN3395858EU.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f264b0-c08a-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791183823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791183823, "uuid": "664b6ad1-fa1f-428a-ab06-bb0cdc4bb62f", "comment": "Malware payload", "value": "c613c33c0ad5f013b91ea436821060b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791183823, "uuid": "e65195df-6d52-4b5c-b918-2d3d9727ff99", "comment": "Malware payload", "value": "70a09c4952159e9c80611b1128da01c5875c616311429f047338a432edb06382", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791183823, "uuid": "7a75309d-2e2e-463a-b082-9c92c6224ddf", "comment": "Malware payload", "value": "16c045bf2fb90996e68fcd760e423ecbcdc62944", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791183823, "uuid": "895b77c7-b636-4ae8-9f16-fe405c869a72", "comment": "Malware payload", "value": "7208ac457eb2037bf5b2d285dd4184316ca8d68eedf37282b2b3d550ea89ea242aa5df68f7dab6e6b47244877aad3a3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791183823, "uuid": "0fe75bb6-4474-4dda-8f64-7b33f62055cd", "value": "T166644C05EA408F5BC1D11779FB5E428E33339F68D3DB73029A24ABB42BC6BAD5D29111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791183823, "uuid": "d02184d9-5e04-4d9e-bf66-9045d2fccddb", "value": "6144:+vK+gmGFsMzPXskVeaUX+Y6SV0A/GTym+cCnVpc9myz5c4yZGVLmxUNt:+yb7XReaUfVV0A/CxqDc9myz5c4yIVLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791183823, "uuid": "55582b72-75d4-4418-b396-6a8c13a82b47", "value": 307492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791183823, "uuid": "5263f84e-c077-4666-874a-b47cb62d93ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791183823, "uuid": "a39f9fb1-51a6-4c21-919d-2e7e30069413", "value": "dissarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3cf571-c0ea-11f1-927a-4201ac107004", "comment": "Malware payload (NanoCore)", "timestamp": 1791225007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791225007, "uuid": "10915efb-42aa-4c71-8000-81adb6ddb41f", "comment": "Malware payload (NanoCore)", "value": "6721f76518a60a424d02502fb4255fa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791225007, "uuid": "600c3b6a-3392-45f9-aab9-2fb0ab6a29ce", "comment": "Malware payload (NanoCore)", "value": "71145362a2382c5de9ed2f1a374b5e5dc2bf6b054da31f28ae911dd117cf11a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791225007, "uuid": "4834aeca-246e-42ef-8fba-e25e809d3483", "comment": "Malware payload (NanoCore)", "value": "79493fee569cf865585fc8f2a4298a482054e56c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791225007, "uuid": "63ff72d1-0ced-43d2-9f2c-4066be354347", "comment": "Malware payload (NanoCore)", "value": "d3d4cf1a7e9f9a10505a6e621ed001232d424520def7839691f8da1aec68d541c297740b4d3f2076cdf1f31b3afe90fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791225007, "uuid": "9b34ffd7-ab16-40db-b7c5-67a42b833da4", "value": "T1C914CF6677A44A2FE2DE86BD702251168379C2E398C3F3DE28D451B78F167E10A472D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791225007, "uuid": "3a8d1da4-5a4d-497f-af67-31a4e76e8b95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791225007, "uuid": "ccc75084-ebb6-4763-99ce-1dbbc7646759", "value": "6144:sLV6Bta6dtJmakIM5+s7UBmOKqVotp/wK32D:sLV6Btpmk2QmGuAK32D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791225007, "uuid": "83b4767f-b33b-4754-8e39-82c1e98cb4f8", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791225007, "uuid": "955cef9f-1d88-4b81-817f-464a5e23affb", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791225007, "uuid": "bc816689-5c9f-4827-b78d-e09d139020c6", "value": "6721F76518A60A424D02502FB4255FA5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a94165-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185886, "uuid": "b2545065-6e39-4204-8215-cabd48b84c45", "comment": "Malware payload", "value": "a3836de77e4a63cfe237a07f1a57f33f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185886, "uuid": "21f80836-f342-4b15-b7ce-7e064ae640df", "comment": "Malware payload", "value": "7169b500fdfa8035ff5c7ecbbb0220471438ce2f368b51b0076f9b924c8c1ec1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185886, "uuid": "9befd2f9-b754-4cef-93b8-5bfb617f4f20", "comment": "Malware payload", "value": "214f68378e68097606a2e274a625dfec8c34d64f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185886, "uuid": "5d5d6b22-c911-416c-bc6e-4b137e0f5d7a", "comment": "Malware payload", "value": "1650973593e8b459859d95f61ecd1bfb31e7e2ec9537f8c691f0fff985860633d4e5678d4e2bb8eee13fed812be38e3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185886, "uuid": "115a038e-3830-4fc4-a485-cd8d995ac478", "value": "T190E423B586889A969A3FC42F0A124232540FDCFD84FD0D78F8F76405AF986F9614D3E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185886, "uuid": "a1eb4687-72c7-4bd0-a940-611b6c325b4e", "value": "12288:UtLT2aCeD4iTmrU7CehZPHGN5QhWpOW3HWtgPt0e0A67EOKDPxr+akUTQQ0oZYB8:UovebmoCePeQQZ2O0XKPxKakoQQ0eYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185886, "uuid": "31fbaf5f-2c08-43f9-a99e-a5321e8878b1", "value": 675444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185886, "uuid": "bdf56dc0-87e2-464b-81f6-88ab9cb7fbda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185886, "uuid": "cea9fcbf-c918-4ac9-91d1-57a1a0417bba", "value": "mb.386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb631206-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791190649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190649, "uuid": "ee64d24c-ea85-4339-a905-ba89fc62580c", "comment": "Malware payload (AgentTesla)", "value": "381ac15696f175b7fa672c8c5fff4e4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190649, "uuid": "951313a1-e939-488c-8dcd-b300395ddedb", "comment": "Malware payload (AgentTesla)", "value": "71c9ef680ba54d9324324bfb09631ecb903e956c07cd14c2b860a0ec1bdc229d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190649, "uuid": "b22d3de7-c0d1-40fc-bb9e-39ad6567c3b5", "comment": "Malware payload (AgentTesla)", "value": "f6ef672acac467c461ff1e4eabf7e9c80da7093c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190649, "uuid": "d334ace5-7a69-4fef-83f3-e8e1720f0593", "comment": "Malware payload (AgentTesla)", "value": "310863cba61cbd490b117fb8201920bca70986bdcbd457e16b3da03d4679df2ae1f94c33f23d11deb7bbf67f8a0980af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190649, "uuid": "7cbb5339-e31b-4a64-99d8-5bd098168d78", "value": "T137E4E01CC21CCE68142C132E6757AA8C22B7D724529CED89E4C9D3FB7699781F4ACDC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190649, "uuid": "25a4405f-aeb6-4292-aff0-9650377f6fea", "value": "12288:5CqMmwColFyr+6JaksZk1zUSbsYcGNUieH0qKg6NZelmizyU2S+WDTqV3:5gCxt7JUZYcGNv7Hsemno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190649, "uuid": "39f3a0e9-92e8-40f8-b278-521dfe7e4753", "value": 705706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190649, "uuid": "ba0d57bb-5c2b-4f41-a038-41622893a3f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190649, "uuid": "6b6e6e17-2e37-4667-91cc-f231c30e174f", "value": "PRE ALERT No U82420994010052.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b88ff52-c0d8-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791217063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791217063, "uuid": "4cece560-780f-496f-80fb-c7444b623c45", "comment": "Malware payload", "value": "74e28ff56ee527fe955e404861a4c71b", "object_relation": "md5", "Tag": [ { "name": "bun", "colour": "#5F490E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWH", "colour": "#5476E7", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791217063, "uuid": "fa891ad3-59d1-4f39-aba8-95e2bbd33471", "comment": "Malware payload", "value": "722552977aa29059abd535e5ed5b92e3de3a31e269d92210845672f4894f3404", "object_relation": "sha256", "Tag": [ { "name": "bun", "colour": "#5F490E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWH", "colour": "#5476E7", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791217063, "uuid": "503886d0-42ac-4cbe-a7c5-2c01d7474ed0", "comment": "Malware payload", "value": "821e250375639d3491d8380a3383d419ade3e1ca", "object_relation": "sha1", "Tag": [ { "name": "bun", "colour": "#5F490E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWH", "colour": "#5476E7", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791217063, "uuid": "198f0b43-5c25-4c06-b563-9a20e1b83d52", "comment": "Malware payload", "value": "6f9ff8d70452fd7cea29a53dd65524b68afc4e8e2c1a66e3e26b455eb38b64814baf91ea136d81fe9bdd4cfb6c5eaede", "object_relation": "sha3-384", "Tag": [ { "name": "bun", "colour": "#5F490E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWH", "colour": "#5476E7", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791217063, "uuid": "eaa55d25-067d-482a-b7e7-a2a0c4effff2", "value": "T1BE286C43A2E751D8F0BBD17496E65323E933BC490B3469EF12944B312F72AE0A779B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791217063, "uuid": "f6f11fe7-d855-4325-80e9-c7c5e5d11df5", "value": "fd6f6d07cc33ee9a2b65bda58a07bb94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791217063, "uuid": "7d0fc7d4-2d08-431d-ba19-4193001f1351", "value": "1572864:8Za7hmguP2nG0/Vyv7UhgxIabc/97Awb0:8Za7hmguP2nUOTAwb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791217063, "uuid": "632c54a5-1f88-46dc-abf9-f40b949ef64d", "value": 97990656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791217063, "uuid": "8e059d8b-4fae-47a3-a73a-d433dea63bbe", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791217063, "uuid": "a49e9def-26d1-408d-91dc-6a33970d2c6b", "value": "722552977aa29059abd535e5ed5b92e3de3a31e269d92210845672f4894f3404.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d20dac-c08f-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791185853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185853, "uuid": "621e5e96-e791-43da-a514-526b40eb6635", "comment": "Malware payload (Mirai)", "value": "1ba9a6410d89b9fc0a603a37bf21d5b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185853, "uuid": "12546242-6ac5-459c-8ffc-6ac5a14b8b4f", "comment": "Malware payload (Mirai)", "value": "72450e617af5eb05a48143011b8a231034ae48f4fe4746dde896e106d75a45a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185853, "uuid": "e3579edf-50b6-422d-aebe-b9e87cf094d3", "comment": "Malware payload (Mirai)", "value": "15f2afda727fa65f5d04916f8e75deae039b89e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185853, "uuid": "9fdb6586-b183-45da-ba0a-99e7c9767f20", "comment": "Malware payload (Mirai)", "value": "54845788f4f8502a492313a2be7a7ba73b9e96d32c2a2c60a4187e561254fc572272816687784392dcab85b6fb9cd72b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185853, "uuid": "24576892-8620-49a4-972b-d0cfd1f33d3d", "value": "T18F637D78B60EAD41D2C3E37DEC6A4BA2B1273CE44761C2B26800675DD4F6ED4CD66623", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185853, "uuid": "859b52b8-f9eb-4446-96b4-5891913c27aa", "value": "1536:jqfWcKmLU0mFINif76n6Cu1oTOyDKau1Ir:jqfT+IIT8u1MOyDKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185853, "uuid": "94756618-5f39-438a-a344-dafe1d6cc8a7", "value": 67416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185853, "uuid": "905928ca-6233-49b4-a3ac-15be649ff90d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185853, "uuid": "ad6cc577-3104-4413-8426-d37c1969ae0f", "value": "bot.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f551f53b-c0bd-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791205752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205752, "uuid": "9c744f66-9303-48ad-89c3-c54224d2e936", "comment": "Malware payload (Mirai)", "value": "9356ff7e9de27b53119f393b450abcc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205752, "uuid": "63424579-88e4-4b79-b03b-c8348bb1f386", "comment": "Malware payload (Mirai)", "value": "729978b00d098842363f59a6ffee3ac80e8a41e11c7317c837cd0b4345ed8a31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205752, "uuid": "1e040104-bfd1-4788-9f49-f9b3a3e191ed", "comment": "Malware payload (Mirai)", "value": "67e0fc622cf5d3add8260bf598ae3bbee5c82b29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205752, "uuid": "886485b4-58d6-4eb9-ba8a-a7efc502fb2d", "comment": "Malware payload (Mirai)", "value": "9ef6ddd9b168f8c52b302d5366c6e02e26258e58da1b32cf85d25df1b108e348d74cac96326d5f7eae1f62426725d5f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205752, "uuid": "fb7ec4b2-e746-4bf7-bae9-d6beff9cc9bf", "value": "T13EF33899F8C16B20D0D532BAFA5E0149735357BCE3FA7115EE215B3523CA92B0FBA901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205752, "uuid": "cac3c8c8-49f1-429f-aa75-c5dcb5037a23", "value": "3072:o6tRTw0v/4HlK1p7PYF6vKLgo1KaL4+k2OEtEqwD8x9LS9A/fn7/in8I:o6tJw3lsFm6vKMaKaL4J2OEtEdDO9Sm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791205752, "uuid": "b7a8350c-d5f6-4212-9282-65c8217fad52", "value": 171548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791205752, "uuid": "af8b2631-3363-4cef-8947-773298a73b6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205752, "uuid": "e9812216-0ec4-4bb6-89e5-f95a46b2b82f", "value": "adb.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eff6b75-c0a1-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791193420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791193420, "uuid": "09a1b07c-62c1-4cad-988d-8ef5380074d1", "comment": "Malware payload (RemcosRAT)", "value": "0ebfe765ba43c9acd584e1ef8586975a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791193420, "uuid": "d554ed81-17a2-483c-b41c-d81b0cb05947", "comment": "Malware payload (RemcosRAT)", "value": "736dc94a8570184dcc4e9e8ca45861c15fed381ee6eb696ecd9efbfb556da1a7", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791193420, "uuid": "b60a2586-d333-4b3d-8300-7b8404e087b7", "comment": "Malware payload (RemcosRAT)", "value": "d0f19bb67388e3bb46ac9bd1fb40b2beb3e73994", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791193420, "uuid": "45f90f03-17cc-4546-a738-0e37b02d78c4", "comment": "Malware payload (RemcosRAT)", "value": "a38b103c73714cc855df490ed93a9e6e5dde5dd4af1b5eefd2874680b145f3f2860015b89d2d0e0da3b0e56340ad605f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791193420, "uuid": "04c7bc3b-0638-4bc3-a30d-1953e4db0a50", "value": "T1BFC198606314710408963A64A47FCA0522FB4BBE21A9EE48B7F8B94EFCBD574437D5CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791193420, "uuid": "ac6f0e91-5395-4bcc-8c8f-247095ac8264", "value": "96:y9wae6vrSDUfXWC0Xu7FEwx08TY14OkiRIv4AUXKJiL:ySaZoUXSIFEwQqOtRIvRAK4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791193420, "uuid": "c143787d-73fc-4937-9abb-60815c1d48a9", "value": 5939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791193420, "uuid": "a564b25a-c804-4165-b718-ae22b180b424", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791193420, "uuid": "8cd48c70-07ee-48b0-b213-58e4e964d565", "value": "DHL_DOC75735835395935853958945634747535.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec29f04-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload (XWorm)", "timestamp": 1791216237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216237, "uuid": "c691027c-e525-4beb-b2a9-cef1f47ff129", "comment": "Malware payload (XWorm)", "value": "f85089702b4e9a62b940d3a926974565", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216237, "uuid": "9f117dd4-19c4-499a-bf69-d0d65dacd3fa", "comment": "Malware payload (XWorm)", "value": "73751b6b6cef4a26579275fe51f68847418099594562f25205f36637c8b63304", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216237, "uuid": "2658e43c-01da-4c50-8d2d-5f0efe90b6a8", "comment": "Malware payload (XWorm)", "value": "c98748eada81bb48dcae080c733513ba5930ce28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216237, "uuid": "fde30a9e-8e5c-43e2-aa1a-3fa23d3a4e83", "comment": "Malware payload (XWorm)", "value": "23d6c21a1effad716fc8e8980db1845aa5cb96b769d15e46f27d954b08cf2db4127d09cfb0c54dd24f74ca0cec4c4c99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216237, "uuid": "c0f84c0e-dc78-4eaf-8c92-b4d7b4b68b24", "value": "T1E9D4E0553364D603C96627F45932F2780BB8AEEEA921D21A9FD5ADEF3932F008D40753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216237, "uuid": "6a9da5bf-a6e3-42a7-bb36-429c80193ebc", "value": "12288:UohmTwFn/P0ZxYxJN7lubjba00HkBE+t1Jo0E:UPT4n/PuYx37luv50HhUO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216237, "uuid": "ac3bd43e-39f6-4d97-b5fb-0c67ae7de88d", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216237, "uuid": "2cef7827-531a-4762-be86-cdba4e1101dc", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216237, "uuid": "9c78574b-527d-42e7-a07d-d3c23bceac84", "value": "73751b6b6cef4a26579275fe51f68847418099594562f25205f36637c8b63304.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5eea808-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791190586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190586, "uuid": "2805198d-11e1-421e-b4c6-2f69bd9f4680", "comment": "Malware payload (Formbook)", "value": "957586317cf21212c4d5c4ecf5191d0c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190586, "uuid": "a1449ca4-8a77-45c0-9a19-425fc2ad2324", "comment": "Malware payload (Formbook)", "value": "7391d82a748cb62a6bb7245f571303ee7c5f89a8103cb0906858801d9ec1435b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190586, "uuid": "3f290833-6631-4d2f-b1d2-ebc1e795ccb1", "comment": "Malware payload (Formbook)", "value": "b928cc015c1a25e85d83e09d5a8bd1f294035d58", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190586, "uuid": "c7e0569f-7b45-404f-92fd-72f5d22ff51c", "comment": "Malware payload (Formbook)", "value": "e28898942fb2ed1b67ba37b32f3efa1f36e649cfd4c79bc40f677ccfd421bb61e6d28ae65eb5cce79d790cfc6b0c63fc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190586, "uuid": "74dd8134-6300-4264-9d81-4600cd5e8877", "value": "T1C0A5F15088C03FE4EB79A61840BD552DE3B14A9B5C2E694ABB3FBE45EFF7500C207196", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190586, "uuid": "a8585f89-3bb0-479a-9f4c-88b222d85f62", "value": "24576:5s6HL6D9sLf13P0PiEOeBgjhGWI2X2782y+vOeaIHSqZFIaygaN:DosL58ya/aiSBaygc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190586, "uuid": "bb662a8f-bca0-4f86-9083-c0b33af6a5f0", "value": 2110364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190586, "uuid": "f7eaa917-5f5d-4aef-85fd-84eb9a021962", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190586, "uuid": "4f68faa4-fa28-463f-bbd0-422bcc8ac875", "value": "New Inquiry-for Quotation.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b497d439-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218958, "uuid": "ca4ac477-a341-48ae-ad24-1f8313c33fc9", "comment": "Malware payload (Mirai)", "value": "0f944bd874d6ea05184b2442b85b6102", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218958, "uuid": "ec9d35c2-a754-4a9b-8920-27396d7ba560", "comment": "Malware payload (Mirai)", "value": "7437ab377eb408ba9779d8c3e9bc9d4b43fe9941a977ca2b720a9c0a4f9f2091", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218958, "uuid": "a066fda7-04a3-48e1-a4bd-8a9d7d732916", "comment": "Malware payload (Mirai)", "value": "62f5b9d578999c722080551c0ceb6c3389cb412a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218958, "uuid": "333a7ca1-4ee9-49cc-a063-4cee09172e96", "comment": "Malware payload (Mirai)", "value": "3ba834ba3d63d6033fd4adf2f9ab827be76a3082f0e6b1eaf2fb226e2459510bc95c2813fa7b87910ed38fe9a8521d84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218958, "uuid": "46c58e67-c44c-4ee7-9eb0-aa665799242c", "value": "T11B245C0BE99590FDC5EAC1784BFAB53BD930B55D0138B21A5B94AF222E2DF305B1CB41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218958, "uuid": "87456b5b-1ca5-4ce0-bd75-9dc1e2c2e03b", "value": "3072:MTu19uKVkecIGF5BRTBaYWu7epE8mzmSbvQ6+Y5Ummjsv/vzVPfQxbI6MWULJmWt:MTu19udBpB7Wu7iN8bo6+9KYxOdQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218958, "uuid": "d969d778-b976-4e16-bdc0-a943a6154283", "value": 217224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218958, "uuid": "4ea467e5-b8b2-4bc6-bfbb-3118d7825bcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218958, "uuid": "f0f6dd63-d5b5-4b80-9c4b-fb534c0138be", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50896a8-c097-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791189430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189430, "uuid": "7c49f432-262e-4539-9f49-e816688a3b8d", "comment": "Malware payload", "value": "4ff49265f6485787a6e851f3f78e89dd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189430, "uuid": "11249d41-a5b6-4e66-af14-9ec6dc486f9b", "comment": "Malware payload", "value": "748f569e783cba27904120906451c839a1dee8700b1db7938a797805d5688cf5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189430, "uuid": "e83ec25e-0957-44ff-8b7b-7ab6ec87da8a", "comment": "Malware payload", "value": "7d9853fac73b4c2dd62b4c729e07175e45e8027e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189430, "uuid": "2591acd7-3102-40ba-911e-7351eaf21f79", "comment": "Malware payload", "value": "b232db47f26003893f3f8b7b6b5414f57c993a17b7df132ce329cb46b5fc94d99b11c481e55b8c3abed0783fc100c11e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189430, "uuid": "ccc5f075-562a-4854-9d0e-eb6eff08e182", "value": "T15CF312715A37BF8B3E69BA15B1076D060C7AE66025436F204265C637206737FCFE5278", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189430, "uuid": "25cd53f9-a35d-4aef-afeb-f392f9e31659", "value": "3072:PjUFKIzoLpiIT/ZL+gcUEu2W6rWl630SMr9NUmQkT9JeSTiLr:gKIzoNpT/N+hu4lJMr9NUmtJGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791189430, "uuid": "e8900d44-12f7-4ca9-8322-7a32b1d8b162", "value": 162115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791189430, "uuid": "4e914661-6c4d-442f-b2c2-400742e34b7a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189430, "uuid": "ecbbe77f-dc81-44c7-b1e8-5d3988e3c203", "value": "a9b9764e2aa1a1e4a942bf878f22a271917a244041900b76787a7d8ec0610cd9.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bece697e-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791182038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182038, "uuid": "628156d2-c656-4da6-9303-e8eaee5f20a3", "comment": "Malware payload (Mirai)", "value": "0df7b3766a705d131b1b440c3993e995", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182038, "uuid": "c4f38bb5-1e12-40f6-a0bb-fe1096956422", "comment": "Malware payload (Mirai)", "value": "750a27df8bdc0f84b83e5bb83f8d44d2e0e3878f2f551cc97ae73164f40e95f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182038, "uuid": "0f39dd52-8013-4c61-9440-9296500fa4c1", "comment": "Malware payload (Mirai)", "value": "b95c6345d92e9def02761332dc2497f2d95aa404", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182038, "uuid": "4f32841d-3002-45a1-87dd-30da47868fb9", "comment": "Malware payload (Mirai)", "value": "0605f03f6bd2438480ae9192c3f36738eb7bc683b98751a62c84df6f59b3d637754e49c52bc46c00f3dce184c71eba26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182038, "uuid": "bc30b42b-4804-4102-bdfa-bc7b0887e0ba", "value": "T159B33B86E793D0B9D91711B041A7E7396770ED720220CD5ADBA0BFF19871EC2A15A3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182038, "uuid": "77d517dd-6ac8-4785-9546-0c4f2247a3ec", "value": "3072:WEh3FVf5TTKB65Pw+dQfqzyrBI6ygSzJ:pVfWV4ARWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791182038, "uuid": "470a8909-350d-4f39-995b-fc64f090f69c", "value": 115132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791182038, "uuid": "b5e0efe9-4ff4-4386-8d43-f7266852d436", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182038, "uuid": "1cf34568-e1d6-4606-8e1f-ba91225888ea", "value": "wife.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c827c5cb-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181624, "uuid": "ba7f79b5-999b-4c80-94c0-def1b8a15cdf", "comment": "Malware payload (Mirai)", "value": "53bcddadd71dc343048a149017345b68", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181624, "uuid": "8398d9e5-90fa-4332-a0b4-0d74590a18eb", "comment": "Malware payload (Mirai)", "value": "757645be6dcacebfd66316a94f3fd5837fbcd5e7cce0696a261ab8ab6fb1ca71", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181624, "uuid": "62caa802-9481-40e6-926f-82425e0f53ea", "comment": "Malware payload (Mirai)", "value": "252065259f5dd8b51c6486697d0b14f97cb8dc9f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181624, "uuid": "ce0c51bf-9d2f-4f28-b090-e3aa4e605923", "comment": "Malware payload (Mirai)", "value": "354176fcd942595847e6931733c6e63ec1f2569ee8801077e8452bc9a2be140e0a44c1af87a390cecf9be3487bb476e8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181624, "uuid": "21a0d73a-3004-4bdc-8ab1-ca4e3efef8d3", "value": "T1E421E689A4702B91F73608129487294B5108A3A96F952F4CF5143DB430FDB2AE4E772A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181624, "uuid": "299c7b2f-5fd1-431c-891c-cb1820ac50b8", "value": "12:dndZIKwvXDuyILpux0aIHAIGFIGpGnJInsgsIfVrh5t0ZTH3FBmnJTPLCabc6tOn:dI/vkLpasYZwnAdrV0ZTH1BmJTPW6cMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181624, "uuid": "633a3d25-6cc1-42c3-afea-20a890715436", "value": 1406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181624, "uuid": "0cdb7039-f7c5-43c3-9b43-28bd71a199bd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181624, "uuid": "4c92cdfd-13aa-4347-9b01-3b6fd6736954", "value": "b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7744564-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181677, "uuid": "4ce2157c-292e-449e-8716-65eb0217f2ff", "comment": "Malware payload (Mirai)", "value": "2955666ebce92b24f565e0a10b3f4489", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181677, "uuid": "72a4896e-4b13-4b31-8569-7b2609784396", "comment": "Malware payload (Mirai)", "value": "758970a475b6d9b6708a52f22727d79d964cec3d04e14b8e5adf31930d80056e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181677, "uuid": "86c599c9-2f0c-4b12-8dc2-f6ed44ed2a28", "comment": "Malware payload (Mirai)", "value": "03d9fd737e96f4f36a3bb16dc34ed44d7fd6c94d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181677, "uuid": "91dac138-1b38-4bef-8710-d994706ae5c5", "comment": "Malware payload (Mirai)", "value": "a2bf41cb8ff51d5668381402e556457ce7b1471f5999631830346c5a33e2f66b17cabd5fd1b2e7f2221e72977631bd6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181677, "uuid": "8fc3577e-b732-41cc-beb6-c6ba4334bfb8", "value": "T164530239F82C2EE9F8A7AFD9056096E5AA78024877D1C0F702D68F647020A74B5C75CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181677, "uuid": "62bebc67-bfb3-4760-b23d-1980bed9e39e", "value": "1536:WMXBOm6SMZZjVMCAXEstnLiW48LXNxk6bGmqJ1a4u+qgw099:WMXBOjSaZxMCuRtn+nKxk6tv4u+qgwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181677, "uuid": "302a4a2f-f23b-4356-8f5c-ebf7ac9afe27", "value": 62380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181677, "uuid": "cca64004-b4a6-4e3b-9be9-2f9e387b8829", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181677, "uuid": "b16fdd68-9577-4f0a-a946-52fae4ad7803", "value": "wife.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c42706e3-c06a-11f1-927a-4201ac107004", "comment": "Malware payload (VShell)", "timestamp": 1791170021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170021, "uuid": "00e9b699-e2ab-4d3d-b50a-97cf326ce051", "comment": "Malware payload (VShell)", "value": "1c575d4e54baf181f44271cacd0618eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170021, "uuid": "b259f8a8-42bf-4e36-935f-44a865e20b9e", "comment": "Malware payload (VShell)", "value": "75eec3fe903f215cfe790a37f77c5be5fb2ef0e9466737ffdee00557acf923f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170021, "uuid": "a3f9276e-45f8-4b5d-ac37-eae0d7857407", "comment": "Malware payload (VShell)", "value": "9f411adee1ebc8333ee2f3db35cd76136a84ffa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170021, "uuid": "6cec0096-928a-4397-ad8f-ca8da9bf23f7", "comment": "Malware payload (VShell)", "value": "e2f6f20c1069ea4ae437553e516a3dbdf6c2f230a81911ff83e4116709fab3418f9211de7b69ac44ed241a947f149c9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170021, "uuid": "e0968e6a-1aeb-4dbc-81f3-b511cf09a363", "value": "T17291D84170B999E7E85C51BF4C0FB494B919740A41C483B70378A5993E3957BF47CB0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170021, "uuid": "e048cffd-04c6-40f0-9f0d-83e005a44889", "value": "e82dd51b077167be63c004bed23d0c1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170021, "uuid": "03bed4f9-308c-4baf-ad35-5632659cb24b", "value": "48:6IIF9BlQaexgflgZH7An0cF5uduvxRxUjbON9XM/ge93ahr0/:y9BOaMg4M0cF50uDxUOvXeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791170021, "uuid": "cefe864b-7e7a-43f1-a056-b3ae0b4a807c", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791170021, "uuid": "543a869b-5efe-446b-a504-2d127391645a", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170021, "uuid": "7fc1b0fc-22ea-480a-92cb-0ef84ef56163", "value": "75eec3fe903f215cfe790a37f77c5be5fb2ef0e9466737ffdee00557acf923f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ae0d47-c0a4-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791194830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791194830, "uuid": "a347e72f-7919-471e-9d90-0da5f707276d", "comment": "Malware payload", "value": "eb871535a90697e6c5a7c7d0c33c9827", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791194830, "uuid": "e516782e-0f38-4a2f-a13e-7d3f198f376f", "comment": "Malware payload", "value": "75f218904393f6982671178534f4bb5c03a031f697db9f5255729e85dcfc1bed", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791194830, "uuid": "03c37af8-933a-46b4-9fa7-1d2d233afba3", "comment": "Malware payload", "value": "e49f81b151e4430ebcb831ae37b6ad978179374a", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791194830, "uuid": "d6480f85-21a0-4b8b-b780-a38b07310cb5", "comment": "Malware payload", "value": "fa2fa4b7d94ca1ad4b6c6c6c063e5c91eb16f70f3667c2dfa507fee508f44eadf88308d3d537893f0da23fd11b18607a", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791194830, "uuid": "a64c4808-a9fa-49b7-9440-77d849936ca5", "value": "T16256B0B875047DE6297F536BDA97ACDC137616239A8BA4CC606877C30BA3375FE12804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791194830, "uuid": "4daa1bce-3d00-44fa-8ea3-fd9e08efd94c", "value": "24576:6l6bRCnM/+5IgBs2Wq/0mPMijkdyrJGC2fCDcdEHaYszx1gE/FPcYxhBXzSDNRl8:cU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791194830, "uuid": "64f38620-f0e6-4a55-923b-179e052c4293", "value": 6185680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791194830, "uuid": "13acebf9-bf99-4f43-aab3-39a35a2ee739", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791194830, "uuid": "4b1e9d17-311f-43e2-bcb2-2431905004f5", "value": "75f218904393f6982671178534f4bb5c03a031f697db9f5255729e85dcfc1bed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a02044-c0de-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791219783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219783, "uuid": "3428a8d8-cc4e-405f-ab24-272a6e4793ea", "comment": "Malware payload (Mirai)", "value": "952e25b49b511e9db0542658ed34a0f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219783, "uuid": "cda30415-816a-4e7f-ac29-cfe13738ebdd", "comment": "Malware payload (Mirai)", "value": "7690a6b56024242d7dbd209f4ddfaf25d4a0fb4e3fb400941c02bd94b94379cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219783, "uuid": "b34915e9-fda6-4bd0-835a-e4a6f6d1721f", "comment": "Malware payload (Mirai)", "value": "f49524aa195555babc42560d98fa70981b705a69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219783, "uuid": "af954841-ce81-457d-902c-1c7984258592", "comment": "Malware payload (Mirai)", "value": "96579c36ae581c39a96d30184dacf1165a74ca9006176e99c167fc7e7f04a48a2357711705b97df0c279d10255135878", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219783, "uuid": "fc7922df-84cc-4aa4-aab2-1f6c50fcb4dd", "value": "T16364841E7E22DF7EF269877047B78970579836A636F1D584F19CD6081E2028E241FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219783, "uuid": "17ae29b4-5447-43bb-a30b-fcd244e3819d", "value": "6144:emYEnmoYxjJKCcSQO/beub9B3Njv5v5sOuqm/L:VVmoYpJLdh/bP9hN6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791219783, "uuid": "c2d7892d-a155-4d00-8281-fc2cc6210422", "value": 333208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791219783, "uuid": "81e9fe2a-d9b6-4963-ad12-89132d80236f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219783, "uuid": "6b79ebf6-ea87-4d66-9522-6b7e1879e00e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73eddb7-c0e8-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791224196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224196, "uuid": "ae56528a-d5d3-4ce5-8222-1996f48f219b", "comment": "Malware payload (Mirai)", "value": "1306bb33ebc0ca7f7cc6f0bc635452ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224196, "uuid": "a94613ea-ee2c-4e11-9f3d-e4105b3c9dce", "comment": "Malware payload (Mirai)", "value": "7778534b38eea50bbf85f82c11fba5e8077aeea87afee3cbfbdf1d22204164c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224196, "uuid": "c60127fe-cc05-494d-8407-e3e0c21bbe0f", "comment": "Malware payload (Mirai)", "value": "9487b20c73031ef9aec8528fa62baa75a42429c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224196, "uuid": "b42d924c-69b5-47ff-ab47-3b2aa965200b", "comment": "Malware payload (Mirai)", "value": "7cadc0b27fd352716795ddef65f4de7b7e72210c436c28787b84b3783c7f17b91a519f709b1831260fa9f12214bcb675", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224196, "uuid": "5783fb87-7dfd-4006-bc6c-e1b8188e5dd2", "value": "T142245B02BB1D0A43F2571EF4363F2BD193AFEA9061B4F684398FAA4A9171D312546DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224196, "uuid": "c53de396-4c92-4898-9ed0-9b6bb02a20d5", "value": "3072:61Zf+FRIMIcydNxIMJK+oFQvVBKC6BdVcXO:0Z1Mz8NxIMJK9FQ9BKXcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791224196, "uuid": "01df0d08-a19d-499e-bcba-0451b68346a2", "value": 226476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791224196, "uuid": "048e84e4-5603-476b-821d-b91d2c69ec65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224196, "uuid": "05d41aaa-6a50-4477-a897-5e47c31a7e61", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040e1cf0-c055-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791160679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791160679, "uuid": "70a69ee5-619f-4884-a7b4-ab1fd1c9d09c", "comment": "Malware payload (Mirai)", "value": "f23cf0d3eae7bb4eb24652c187a419f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791160679, "uuid": "6d8acb56-7d94-49d0-b6a0-6329e451cf9e", "comment": "Malware payload (Mirai)", "value": "7850fe83806399284d1b643547b6cdbfa3f1cc7413550514df0548b7eb1d3066", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791160679, "uuid": "c662b542-1a68-4aa9-b9da-71cceeb7cfce", "comment": "Malware payload (Mirai)", "value": "9513dd839abccd2ded082c2223464154225d937c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791160679, "uuid": "beedd552-ae01-454a-913f-36b72fb698b0", "comment": "Malware payload (Mirai)", "value": "59fb1e152f5ff44a10037e4f721b7aa01d9d05c276e42a48182985fbb49977aaaf0129d0f623d7df7116be9149d4761a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791160679, "uuid": "4d829220-df99-4e06-8576-fd693defb6d1", "value": "T17F04094AF9428E51F58012FAFB5D82D83F1303FBD2FA75029D185BB46B9745A0E2B942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791160679, "uuid": "8aaff249-a241-4914-8351-60c5172052fb", "value": "3072:/wKE4gkmDpNewqm4ZLv8G6vyopDfiCxUn57BdbyqZRqYtB9MAUBdmIc8zf1Uqf:/ZETHNej1Lv8G6vyo1ajZtBGPk8zf1Uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791160679, "uuid": "5ebc950c-54ba-4905-8e13-c22c45ba43c4", "value": 190080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791160679, "uuid": "4beaf11d-b0eb-4739-a8d5-ebc9251119a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791160679, "uuid": "5ebfb46e-c812-4cb2-82d8-f5089b4db479", "value": "kushnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca34bbe-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218917, "uuid": "675cac53-0798-43e6-9ce4-552877053e1d", "comment": "Malware payload (Mirai)", "value": "10223e1fd2aa89db56923f2a9c6f60f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218917, "uuid": "c3854b82-cd95-4a7d-a1b8-ad73bbe58c60", "comment": "Malware payload (Mirai)", "value": "7876770417f26d23b47c453cce4fb5d53ce79b3c44b5bfa63e20bfe4d00a2d5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218917, "uuid": "b7f23475-b0b1-4ed6-b72e-c0d4a4eb723e", "comment": "Malware payload (Mirai)", "value": "daa248a1e7b2bc56d03ed64334dcf1d690fbe545", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218917, "uuid": "4a02c770-4185-49e1-ac3e-8acd3c1907ea", "comment": "Malware payload (Mirai)", "value": "0cb9be8b87f66e6b729b48e0d450a02d4ad0039358de509d8cb02158ef1eaefbaae6a5e6acd8a2c2361e383c2419e20b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218917, "uuid": "f8a1f372-c4dc-41dd-b030-df5265f8c2fa", "value": "T1C2243A85F9415E17C6C562BBFBBE828C371B13B8D3EB3102DE155F64368A46A0E3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218917, "uuid": "8cfe8d8d-d4cf-4b1b-84b6-790376dc9457", "value": "6144:PdiI7myioDMUxZ+cwK5YemguD4ia4QqDO2UWHwM:PdinyiQZPZgi4vdJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218917, "uuid": "020cfab2-d058-4f00-9a48-c9b3ecdce785", "value": 223328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218917, "uuid": "2bbd6f66-05c1-42e8-a331-71f493574d93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218917, "uuid": "a7bce819-d514-40a9-b3d3-6676fd6e4a70", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac9a4ab-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791190594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190594, "uuid": "e96b7109-1b6b-46f2-8af0-de8cc7d8a661", "comment": "Malware payload (Formbook)", "value": "521c7f91fa186487c18a41b7e97d27c5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190594, "uuid": "55d5ed48-a820-4602-b9c4-e0fb6181a5fc", "comment": "Malware payload (Formbook)", "value": "789ad476a56534cb01032e7219bb102dba7a3ac9257e56d820bee4e524357e6a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190594, "uuid": "4f899f36-cdc1-44ff-9033-22d5605f5317", "comment": "Malware payload (Formbook)", "value": "79ef7b013da268904d0ea2ef416d6450bd10a5eb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190594, "uuid": "be38aa54-1755-4c5f-9254-3c00b263e057", "comment": "Malware payload (Formbook)", "value": "2fe26184b753834c63cfa9b51a348541e22f799f8112f696c4f66aa81e8328e2860820c2c51212209f1126bbd91a5d66", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190594, "uuid": "6b5b694f-b7b8-4678-a41e-4353ec1d8542", "value": "T1D123EB444D81748423336B7ABA2AE4E5F7BB0A6B0194494BB87C7484EFB1D18DEE4DF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190594, "uuid": "3d5ee447-8072-472e-bb55-401bd146a3dd", "value": "768:OoT6s0rdUEVDLCi3yRB7eeA4bl3A69euqtZvYJPT+E3iTcxDp9wThIuq12d1R/eE:OpUEVDLrW7ld7+0yX0CAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190594, "uuid": "d462f0e1-3104-49c2-8eb9-d6db95f10ced", "value": 49373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190594, "uuid": "d316cf4b-3616-4549-9f91-59dfa6f12901", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190594, "uuid": "79bee1ce-4193-4388-9868-e59bdcfff923", "value": "Technical Specifications Image.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a887d7-c0ef-11f1-927a-4201ac107004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1791227033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791227033, "uuid": "4ab6d94e-ff69-43f7-ab6f-83dc3296c397", "comment": "Malware payload (AsyncRAT)", "value": "61480a155193ab1d60ede49b5fe13556", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791227033, "uuid": "d8aa4706-8781-4734-b9a6-ee539beb69a9", "comment": "Malware payload (AsyncRAT)", "value": "791c80619bb5c1dcd0a560c419b8e32885d074c82f626a1f35d4f477a45eb344", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791227033, "uuid": "60a6d18a-4425-4df4-a385-7633b5412fb0", "comment": "Malware payload (AsyncRAT)", "value": "36bebfe8d53c60e5b97c084bf6e0b4bb94e457fd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791227033, "uuid": "1b2dc8da-9017-49d2-a0b1-f6afd6adeed9", "comment": "Malware payload (AsyncRAT)", "value": "abce2827b062f8509cd5a7f860b5c165bbb1b3c512457edc8ef01ca99c1590166322b3ef489ccec2cc0a260f15089b37", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791227033, "uuid": "590f4303-8bea-40d4-92a5-6ecb62a18342", "value": "T1F7232C003BE98126E1FE5FB8ACF1514187BAE6633603D65E3CC841D75B137C6CA52AE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791227033, "uuid": "679e5c43-1bea-446c-b89f-2a16b368bd4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791227033, "uuid": "80c9107f-6b40-4ba7-aceb-b8ea597e610a", "value": "768:LqdpXbXX0fIAkOicvHk3eHlWMPbPgF0qp1ufQPpGYQvbPNPYI6OCC2tYcFmVc6K:LtIAXvZH0ub4Frp1uf4f0p6OnKmVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791227033, "uuid": "e7b16d2d-7d55-4772-823a-9ec6fc80d2d6", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791227033, "uuid": "9aa41da3-637b-4e56-8543-eae39311fc55", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791227033, "uuid": "7f77929a-ce22-4ee3-91f5-828266da255e", "value": "791c80619bb5c1dcd0a560c419b8e32885d074c82f626a1f35d4f477a45eb344.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f68530b-c08f-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791185851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185851, "uuid": "f27117a6-4867-4907-892a-bd5f7f93c666", "comment": "Malware payload (Mirai)", "value": "ef35ff06bdc34f03c532b62b1b3407fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185851, "uuid": "e7196193-e357-4d1b-b1ef-bfe8cfa59a16", "comment": "Malware payload (Mirai)", "value": "7970c397baac166a81cf050def91e1b969180564ef973242b565b5c6d821d189", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185851, "uuid": "e6ae7395-8361-46b7-9f39-148e0b9b40d3", "comment": "Malware payload (Mirai)", "value": "d7a9f595270ddc83f37bd553a1935a6ef9c6ed47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185851, "uuid": "7d4d8352-02b7-4eb0-a5d7-2db294899c69", "comment": "Malware payload (Mirai)", "value": "eb8451fdf823e8bdc97063a32b51eac76d3d7bfc433315edd102cf11b0f6024ad02954d4a9edda2a54ff58e4e96e580e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185851, "uuid": "f57d14ec-bc00-46be-a58e-93cc5f6e42ac", "value": "T179832946EE900F9BC4AFCE30465F021726ED8C9E93E2733B517C9D5875AE3458AD3948", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185851, "uuid": "cfa9838a-e4be-44c3-b256-4986fc84808f", "value": "1536:rPoXBeDJ4JuzD2IhSoO27Yn5XQG50qoGkXIg4pGI6qW59GWKX4rq:cXBet4wDvhhv7Y5gGhkXIglI6qWjG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185851, "uuid": "d52887d3-269e-4b48-8049-e84d8e1e1a77", "value": 88388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185851, "uuid": "b9ea45c5-81ef-4788-8b12-ad8af2b47581", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185851, "uuid": "d4ff96ca-aa34-4095-a25e-e6bc28d0527f", "value": "bot.mips64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbfe7b6d-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185926, "uuid": "cd3ee437-fc32-49ba-8ae7-f7f3184740cd", "comment": "Malware payload", "value": "1d0947cdde7872697d84ae1c169c7e64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185926, "uuid": "6a318171-eedd-45d8-9643-dd496d75c8dd", "comment": "Malware payload", "value": "799fe5f5e5d02033b5648d44c3e0d8e786e6a1033a23e7164ddf95a70b9fa1e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185926, "uuid": "343b3224-98f1-45c5-a7b5-614277450221", "comment": "Malware payload", "value": "93784eaa937385d0b1ddb51197270394e5757a74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185926, "uuid": "3593300f-19ef-4180-a2bc-825a5c8e120b", "comment": "Malware payload", "value": "2fe378f0fab33c228ed61956fafa7416fa176f0a513c6bce63ef1cc2eba3ad3f954eef4850bada9bf06b650df9b9eeac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185926, "uuid": "79128f74-24d1-4ec6-a40f-c6091578d1ea", "value": "T1DFA5F797BD814943C4E43A37BCBD80D433665EB99B8A631A6D05FA7C3ABF1D80A35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185926, "uuid": "f36697c5-070a-4313-bc02-c8d0adc42f56", "value": "24576:C+ouP2UnjggYUCMYURLJKtCiVp6tak363jCxnGAkP5vEIX3y8fquGE1Wn6DN+Z:V2BjRPvE8VO+Wn6UZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185926, "uuid": "e2de7131-2f85-479b-b0f0-aa5156e90144", "value": 2162812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185926, "uuid": "eabf2bd6-5422-4815-b2cf-76e9857e0b76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185926, "uuid": "a6c7eac8-aa88-40e3-9e4e-07d33a43f2d4", "value": "mb.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37363ef6-c0fc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791232491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232491, "uuid": "15831834-a2c6-46d2-86d3-07e783299a0f", "comment": "Malware payload (Mirai)", "value": "e9c58b4281e94d641c97390fc416c503", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232491, "uuid": "3c4ab1dc-088d-41b4-8fa8-da6344ccd4f3", "comment": "Malware payload (Mirai)", "value": "79a1e4bbc9351f13e37064fb33ae331e8c440e5cab7b9905f488cef856e1cb85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232491, "uuid": "55547ca4-a886-497e-a302-1bc47f01decf", "comment": "Malware payload (Mirai)", "value": "cc9195c6a4d43b1f6ace22f7490bfb80e644e0e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232491, "uuid": "51477e1e-99a0-4900-bc31-e7545ac51085", "comment": "Malware payload (Mirai)", "value": "c50c6700b69d699cbbde420ca10611abc914556f6abada61456571a08d858bec7b776799b8c518ec8be4622673debe81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232491, "uuid": "ba8aa9f6-7fbd-4265-b943-dce8ea9b4306", "value": "T1D553F891B8426A39C2D1577BEDAF548E3314A7D8D1DB3213C9244BA07BCA94F0C97F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232491, "uuid": "e5233b7b-4bbe-4332-bbcb-06aa29618a97", "value": "1536:nEbNn3E5sOq19Pj21ZXBbpuW+8nkSXeVSvhWy5UzS:+n3IxdpNkSXsKf5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791232491, "uuid": "9f2b2db5-fd33-42d8-bcca-72464fc3a182", "value": 61700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791232491, "uuid": "b3af05f1-599f-443f-a4ad-662ad9ff6100", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232491, "uuid": "2577f4d3-371a-4158-8b37-0bcdb2c1abe4", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c881eae-c0e8-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791223830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223830, "uuid": "6c353faf-6aa0-4d53-b1cc-8216b7ec08b0", "comment": "Malware payload", "value": "cb9ef7992204c2e440d6b37aa884ce9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223830, "uuid": "59559858-adf9-44c4-a7cd-ec41cef42f49", "comment": "Malware payload", "value": "79a54625d4f6572e6ea037c815d785e475694c48ed3d7ee635a0015f7d1b9dee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223830, "uuid": "20e9e6cd-1548-47ee-afd1-63e09fe10cb5", "comment": "Malware payload", "value": "d79979424c8f7572a788244bd68ab60dfbd2468e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223830, "uuid": "cc39acdd-697b-4eb0-a531-82818446dcd5", "comment": "Malware payload", "value": "765382a424e6fafe6eb8e6651c5a05d8a2b9f6e3b4ad4fc6105a33f4e64f385c4b0e74476806a3d2a47ca8a6c767eebb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223830, "uuid": "9727fce8-984f-4b63-b795-40b5d5db66aa", "value": "T134565A53ECA819E8C0AEE1358A629553BB717C494B3123D32F50F3282F77BE0A979754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223830, "uuid": "0fb892d3-cbb2-40c7-8b3c-75d6cb0de58d", "value": "49152:OGPsxAK3ITH4Ah3EJpkd+JTHMbbHTDgRn11tNn3WqccITBsuqCo7Wci2WKlK1KcN:OGBEy3upnj3/kBlrcKvxBEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791223830, "uuid": "3e7d4d4e-8a5f-42ec-b5d5-d9cedb68b6ad", "value": 6430882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791223830, "uuid": "fe2a1652-9efd-4a79-85e4-cef6c1fd3811", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223830, "uuid": "42a28b53-c6d5-4e6b-9e96-8cdd2bf12175", "value": "b8eac6853dcc452bc021-implant-linux-amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d052b5d8-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791190657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190657, "uuid": "673b9e4f-17fc-495b-bae6-156341c9c270", "comment": "Malware payload (RemcosRAT)", "value": "7421f00daf37de5af6d82b036ebfb83c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190657, "uuid": "404773fd-43f3-4c67-91e0-4c2828a49e54", "comment": "Malware payload (RemcosRAT)", "value": "7a2ed57c13d20706dd871a9a28654c6c0293271b26ac9c04d326f26649765028", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190657, "uuid": "6cabc31c-dd44-4921-a45f-0175e8c8d420", "comment": "Malware payload (RemcosRAT)", "value": "0196d2851b1450da1cc0da76ee477126dd71abe3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190657, "uuid": "966d187f-9e35-4c15-8e16-50f149eb74d7", "comment": "Malware payload (RemcosRAT)", "value": "a0076a02303e3f5d39e72c5ff8689858a7bc2388b8b24eb58381ca88a1a03cb9ad7df34ccc535d5561b4fcd81979b8f4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190657, "uuid": "088a39ac-8e6e-4d3f-9b9b-0f4439bed992", "value": "T17C834C60CD2645774F4ABBA8BC950730C7FCC319452625B0E6D68F0DA90A8ECF77866B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190657, "uuid": "9d764392-ad54-4a4c-8e2e-0b36cfe851a7", "value": "1536:fHe13AxiR9LXIbM8fBLZ4TDYTbw04um6NA+Jaorc1mOh02v21xk:m13AxiTXeRpLZ4PO00m6NA+Jar1mADvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190657, "uuid": "509f3bcd-1b6e-455f-86cb-80764b157de9", "value": 85435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190657, "uuid": "8fd9cd09-f660-4dcd-8312-a215364ce72a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190657, "uuid": "e45b4dc3-cb59-4c2e-8c9c-e578a261c370", "value": "Order NO. PO0425, HUS Ltd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db7b209-c05c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791163809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791163809, "uuid": "19869116-5afa-4ce7-bedf-0de009795d53", "comment": "Malware payload", "value": "a468ee6adb39796c191ca02e2edb959e", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791163809, "uuid": "653eb3f8-b623-45c6-9f7f-f4ae7b9b4f41", "comment": "Malware payload", "value": "7ac6fc134c99f0f2f976fbde077a8bda2ee64cee2b6ee554dff90a480b1b07df", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791163809, "uuid": "4251ca32-ba3e-4dc7-8bf5-9a9c51088c6a", "comment": "Malware payload", "value": "6a9fa55fa03dda354f14cd63fdd8349f17e07125", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791163809, "uuid": "39208367-9233-4eb7-9bf9-034802669963", "comment": "Malware payload", "value": "86a04bfaa557e040523fab3f75ba46510d05f658b0f80ce19e012200700492adffb8419863735b514f39adc021ee7e10", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791163809, "uuid": "c04ee1bb-66f9-41b6-9976-f48da1e07ba1", "value": "T1DF115465B4F8AC3A742C5B8E3375F751BC836CD189153DA67033B830100618D6647630", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791163809, "uuid": "f2375e29-7777-48b7-bf0a-417f31bfc146", "value": "24:barUsX4kLQRDoxHgUpkv2HXvZ4voS9+v/k1l:2phEwAUU2H/ZSh9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791163809, "uuid": "c2b9c358-4054-4e0b-9bb9-57cc790fab13", "value": 940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791163809, "uuid": "f6269ad7-e5ef-4f89-bb51-1d5f044c7885", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791163809, "uuid": "91947c68-a8cc-4804-8a39-0fee4de9e5d6", "value": "7ac6fc134c99f0f2f976fbde077a8bda2ee64cee2b6ee554dff90a480b1b07df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3998f5c3-c0fc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791232495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232495, "uuid": "e2fcd77b-844a-4d1c-ae8f-106c5f010c8e", "comment": "Malware payload (Mirai)", "value": "ed8acf48810bc2fabd432135b6a2948d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232495, "uuid": "d0fc2b43-ddaf-4a07-a5f8-979f16c4b6fe", "comment": "Malware payload (Mirai)", "value": "7acd64b20ccad8105eb6b179f66c9d2bba0045fa3953bd3ce5cb083714d4ef18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232495, "uuid": "09d12251-e092-47bd-949a-08571a40723c", "comment": "Malware payload (Mirai)", "value": "fc2e4758f95649f1ebe719c7fd6ab7fb66cce567", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232495, "uuid": "173c8456-d3ed-4ee2-9290-2d5227e6648b", "comment": "Malware payload (Mirai)", "value": "652a9b925943e7ce726c5dcb6ddde6f64d11c8dc6e25a1a0131dbc63075861ff7e8369ca5ba7d878ceee998671967ccc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232495, "uuid": "b3709b18-7e5c-4373-92d7-38fe7bd0885e", "value": "T11893D706BF610FF7DC9BDC3705A92B05289C665A31A97B35BA30D818F64B21F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232495, "uuid": "4a798ac6-e470-439e-9077-7f99cf0e46b2", "value": "1536:NF2GXYZ8a8fnwEvLNPENIdhs9WZx0ZCufqLhK:NFjXYyCEx0ihK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791232495, "uuid": "6382cfdd-782e-40a7-a3fa-94b7d0876f03", "value": 89408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791232495, "uuid": "e0f157cd-133e-4a25-9819-e154e045cd2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232495, "uuid": "aa688421-4349-439b-8974-298d19406aa5", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13e75ed-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791216348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216348, "uuid": "d512ccd5-26a0-4f80-856d-38232606f47e", "comment": "Malware payload", "value": "7fca5d3b8a0e93d832286ef1a69b916b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216348, "uuid": "c90aef90-6b55-4fdb-98f9-366712817a0a", "comment": "Malware payload", "value": "7c0ae21238ad30ce174f1b9d432cc1205546304825c4bf39dfd665b2e47cd0e9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216348, "uuid": "702762f4-17ea-443a-8af4-ee17f332681e", "comment": "Malware payload", "value": "e07b1032053d0b7c494cb5891c048e18690f21ce", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216348, "uuid": "2b99ba62-b367-4048-97cc-c3b99bc14dad", "comment": "Malware payload", "value": "bd661d43806d6b26f7430658f2be338dc26ddf4600a8bc13e983cc075fa86eb8ab0972bc960ac192bc0ba0a3594913a6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216348, "uuid": "23f51016-9def-4fb4-9b17-7a04042143b7", "value": "T144F4C02425A35E31D26D4AF7E4EC8840137AD6BC9FAFFF29504F46BCAD03356A213952", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216348, "uuid": "201172d3-85b1-4f1c-a764-a606d3a25d8e", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216348, "uuid": "105e6a75-32ba-48a6-aa49-fbb896fd406e", "value": "12288:LtiZKsHedREOpuXCbSAjW4uCmlqoOt1Zf9oewEGX22uOT/ocOdF7vo7xy4b/A:LtdsHedm24uJbzaP7BoS9yK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216348, "uuid": "1f07457f-3efb-4309-8235-0e80662eda8f", "value": 777729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216348, "uuid": "80320af9-983e-4f35-9d19-780f2bbcf7c0", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216348, "uuid": "8d725021-017f-4f6a-96a6-d99cef445ff4", "value": "Noogen.Validation.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0ebbbf-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791190575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190575, "uuid": "a52bf8e8-8613-489e-8e5d-012694bf0b23", "comment": "Malware payload (RemcosRAT)", "value": "dc56573fb68dc0fef520ca171148bd2f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190575, "uuid": "e214b291-6a94-4622-8101-b4fc6f53fd03", "comment": "Malware payload (RemcosRAT)", "value": "7c72a382ba3da31e5b9fd86328801a868655838f57bf95a82df073d114e258a9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190575, "uuid": "b5dba430-e8a3-4e64-951c-f4b191398ec6", "comment": "Malware payload (RemcosRAT)", "value": "6dcc4fbcf5ff652766bcbcad2f523ef3f27ada72", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190575, "uuid": "2f326015-d365-447b-b7fd-775739b932f5", "comment": "Malware payload (RemcosRAT)", "value": "db5901af47725fbdab130741818bcddb011f4904606bf9b1e105189aad0558e24f3f431a36394ec55ca79cf99c8de9a8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190575, "uuid": "f4cc4bf7-b965-4817-9d5e-69ff4cd35e88", "value": "T14F26087A5745A13273295B4C9636C930999E304334D5CF3832ECF2287758D1BB39EAEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190575, "uuid": "f82b81d0-b88d-4875-8051-abeb502aec86", "value": "98304:vppdxrjD5pDZb3SlIYXcFu59VIs7yj5aAfVdnunkRNAGcVgqeKv9kv4mXTb3HUQ2:vp3pD/N3MA0Rej7fVdu8Abgqe2yFXTb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190575, "uuid": "64d28543-4478-4076-91bc-b315e685b7ed", "value": 4716088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190575, "uuid": "8e25f130-283b-440f-95e3-9a107314133f", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190575, "uuid": "581f65da-bc15-4ca4-bfd7-2a6151761a85", "value": "RFQ - 2AP (Epiroc).JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ad31f9-c0e7-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791223543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223543, "uuid": "e33db7ae-e0e2-437f-94f4-c96ae9956268", "comment": "Malware payload (Mirai)", "value": "3a7bf817372c6caa457a67f74718ea77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223543, "uuid": "ece7fd08-39e8-4221-9d50-2f41b2765f45", "comment": "Malware payload (Mirai)", "value": "7c78a7534a25396301040953b5f3ec1fb5b142e9b60f98cc6933b4a97bb3d42e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223543, "uuid": "40f6dda7-1653-42f7-aedd-ffe6b8311a17", "comment": "Malware payload (Mirai)", "value": "88c5e2c72f5b4c3a2f500e63c8fe51cb366170eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223543, "uuid": "ecc31cec-3bb2-4f73-b3b2-1a56323b7e10", "comment": "Malware payload (Mirai)", "value": "5eb0f33880eff49f2b9d6849fb8061d59f6159556c80029a96f5f93af9ddbbdb3491d9bd80d8d2295a96d49be4afde72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223543, "uuid": "4d127d0a-df46-4b59-a3e9-33f47857b31f", "value": "T158B4AE67FA621D03C4F39A3E15A782785323E28917929306A30FF5793ED63794F1A6C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223543, "uuid": "11d0ed4b-e637-4322-982b-d86843e6806f", "value": "12288:axFVgVNQ4Y1z/qS5wLuYXiEVTmEYgpihoPQfJXtrrymt:+L6N61j5iDXiAIfJXtXym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791223543, "uuid": "453ee6bd-c16b-41b8-8eb6-0879b81dc985", "value": 527768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791223543, "uuid": "4c83ce7f-30a5-4397-adb0-c8f9b581f00a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223543, "uuid": "b7d0a148-96db-4f9f-9565-49ae0b1c8135", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8605662-c08d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185060, "uuid": "7712e21c-e8bb-4c2f-8334-bcf87fdbe144", "comment": "Malware payload", "value": "305eefa85968ee33d362cfd2f87bdb89", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185060, "uuid": "3b863e8b-e528-46e8-898e-af6d3a1d93b4", "comment": "Malware payload", "value": "7ca026915d697c052ce56cb6024ef7d11b30155694642b374b29c3ea23be5ec8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185060, "uuid": "d3f11fae-7f18-4bce-b0e6-3dc0eec3a49c", "comment": "Malware payload", "value": "5681e7d3c93f61a33eda4bc1b4db5cab938f0c3d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185060, "uuid": "167ebdf4-f848-4cd5-84ff-222f54cf548e", "comment": "Malware payload", "value": "930ae3e3f0475b01ff61029664bb46c0668654757b474a85ad36fe42e41254e2a6467d73e571bc0ca5a59e47fd47b8f0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185060, "uuid": "6a155238-2178-4a86-bcd4-1d45fd15f5b4", "value": "T12D65337ECBB86BE5C7D45194B0BAF7EE5DA0E8A6240DF365F6C0260036396D50612F32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185060, "uuid": "e4fe9dde-b247-4cc5-89a9-c6d88a3022bb", "value": "24576:ik7SDVrTjaYRz9P4vnMuUFkc7kNqhb6k7SDVrTjaYRz9P4vnMuUFkc7kN2h8:376XuYRz9P4fMLku76XuYRz9P4fMLk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185060, "uuid": "0c2c0657-2134-43a2-b6c7-459f42326183", "value": 1539564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185060, "uuid": "6a2cefda-c7af-41a7-bae1-88becaed98a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185060, "uuid": "1b2998c4-4406-469d-807e-d68d73807c1b", "value": "7ca026915d697c05.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6e3aeb-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181682, "uuid": "607f8ffa-c522-4bcd-84b3-7b4a9a21e3c5", "comment": "Malware payload (Mirai)", "value": "3ad61c1e5efcc93cf6aee73e37fdac45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181682, "uuid": "01f78282-a59a-4a64-b4f7-8a7cbf5acfde", "comment": "Malware payload (Mirai)", "value": "7d114b0353b479ff7994f09800320cc9ba06b0c5291ebfa6ce0c1d3018c56661", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181682, "uuid": "29eb2497-86ba-478a-91a4-cb267eb2bfc3", "comment": "Malware payload (Mirai)", "value": "ebfd75fc86a957d80c015224f3eae2a8077f6294", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181682, "uuid": "16e37fe4-f5a7-4ae4-94b2-d775d1f0eea9", "comment": "Malware payload (Mirai)", "value": "5a62da79f6dd62db35ddf4555b78e65646eeab900fb3699b0b7b7dafa31b4c5e7eb8217ebc600fdb25bc9dee16c15e20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181682, "uuid": "f485a14f-c022-48dd-8c4c-4b9bb6f6b919", "value": "T10A23014320D3BA03E0345CFA4562CC8DB55EA679B2BF7BA735490E154C349A3ECB19AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181682, "uuid": "a1caaf55-bb7e-4653-b8b8-715366bc1a48", "value": "768:aK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFKc9q3UELWt/iw+kvBGg6+fYtrBHc:E12O1LCNguovDPH7TcrslLWhiw+kvBG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181682, "uuid": "f266a80a-c0f3-4aa5-af7e-b46e5cdd0868", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181682, "uuid": "82a92089-989f-4214-99fe-29ad968d1ca9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181682, "uuid": "8a957167-9cd3-4007-a4b6-f72d1097eb74", "value": "87sbhas6as.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fbea9ad-c0a1-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791193368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791193368, "uuid": "33663fca-5d86-4ad7-b7f1-14ebcdcd4df1", "comment": "Malware payload (RemcosRAT)", "value": "a0dccf1309d8b32e9cd3c271b3cebb34", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791193368, "uuid": "024c196b-5975-4411-876c-fcb6b3efcda7", "comment": "Malware payload (RemcosRAT)", "value": "7d37da20bddce8b2b14060396ed6e7b6801d18103b66dddd9f70a382996877c4", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791193368, "uuid": "9d552d8f-ecea-4876-9674-c977e975dc99", "comment": "Malware payload (RemcosRAT)", "value": "60f146f05cbb9b351b91c42da79f117bbff2a361", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791193368, "uuid": "6ab7baa3-95a3-4f3e-94b9-9a39431ae49b", "comment": "Malware payload (RemcosRAT)", "value": "504bebdc603b11e2f78a24bc41edec6e9e50351d638f74433a52bdd23a82c96eed1b4a08480a5bc566aac1b0cfc7183c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791193368, "uuid": "2f46e1fe-0a5d-48a5-8065-1490a32f042e", "value": "T1F26284784AF2BDE64EE3E1E5444BDA614884DA3FF4400D19F49F44FB032863D9C6D296", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791193368, "uuid": "b628aa8b-d454-483c-8c84-27c5522c864e", "value": "48:3GubZubH+p9LhxXxTYkOovu7y7uuuuuGJub6ub4mub2PG:WeZe0LbHo7Ue6eje2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791193368, "uuid": "0ff7f0ab-63fd-46aa-a802-e2d3756905bb", "value": 14791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791193368, "uuid": "3b7cf8a0-616f-40d6-b6aa-4370942d5510", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791193368, "uuid": "6cfadba9-d4e6-4dae-8eb5-22d89b11e3b6", "value": "GFG.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2c328d-c08b-11f1-927a-4201ac107004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1791184129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791184129, "uuid": "5dbe6dd9-3708-416a-aad8-bd790686c645", "comment": "Malware payload (AsyncRAT)", "value": "846e2b555e7c16d538c1e84b38bcb26a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791184129, "uuid": "40e93634-ab07-48d1-8e83-5cc88172c920", "comment": "Malware payload (AsyncRAT)", "value": "7d4a07190ba8677db6da293201874a923a8072a8fe3e1d2eaaede710f3fc04c6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791184129, "uuid": "0253a00e-34b0-4075-9e9c-794735dc3a4b", "comment": "Malware payload (AsyncRAT)", "value": "961466f8dc90b322c4e108432b6d7bf4e4f1545e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791184129, "uuid": "9cde5f86-2e3f-4671-beb6-d1e2b21ec598", "comment": "Malware payload (AsyncRAT)", "value": "28f70869ac1cdae37969732b75ce64e835cc5f527c6771ff23fc3d142452665dcdd4f40d2c856c9ad29565f5a02d2a50", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791184129, "uuid": "8cf7f3b6-359a-47f9-acfc-13161e18eb3f", "value": "T1D9333C0437E9812AF2BD4F7868F21251827BF2677603D95A3CC851D76B13BC29642AFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791184129, "uuid": "17897c8c-c23f-4af9-be30-7d01f1e14a97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791184129, "uuid": "768f106e-cdb0-4aa3-bc5b-71335a11c105", "value": "768:kozqM7wdcb64GBklNAckeKECP4uXy0bNpDC7uEsDPKA8gqoTClZM2tYcFmVc6K:kozqME+EL9bNp27uEslqoWrMKmVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791184129, "uuid": "7f1bfa84-2dec-4400-b176-072a60f1c22c", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791184129, "uuid": "1165a459-ff48-432f-a650-3cbf4ffacc28", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791184129, "uuid": "b601a412-08a4-4f87-b3c1-3f8e4c5c1828", "value": "7d4a07190ba8677db6da293201874a923a8072a8fe3e1d2eaaede710f3fc04c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2880bec0-c082-11f1-927a-4201ac107004", "comment": "Malware payload (NetSupport)", "timestamp": 1791180068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791180068, "uuid": "b7e4e88d-029c-48ff-854c-5e9ab9ef2e4e", "comment": "Malware payload (NetSupport)", "value": "dfa5f0e5839ff343daeb096a57daef83", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791180068, "uuid": "c3e9baca-0cec-467f-bdbf-0549ed610f41", "comment": "Malware payload (NetSupport)", "value": "7e6efb2f5a2c4e858fd3a2d418af793e3d33792de03c3f8c4aa6f93018d6af2a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791180068, "uuid": "84f9a85a-54b2-4a38-a6f3-a9c861f9955a", "comment": "Malware payload (NetSupport)", "value": "b5a1fc040c05b9c0714f46a5d5cb01114a22b801", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791180068, "uuid": "b917e8c9-cdec-4070-9786-e32de82b3854", "comment": "Malware payload (NetSupport)", "value": "4c2d2cb597c5b5e42b1eb4968042c634116312c4b8b0bd8be5391f885dad3df81aa7437b925deec6479fc0ca43ab7c9c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791180068, "uuid": "6e280ad4-1e8f-4a4e-aca5-009cc6105ac0", "value": "T1BF5629CDDA1FF779C013D67068EA9BEFE26448A9FEC11639667B3A2C9471FC12111620", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791180068, "uuid": "19c4ebfa-cd6c-4d42-a07c-c15c67a69963", "value": "61fa20e04a6d92b332b9552404fa2577", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791180068, "uuid": "a8fb0d55-5bb8-4403-8f7f-dc2c840c5594", "value": "49152:axN93caozS/KFIVcx+DEyqplqkBrlIWzhM9ip2/HAZvMbJSiAIn9YhO7zEM+05cf:S93cl2Klyqhh7FVvM0pIn9YcABt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791180068, "uuid": "0637363f-56a1-4717-bc3c-add72db2fe8f", "value": 5997056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791180068, "uuid": "de9ae1d9-ea98-478e-b36e-6efdad852483", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791180068, "uuid": "e8303677-d446-4548-b255-b0dfffa82440", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d5b1faf-c118-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791244554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791244554, "uuid": "354cc2d2-c276-4c3e-8ad8-d11a4c228909", "comment": "Malware payload (Mirai)", "value": "01ac32ba12ccedb579930318e515862e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791244554, "uuid": "4e43b89b-015c-4ef1-b68f-078815602056", "comment": "Malware payload (Mirai)", "value": "7e71a7685792289f53de52982089c87fcc022e56055ab4b997aa14c996eb2ae8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791244554, "uuid": "2b1ae4e7-8abe-4995-a2a4-a3d626c1707a", "comment": "Malware payload (Mirai)", "value": "662d5a321274b83e9442504f1e21a44cedee0ea6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791244554, "uuid": "02582b4a-58ba-43f3-9882-fe2926653f27", "comment": "Malware payload (Mirai)", "value": "2353293b5a4c847e2174161045a2e4a74af172f18baef6285a7c90cee09f07218710a3077afec92d607280257a670332", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791244554, "uuid": "51a0745a-7770-4fac-85ac-511df8bea4b4", "value": "T12CD46C56BD919B91C6D24ABBFBAE4368731757B9D2FF7007CA005F903BDA4810A3E241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791244554, "uuid": "275fe7ef-4d84-43a6-96b9-b11022412286", "value": "12288:IuZcNYXnuuBVLdCclDYISJKvkkr8nwZaUBnCAUXj14Ze:IrNYeKdCclDYISJKvP4UQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791244554, "uuid": "609c62c3-5c31-42e5-b27b-880d61c967f4", "value": 629576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791244554, "uuid": "456ef267-08f5-4259-9638-b99b2d1d6be6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791244554, "uuid": "08b3e8f5-d23a-4e5b-a8be-6f0031779187", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad17e807-c0e8-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791224099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224099, "uuid": "d543d389-b573-49a9-854e-60d999918576", "comment": "Malware payload (Gafgyt)", "value": "94e7315208f95032d8181b0445dd7285", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224099, "uuid": "4ed1cfc9-5ab2-422e-8e83-d237476d01b7", "comment": "Malware payload (Gafgyt)", "value": "7ec5b590d97db12a7296aca834e0075d2f41df6cc768ff4431aa61f91af0f837", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224099, "uuid": "e1c3e5fa-2ad8-4ccd-9f92-ec921e8fc8a6", "comment": "Malware payload (Gafgyt)", "value": "763bdf3728151d3c3dc51a449b39dec71857622b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224099, "uuid": "1953b36d-51e0-4890-809c-3aa91d75e227", "comment": "Malware payload (Gafgyt)", "value": "563c070d7e67a85cd2b670f6f2fd8dc6e654608fa1f93565e57776a8ac6f66c18a7a1753738df6c621a61389388441aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224099, "uuid": "3dfafff6-0cbb-4196-af29-cf1feece8885", "value": "T1785302BA259CBA70F0778AB7D6B1670D92394902E4B1C19433BD5E8B26C3F04CFA9475", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224099, "uuid": "94c3f3d0-eaf5-4550-847f-db4c948f209f", "value": "1536:gU4kagMkV1Px2EnqRNjec/sUcZqNFDLkg4azHz:tT9zNYEnqRoVUcZqNdLGazHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791224099, "uuid": "e2edad7c-cac9-4782-9a17-d4a74bbdac15", "value": 65672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791224099, "uuid": "cfaa4129-2e71-4662-b84c-973ca036df33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224099, "uuid": "a7d9ef2a-757a-41d2-894e-876986822bc2", "value": "xnxnxnxnxnxnxnxni586xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5be3a5-c0e8-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791224094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224094, "uuid": "d51241ad-04fc-4744-a32f-a32bf59f1c3e", "comment": "Malware payload (Mirai)", "value": "52643c5f0b0d9049fa167e6cd2afb9d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224094, "uuid": "4c6e0207-207f-4ed3-b74f-0eb6df5334d5", "comment": "Malware payload (Mirai)", "value": "7ff1268ae4ea1689d39bedbf9c1c4bfb3f2a19b0b9c64f4d8ab0b089f28bef8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224094, "uuid": "2e2b7e73-96de-425c-b64b-f6a6f9ede592", "comment": "Malware payload (Mirai)", "value": "d9c3c1214985a5e74bff1ea2c286203267e47d2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224094, "uuid": "bb7e5af0-1eb3-4ef7-b665-d4e46c04b1f5", "comment": "Malware payload (Mirai)", "value": "d1c3f09c783c47d333d13dae0544f526d5fd2eb26a75702a25de5a30e6c9adb0919f2a483cb51ac780878c787bb10392", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224094, "uuid": "a5d0b160-6e32-4714-bc3e-1d319458f992", "value": "T16CD316EFF2D1CDFAC09255B5EAD791539422F4380A22E20733C3FDA52A6C9E41D592D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224094, "uuid": "7fe6431f-dbf4-4b2f-adb8-94f011f6430d", "value": "3072:JOWpvqqnqOqq88qvqXgXXqYqCq0qNqLqSqPqghqq3qqqqjhqhG1ujhDj1w0M7qZC:VpvqqnqOqq88qvqXgXXqYqCq0qNqLqSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791224094, "uuid": "418ecd45-7cbc-4438-9dca-c26393f7ac15", "value": 135881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791224094, "uuid": "0ecdc78d-eb68-468d-992f-a12bf9b4514a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224094, "uuid": "61307af3-aee3-4dcc-a0c0-49c8d95aa46e", "value": "ntpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "415335e2-c09e-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791192135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192135, "uuid": "2e60ddd9-41b8-4c65-a4d2-03e24ab21eaf", "comment": "Malware payload (RemcosRAT)", "value": "469a8f715bb5830353332e9859f770ec", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192135, "uuid": "8189a85d-0a8d-46cb-9863-2e6e77a066a5", "comment": "Malware payload (RemcosRAT)", "value": "800376b9807c86fa1e3320432f40339f31209093ab16efc90ef9e02ed218df11", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192135, "uuid": "eecdc9e9-abcf-4d53-9a2d-e9579541a588", "comment": "Malware payload (RemcosRAT)", "value": "3ad4cabd68d62b4c586b2ae2564904a771bc799f", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192135, "uuid": "59d9185f-a301-4e67-8287-5fa25e4eeacc", "comment": "Malware payload (RemcosRAT)", "value": "ab1819304bee28f7ebefb32fe364079f7db3a7b7baa4caa398e40f4e80bbb28433e6f5b7b50e61dfa2f25eb89e77039d", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192135, "uuid": "2b0e5cfd-785f-4c5f-b065-3314056bf8a7", "value": "T121A4232430C0DD67D1AB49FCC8E0C253711BFC859FA62D1BB28A335F0A767845E5B9A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192135, "uuid": "7d84dd5a-1447-4697-b4fd-ec707abb9522", "value": "6144:IXq0SWp/gRH8oCM/xV19jpULb6zWp5chJymus37JeMoYXq6gHRUm16/hVmMOzTKr:yp/6Hf32gWb/mjJeM1Xq6gHKRSMZg6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791192135, "uuid": "70278ee4-62e4-41d4-9092-97be9fd33786", "value": 455680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791192135, "uuid": "0c1bbda2-71bd-4bb2-9c65-a31b8d49d7e3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192135, "uuid": "81723a30-95b8-401d-8e3c-b0d29e67a22c", "value": "PO-2026-00289 - S\u0130PAR\u0130\u015e EMR\u0130.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b321addd-c08f-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791185884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185884, "uuid": "03315aaf-d21c-424e-aada-794d81f7ed96", "comment": "Malware payload (Mirai)", "value": "c7ece7ac00a30d39c6663cb60877a9c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185884, "uuid": "4ba40008-ec17-4dab-9e04-c0b5fdd66047", "comment": "Malware payload (Mirai)", "value": "80276d9ff0aa4d87530f3f101a36d7f4f3f5d8bc18b2af8485df70c10c2b988c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185884, "uuid": "87ed707e-1203-4d5f-86c8-355e9331c312", "comment": "Malware payload (Mirai)", "value": "6d230b0602519676cc702166a72be89c2d1cd3e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185884, "uuid": "7243edea-cba3-47f9-b0e8-fb43ea2a4c66", "comment": "Malware payload (Mirai)", "value": "6579c1fce197ff52265adc9077d6347f0f8fb4800bf3990ab366e57b2d859c57c6a36dba1b68649c549571938764ce03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185884, "uuid": "5c1a5f07-87c7-4f30-b9e4-a20c281ecba3", "value": "T117257C5AF2B374FCC067C030435BDB62AC35F46511226E7B25C4DA352DA6EA01B2AF67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185884, "uuid": "6a60180b-639a-4981-acc2-3562550f178b", "value": "12288:snwoBmMYn+UGPwFA6l5ZFXikiJD2eqmyogRu538aRAK5k:snjBmWUGPwFAq5ZFyk8XBAvaRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185884, "uuid": "fb2286ef-b85f-4615-8aa7-e02e4ac5585c", "value": 1016528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185884, "uuid": "6eb20b78-fea5-415f-b407-6605fe0aaf15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185884, "uuid": "9f8598ac-cb2d-4a25-93c8-def75098909d", "value": "bot.amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a47927-c0de-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791219823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219823, "uuid": "6c9cc003-7590-4801-90df-0c533989e729", "comment": "Malware payload (Mirai)", "value": "433e15d693753a36b13bec6d1761caf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219823, "uuid": "31eefae3-8c56-4dc2-b8a9-dcf151675ddf", "comment": "Malware payload (Mirai)", "value": "803cff17b00020a2e4206e84ab2ca22eb06ab61351d97336d960ca90e4d31cea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219823, "uuid": "5eab4c90-2e60-41c7-90b2-9c64b15dc47b", "comment": "Malware payload (Mirai)", "value": "7bd61a1c1a270113ddf1fbd97914292953f7fa12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219823, "uuid": "c893053e-0659-4ebb-a818-403e019abf67", "comment": "Malware payload (Mirai)", "value": "7a854e52c602ffbcb9882ae5d2a13e62b2dbeaf4aa6091b8e7fb41cfc015c7b446323648694d4bc96cb41080acc83a47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219823, "uuid": "d028ff59-749a-473d-b6f3-79224c156e9e", "value": "T143543B46AA408F13C5D22BBAF79F425533339768D3EBB20689286F7437C769A4B37105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219823, "uuid": "6d9a805b-7eec-4a23-9985-16d51a2ffcaf", "value": "6144:GfZzMS+8QmAYoYqU07YYiB3m6+amAGTdaYa25qWjgdWAUZRqAcMFOHxGV/B61j7j:GfZzMSdQmAYoYqU0EYG3mYeTdaYa2dj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791219823, "uuid": "c200ffc6-3171-4913-85e2-d805b283d266", "value": 304762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791219823, "uuid": "72e69606-aff2-4a52-8681-50ea1010aee1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219823, "uuid": "436b130d-1b3a-4496-8832-d36698032707", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829b72e1-c0c3-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791208136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208136, "uuid": "a964eb30-1ded-4f32-80f9-adc832b15347", "comment": "Malware payload (Mirai)", "value": "bc3070341adfe941fe400472f7c56441", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208136, "uuid": "41069924-ffb5-46a3-b6e3-e3420749eb82", "comment": "Malware payload (Mirai)", "value": "80ef3c6e9929ca834a0a4b5ce2f833689a69e32f3748083e215e24dbc72831f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208136, "uuid": "86e85072-26e0-4ce9-8463-bd08656bd01c", "comment": "Malware payload (Mirai)", "value": "5dcc57b7384007ce56f3e718f1e0abd7737e66be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208136, "uuid": "a8bb51e7-0230-4bd3-bcec-217d61769e8c", "comment": "Malware payload (Mirai)", "value": "2d7f577d2fcbeba838966af6b7aa9935f8ee812265a61c0fba6bd28e297594eca45a36e1ecaeb1b87fe9cb91639cbd02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208136, "uuid": "d59ba989-793e-4c0a-86d5-3014717f718c", "value": "T19FF3E6CCED54472BC2D323BAF74942CF37361A789797B31159A7EAB02BC67441D292A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208136, "uuid": "f66d1986-f225-4cd0-b967-d560d5845e06", "value": "3072:AkAR5cCI0gu0gb2kqX6QSsSmaSXNiqSEVAmiL8qka/2agGpOFxqSentSbU7zHGsD:kohsO4AVkMgCnQcCDmP0Q38MO5tx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791208136, "uuid": "246bce55-fc92-43dc-b017-e807b05e3de7", "value": 159618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791208136, "uuid": "4b9a7062-2f26-4fc1-9377-bd562301194e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208136, "uuid": "909c326f-c1ef-42bc-a9cf-46dc66527053", "value": "80ef3c6e9929ca834a0a4b5ce2f833689a69e32f3748083e215e24dbc72831f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0be8e77-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (PhantomStealer)", "timestamp": 1791190577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190577, "uuid": "43826b1d-8613-44e5-b7ea-c2edd50b87c0", "comment": "Malware payload (PhantomStealer)", "value": "22d130366552d6117c83f1b9e9b79707", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190577, "uuid": "0c5bde22-8f7e-4fb5-9103-a863bb7db921", "comment": "Malware payload (PhantomStealer)", "value": "81491259304b17abea0d7f2632c0ba5dcc809a3dfb4d3d4a694c109c107fed51", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190577, "uuid": "a8a92dbc-d043-44a6-b202-333653d5af64", "comment": "Malware payload (PhantomStealer)", "value": "19d6b6710ebe3d7e13e82608f853679333d77f09", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190577, "uuid": "3beca2ba-a0d1-4504-a96a-0dacd77b6cb4", "comment": "Malware payload (PhantomStealer)", "value": "8fbaef79510076c72f732c2d4d9461b340216e4d5500403386a19c34f3faab6bad7b4c91a45af40bee77f66308b588cb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190577, "uuid": "0f92297e-cf95-412c-912b-01139c326d51", "value": "T1493502AE688719B5B3ACD701B73F9AC8D3B452C10D9DD006C26E8EE81AE52F7D572D04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190577, "uuid": "1bf0599c-8bba-4a05-ac18-8c3aa89f73ea", "value": "24576:r3aCM2ymAZTMrU0gqtVwtfLLoeZSFXxy7CC6jVLUjfbmwqaNdv:r3aC7y1ArUxMwKeglxmfmwxNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190577, "uuid": "ec4efbac-a63d-41f6-a50a-d0cfdf43070c", "value": 1133266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190577, "uuid": "39881b1c-e089-46d3-a8cb-1a40205a2860", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190577, "uuid": "846f61b2-e6ca-48b1-bc88-07af40e7ddff", "value": "20260928_18.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c30d83c-c0f7-11f1-927a-4201ac107004", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1791230271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791230271, "uuid": "c027dda1-f56b-4d59-b555-e3812a3319c1", "comment": "Malware payload (Cobalt Strike)", "value": "71a54cfff6a1e3cab470f67588bf92bd", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791230271, "uuid": "b06b9626-17c5-48cc-90fa-4dd119e34e91", "comment": "Malware payload (Cobalt Strike)", "value": "81883bede526e686d7739be06ae32c73f78058a1603f1756c3263162452793f8", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791230271, "uuid": "256120b7-327c-42f1-b66f-49c65e8ba3bd", "comment": "Malware payload (Cobalt Strike)", "value": "c1e6fc8236329328629f9c42e4eae7da426c1772", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791230271, "uuid": "05287d3b-784a-424a-84b8-764e453f6b45", "comment": "Malware payload (Cobalt Strike)", "value": "3acad7c5f8b0415ae21eaef25df89cec88ec7a4b709367e9169cf49d3ffbc0693bfd8e69dd8746bc2a09b5d3e912194c", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791230271, "uuid": "bba6cda5-55f9-4e76-9b17-eb2999ff47f2", "value": "T104940213CF0584EFDA995C7701FA7EF15C22B7EBB4924D765BC8A8853A27BC17226018", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791230271, "uuid": "f89e60e3-913d-4bb7-ae5f-7e3143476e2e", "value": "aacb2e69d0124c38c8150f18be1a9539", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791230271, "uuid": "39070bfc-7db8-4488-8e59-985d40a03678", "value": "6144:ucDcJGK37hGRjKy51dY7yjJyglJrSxsvctsACLIBwlKY5PPNFqbYKD73yWl6aj:KFSjKgXJy6EsUr+wAXPNYkKD73y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791230271, "uuid": "1e79e409-9faa-4227-b946-212516789af8", "value": 448040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791230271, "uuid": "1c24b7cd-7c0e-42cf-acc6-95e9cc733333", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791230271, "uuid": "4937f1ae-60f2-4287-856a-955390e98c4a", "value": "goopdate.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1282e819-c0e1-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791220833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220833, "uuid": "f5b90471-9b0b-42e3-8d5a-da9dc10595c4", "comment": "Malware payload (Mirai)", "value": "fb8ac110e298a29c21a247331b1561c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220833, "uuid": "15e247a7-bc2b-4677-b503-40794e165ab6", "comment": "Malware payload (Mirai)", "value": "819777ab8e5678964da09774fd8211318364e796acf056797cdc4565abb74057", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220833, "uuid": "e2374f85-f80b-41dd-8007-be620992e5ab", "comment": "Malware payload (Mirai)", "value": "b4bffc0675b80078fa7530719f70b776234bd1aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220833, "uuid": "158440fe-b11b-482d-b04f-718cab5a5a9d", "comment": "Malware payload (Mirai)", "value": "2cc58a8db0447199c5cc6321868b484328987f633ab961c694d79dd7a2f1444b620bf3fbca1e22c6226aaa95d9d97a22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220833, "uuid": "541d52de-6140-4291-9ead-58d462e1f326", "value": "T119D45D66BD919B90C5E159BEFB9E436872035BB9E3FFB006CA045F906BC94854F3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220833, "uuid": "bb02c4d3-5f2e-4852-bc50-0dbc5ef81736", "value": "12288:bpOCURx1fcgJu4FOaEdGaRAWnLaBOE09D3OE1BHgEyvex:EHC2FOjPFsayv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220833, "uuid": "2d3e2321-7f4e-44f9-8ddd-87bee23c9767", "value": 626296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220833, "uuid": "4163a115-6a1d-4871-9659-28f78de5e142", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220833, "uuid": "034e434e-980e-4489-917d-d7d893c21593", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b9dff9-c0e8-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791224201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224201, "uuid": "a36c2f2c-8957-41f2-84c0-df704e11b181", "comment": "Malware payload (Mirai)", "value": "f3d2a3b2d954fe3cb1a22bfc139e107f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224201, "uuid": "1062e883-0350-4a6b-9781-b842f4512f3b", "comment": "Malware payload (Mirai)", "value": "81ae45a399b8e23005fdb07a2caa2b22d4618893b67a92a29ff6813352352023", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224201, "uuid": "c899f1af-873c-4701-b052-66d9439717be", "comment": "Malware payload (Mirai)", "value": "c1ffb1da901ce4bc8f85b538ea70fcaf29071d57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224201, "uuid": "628292ee-665b-4ff5-a06d-164fca37d540", "comment": "Malware payload (Mirai)", "value": "9c8159d245669184891ad4520d9a6a6080f4a90a271ec1dd43842cdd14e1621879c53ae4621888ae3227dc680e57bfa2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224201, "uuid": "badf2b0d-f6e2-4de0-91f7-3b886fdfdd09", "value": "T148242A45BCA18F22C6C522BBFB2D428D372757ACD2EE71039D246B7427CB95A0E3B145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224201, "uuid": "4ddbe7e7-c28f-44fd-84cf-795ae31c6b2e", "value": "6144:Rv8r+flZvmsgr4D4FdI6ku4a9XyHSVZWeRm:Rv8qdZvmsU48zou4a9iWRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791224201, "uuid": "da9072d5-6179-4e48-bb23-d38c4c1bb4de", "value": 226360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791224201, "uuid": "db1e911d-9886-4472-9c77-86f004382686", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224201, "uuid": "7f60c26b-22c2-484a-989b-b1c115e6c0a7", "value": "xnxnxnxnxnxnxnxnarmv4lxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842e9778-c0e5-11f1-927a-4201ac107004", "comment": "Malware payload (GCleaner)", "timestamp": 1791222742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791222742, "uuid": "07fad765-d585-4cde-a371-c169893dc02e", "comment": "Malware payload (GCleaner)", "value": "753270b3843109dcb5f1ce2f2d095b06", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791222742, "uuid": "78b0facf-5012-45c5-8427-25712e8b5edf", "comment": "Malware payload (GCleaner)", "value": "81ce9fc4460358010edd5b6939c3cdb9e25831868bc33ddb4f23a473ab467ff4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791222742, "uuid": "c3487453-442c-465d-b6bc-4f43b8287c6a", "comment": "Malware payload (GCleaner)", "value": "43a86a5aeb436108b5d2c17c3cdfc097bd6fb607", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791222742, "uuid": "1b5bdbca-71b4-44f8-881e-6d958caac85b", "comment": "Malware payload (GCleaner)", "value": "1734eb3444d5b85f0ea327f689a5a93bae2227008d2ee1e205a525de7b72425d4d2bd81990056840d68decb0ff97ff5b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791222742, "uuid": "85488919-e3e0-43ba-ab81-870a519c69c7", "value": "T107157E62A3934433D1722A7D9C2B52649B2A7F036D37E54A27F40F482F3924D76363A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791222742, "uuid": "f2576be9-dd72-4d38-89d7-083cd266488c", "value": "b01b7a7d0c9d9b9bf573a0fc6aed5d5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791222742, "uuid": "f707f478-f7aa-4820-a7e4-fce611c243c7", "value": "12288:l8KmI/ZglLGRQVQYNc/qSsdMy6cyPYib49hX6G7oGUVicfPo3OqfPjKMgqMALFB7:1FOBVPNcLsivHiX6nTqfPvlL79EUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791222742, "uuid": "8e114d57-e0c8-44e8-89e2-61547c5a27f2", "value": 956176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791222742, "uuid": "ac884440-1eb8-47e2-9cb0-6c5331259657", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791222742, "uuid": "3f0d1697-0687-4912-8a46-13df06e4acc6", "value": "setup_euone.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "decb9df7-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181662, "uuid": "482fb2d2-fcef-47b6-aee1-ce755a1259a0", "comment": "Malware payload (Mirai)", "value": "a1e2d1186bd4cf38393e44bb97ef4008", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181662, "uuid": "0f7fe539-65cf-4f9a-9c3f-1c1949925465", "comment": "Malware payload (Mirai)", "value": "82765c308af4f3638437cc708b0f0c3990c0dafda8e6b5ac7f8cb43dd978bc38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181662, "uuid": "16236d7b-33ab-4f24-bd81-9a8eb92834e1", "comment": "Malware payload (Mirai)", "value": "33723ff553c9351a39538657a34c96365b683a6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181662, "uuid": "6ed29ca9-8e6f-4ae9-9ed6-99a3fa84585a", "comment": "Malware payload (Mirai)", "value": "2f512801f82cd019dee53334e763e9eacc48748bdd02285b0210bab323de41989b7a4d8c206dd17d22afc1e2c7947170", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181662, "uuid": "6569b5a8-daac-4ba9-8446-6d833e1f27cc", "value": "T1CA043A06B681C9FEC897D1F447EB9621DD31F81E0635769F6794BEA21E4AEE0270C360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181662, "uuid": "2b96c96a-2020-4240-a88c-94b675872aca", "value": "3072:YDQMpl573GiFkzN9uXEqr2rNHfW5z11nH5fE9Mt2ulvOYUEaMPlor9:gQMpP73Gy0GXUujJW4pNnW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181662, "uuid": "0d0c393d-c06d-455b-9ab8-87082b05cb1b", "value": 177280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181662, "uuid": "2ef2e4dd-277c-4a28-b2d0-da0dbe8964f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181662, "uuid": "ce0b3eec-8825-46a3-9be8-7931c79a4bec", "value": "wife.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ca19db-c0ab-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791197753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791197753, "uuid": "5b2667ff-a317-41a5-8832-1e09306e0f42", "comment": "Malware payload", "value": "921bdd82446890c2cecfb959f6e3fb5e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791197753, "uuid": "b40d447c-69d2-4036-8645-5413a10c0911", "comment": "Malware payload", "value": "82b90c2ea51091430ccf7dcb7125b298eb6406b39dea8512706d6b7c21d618e3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791197753, "uuid": "9f5b34ff-d164-4ba7-a988-e0ea6fe37538", "comment": "Malware payload", "value": "9bd0ba6a5afc7135916f249de8c53b312bcd1c6e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791197753, "uuid": "f80d5714-bafe-4cf9-9a35-4aae74e04dd9", "comment": "Malware payload", "value": "26a73b381139435dea9fa40f8665593f7fc388755daa6be43d5deb9d20c4cf00cfed533e0feec266944b1190fe0ed736", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791197753, "uuid": "86d16adc-e001-4a64-9c15-121b948f9a07", "value": "T1783125F3B4F6D972168C641479E98B93E58B0A2748083911F0DE38157B288D4F1A1B27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791197753, "uuid": "ba1f777f-2851-49ff-8081-44d96385994b", "value": "24:0vq90Q2bnDN0bL6o9H2WkUEWkcicHJOv6PIM5D1mSBkK9PDB65wQD2D922d/f2GV:Siv2bD89WhUEhcicHJOvOI2D1mSNDopS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791197753, "uuid": "27239b05-ed98-499d-8c74-760a169564fc", "value": 1529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791197753, "uuid": "9f45ba58-71ee-4f1b-8d15-b1437bfd6a55", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791197753, "uuid": "5fb48ad0-576e-4550-be91-2c95d692ca6a", "value": "agent_i.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af74d1bb-c08d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185019, "uuid": "3843a044-f29d-491f-90bc-d1c8c09a79ed", "comment": "Malware payload", "value": "ed5d91cace01ea0fa44d80405c0a6612", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185019, "uuid": "011642b6-f45c-440b-8b14-8b2f70559006", "comment": "Malware payload", "value": "82e1b1abedce7047985d6e7ef4feadcce136e84fd0b98290ad7b70e9290d718d", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185019, "uuid": "ba108228-df05-4456-8b36-b3f555092263", "comment": "Malware payload", "value": "d4680218c7dc38a4f2575076105899c313797fcb", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185019, "uuid": "308a898f-0f67-47ee-8dae-b5e699605c74", "comment": "Malware payload", "value": "72dfa13fa7cc62b7e8b16a3416f57ffccbe9f4b0625cfc7c6120db954c2558291f8fa1cec49ceccd7f31a3abcd218082", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185019, "uuid": "440d358e-eedc-4531-bb68-d38d60c6ab50", "value": "T123422A5CAED1A1B0EA1703DDB7AF24690228A0C7200DC484F54CDEE87F46BDD4A56B57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185019, "uuid": "18923eb3-a3e0-4aee-ae1d-404d79417eb9", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzPbqFtCOSnDRUM:sXX+/DV7k/3mFtyRUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185019, "uuid": "d70c1423-bfdb-40ec-845d-f2aa6d99a964", "value": 12050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185019, "uuid": "32299e6a-bc11-4d9e-86e9-3e74a551f639", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185019, "uuid": "821534ce-80e6-4075-8877-4c30ea2e1c14", "value": "fuck_niggers_39.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97bbed7c-c0c3-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791208172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208172, "uuid": "fdbe3d41-6cb3-48b3-b106-f1cb5c65644e", "comment": "Malware payload (Mirai)", "value": "19887a860c392fed64a3edfe32a4b760", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208172, "uuid": "8c78f335-306c-470c-a610-bb4397650707", "comment": "Malware payload (Mirai)", "value": "832dfa6e05eb7b7d2c2429ec8656b2e82feef39e91d8a3b03cb1aa124d0f4508", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208172, "uuid": "d918d769-37c4-49be-b07a-307e2d2ca825", "comment": "Malware payload (Mirai)", "value": "d760c302a79de90cf9834c8e9805c0063a483eaa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208172, "uuid": "03eaa201-e52d-4fed-819f-1944f1e54948", "comment": "Malware payload (Mirai)", "value": "6c9767851fdf4cce6b548460885ad56fa6bc1e76fb7a5bca8d7cc16e4b94b12095c260d25ff76a9100c17d210c459036", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208172, "uuid": "0b541985-ea12-4430-8861-b39449c9f80a", "value": "T13FD317EFF2E1CDFAC08255B4E6D791539422F4380A22E20733D3FDA52AAD9D41D592D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208172, "uuid": "ab5f20c1-5dd1-4697-a62c-9c016b5c97fe", "value": "3072:JApvrqnqOqq88qvqXgXXqYqCq0qNqLqSqPqghqq3qqqqjhqhWKI/tRIFi9A0caqu:mpvrqnqOqq88qvqXgXXqYqCq0qNqLqSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791208172, "uuid": "7ffa3acb-5026-4549-af8b-dd335debb1a8", "value": 135878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791208172, "uuid": "077a5501-33be-4009-bcbf-ee5177a0b9b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208172, "uuid": "d8336123-aa99-4193-a1ed-50a8389a60b0", "value": "832dfa6e05eb7b7d2c2429ec8656b2e82feef39e91d8a3b03cb1aa124d0f4508", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdec0ed7-c0d9-11f1-927a-4201ac107004", "comment": "Malware payload (ConnectWise)", "timestamp": 1791217792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791217792, "uuid": "20933ee7-87c4-4652-802c-23119119d86b", "comment": "Malware payload (ConnectWise)", "value": "c51ef0e96d102409320281316bce244e", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791217792, "uuid": "ff5b0745-398d-4e42-8aab-cdde2a6410d3", "comment": "Malware payload (ConnectWise)", "value": "8337819ad52e9033786ecbdcef7043c1092735805670223c098832108ee6faa6", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791217792, "uuid": "71efec6a-cbd8-4538-aedb-b5462f64fa5a", "comment": "Malware payload (ConnectWise)", "value": "2b29d8bde8b3ac1ddbaff6f3633d644869526a87", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791217792, "uuid": "cd35e16a-1384-499f-91fb-056b37563b85", "comment": "Malware payload (ConnectWise)", "value": "7d6ed1afbf814a692524fb73cad69b84138a133e0dbad206a2e885f803d0c47ff66c5f2f86eff673aebc88e10b17b86f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791217792, "uuid": "4649db10-a2e6-46a5-b456-343f3466fc5c", "value": "T12F646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791217792, "uuid": "1a89cf93-000a-47bf-88ab-0a28ae77a236", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791217792, "uuid": "801dd9f2-58af-4a09-a2a8-387bf7043b88", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9N:R1iw7gryNkSV1hy1Z1u2JLu9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791217792, "uuid": "b81d5e1c-ec33-41d2-8daf-7f4d75cab836", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791217792, "uuid": "eee9e1d9-c0e0-4016-a7d7-9da7e51949f1", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791217792, "uuid": "1a1d9aee-4406-4a3f-818e-32fc687e56ff", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa80533-c0d3-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791215049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791215049, "uuid": "140cc801-d8ae-4562-b778-61a7357224be", "comment": "Malware payload (Mirai)", "value": "7461944966378d69b73e90948d9a690d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791215049, "uuid": "5ebab9cc-fb2b-407e-be16-2586dbdf9a8d", "comment": "Malware payload (Mirai)", "value": "837706d2629291091b85acbb0dc17ac550552b96b9335eac0817307fcd228f01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791215049, "uuid": "011b2be0-3afc-49de-bcb9-0a7a826e626c", "comment": "Malware payload (Mirai)", "value": "67b8db618870db9430479593359cf55e2362c090", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791215049, "uuid": "b84de07c-b487-41f6-8daa-e23972a1e6cd", "comment": "Malware payload (Mirai)", "value": "53a6d23203bf80787bf5a86c26b57220f4c833bb6d0dd7a1c1009232d11aa9a90f1c6fc7b867d431cd130f68f393c6ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791215049, "uuid": "53648a70-fc01-409a-a7b1-203bb7184952", "value": "T1780473AEFE11BB7EE668873187F26FB2C39521B22291D341E1EED6185E6114C085F7D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791215049, "uuid": "adbb42a4-c439-48da-b67e-20b38d6c2c86", "value": "3072:a9EVKQczzNNA23zNcbbzs789ufvUxF/kD6pSceS8a8tC5:MEVcNKw/ngeD6pSceS8a8tC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791215049, "uuid": "d8e8a0fa-7a84-4ce2-be49-ef8437817961", "value": 190090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791215049, "uuid": "fa550328-eea7-4ba3-a1f7-e190191a5dfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791215049, "uuid": "234c2763-062a-4afb-8c84-b5bba8b0acbe", "value": "gnome", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "861e1977-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218880, "uuid": "4f5f39d4-3a3b-4478-9bf4-73aa1e8e0fe8", "comment": "Malware payload (Mirai)", "value": "c2180e1f6c3479168b81de7c805f3d51", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218880, "uuid": "57fe7efc-45e5-49b1-bb9e-dafb69ec5f9c", "comment": "Malware payload (Mirai)", "value": "83cd69a71a4343eeceeb43a80f327739d0c3612c6e37bc4f580a700e5569aa17", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218880, "uuid": "0e2544ec-c207-4f8c-936f-da02fbfebfd7", "comment": "Malware payload (Mirai)", "value": "18d520555c83070aa202c62d972bdd4bef9e0e16", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218880, "uuid": "0eb7946d-6277-4eda-ae3b-7bfed766fa18", "comment": "Malware payload (Mirai)", "value": "81676d2d705dd02d256222ad7c8f067157f0e4d3f7695c72225a4e630c9e5b94ce451d4959d43ba22d6ad2143458d82d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218880, "uuid": "adafd0ba-a33a-475f-aa9a-17f49e685ecc", "value": "T1C6A31298AF98A351C434E23056F58BC684E860A1F811DEA059D1D557FFBE2F0780BEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218880, "uuid": "64b40917-6f3b-47c1-8e71-c6b44b2ae207", "value": "3072:AzE/p7IPNmkLzZ/gcNaXeflfhUhOudJVQi:L+Nmu6e1hZK/Qi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218880, "uuid": "34d362be-7f2d-4c2e-81e3-1c6db3433836", "value": 101852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218880, "uuid": "714ebd3b-31f7-4d65-b35e-b7da62e8b123", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218880, "uuid": "00e37c77-0d58-434b-8e01-04246f05fb32", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eec0c7d-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791216210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216210, "uuid": "13cc96dc-8175-482a-adf7-a039e6d7f8d0", "comment": "Malware payload (Formbook)", "value": "32bfffaddb35b3e2e176ac7e7d722ee0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216210, "uuid": "f073b4c2-07bc-481b-8b8f-ffd9084d3554", "comment": "Malware payload (Formbook)", "value": "83ec0f2732ffc388763f69c1f5a4e190dee8df484cdcbba6b798faf4bab0bf16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216210, "uuid": "8dfdd141-a028-4624-8789-5c6d8ecc8820", "comment": "Malware payload (Formbook)", "value": "69134a4c60b59da72974f8bd227896f026cedf5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216210, "uuid": "38d321f7-53ab-4658-96d4-407e7ba6223f", "comment": "Malware payload (Formbook)", "value": "0154a7386156e69cb2a79b595ad52cbcf8405aa20398875eba2ee9ad8c80e07004438c72ae8e6a19e6a56a4b2dd3e3f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216210, "uuid": "ac8bd335-0b99-464f-8759-7f447ec813bc", "value": "T11B35F11832A48E02E13E477D85B2E27063F06D579516E7099FD8FCEB3D21BE16D4A683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216210, "uuid": "c94d4efa-e648-4a23-8224-1354f15fab84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216210, "uuid": "8d9ec540-0177-4171-97e1-f4b12259b1ff", "value": "24576:c5daHn+tZ5ekbAJr9uTkzv+45hFaGGdNd02:G3tZxbA1TLb2/NN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216210, "uuid": "4b7f44e1-ce79-4fc7-a3c6-7eee5b613fe9", "value": 1061376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216210, "uuid": "a9a825b7-f256-4d07-abbc-b1d79101dc9d", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216210, "uuid": "bf963f86-7d79-43c1-8570-1c91356d49f1", "value": "83ec0f2732ffc388763f69c1f5a4e190dee8df484cdcbba6b798faf4bab0bf16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd3bc362-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181660, "uuid": "44aacbb9-ba45-4ba3-911e-d4d3f582a245", "comment": "Malware payload (Mirai)", "value": "1a6a06643d31cf1cea40e7768b26fdfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181660, "uuid": "63b1cd9f-41cd-474b-9462-5c79472d5345", "comment": "Malware payload (Mirai)", "value": "846d86e4b76921e69afd0c7f5a62fcb3fae43614317e2315f7923aaa14d56a04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181660, "uuid": "8bba28ad-17d7-441a-b683-c153cc10ea42", "comment": "Malware payload (Mirai)", "value": "2a871c7604195d87bb546e8b0bd7645019ac695b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181660, "uuid": "4688aec8-813b-4e79-99e6-7046d182b3f7", "comment": "Malware payload (Mirai)", "value": "e958d77f5da18adb5091038b3c9ef57a58c214db7cb5f5518e4e9cb44ce9bfa6d14098a7d1f463779bfd13b1fec2fb7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181660, "uuid": "42322b49-0e6e-4029-a705-df8b1b473ddd", "value": "T1D26302ADA6A653AAF94787B4423713088934C7AB00F1D6921C48F343E7D3BB67DB45E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181660, "uuid": "feb88da1-fb3b-4884-a08f-915b875fe682", "value": "1536:GcTuNI0fFy5AQ7VMr0aD1W+ZvGRbnUarg8ahp8InDEZiOKU1RZQVEWTe7F:GbdfFyKyMlW+ZCb88a7l0zQVEUeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181660, "uuid": "32186466-418b-4ab5-8ba7-a5f2f2d6c085", "value": 69468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181660, "uuid": "bddd2e13-2a31-4358-8d98-4d201f54abf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181660, "uuid": "a2638710-6805-4aff-8e33-b16a920cc2a4", "value": "wife.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041d4045-c0a0-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791192892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192892, "uuid": "93b1aada-9ddf-4498-8126-844412cd234a", "comment": "Malware payload (AgentTesla)", "value": "7807bd01fed00bdb76d72a3790195291", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192892, "uuid": "471003df-8698-46d9-b55f-4c88768b2882", "comment": "Malware payload (AgentTesla)", "value": "84de969fa7d734128d5293c458e736694b0eb42313b5d165d0ee44ca9cf888a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192892, "uuid": "a537597f-4af4-4434-aa54-8ec42016c628", "comment": "Malware payload (AgentTesla)", "value": "adbca33ca1501b9cec26fb7a645e295e8934efe9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192892, "uuid": "33174ab1-0be3-42e2-b09b-0ca6af3249c0", "comment": "Malware payload (AgentTesla)", "value": "36c7bf5a4cdea3575b29491708723ca82cad8726aaf07888f5dc5d5936018d050d1caf05301e7922218b4d66b1b0f1b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192892, "uuid": "9d72f355-3b17-4ada-8749-33c338c2a55a", "value": "T19F35235CB49E69FD0812F6EDA226F58AB544278F0F008326737DE2A53274450DEA9CF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192892, "uuid": "47c9e940-87fe-45e8-93ef-2c1afcb9a070", "value": "24576:R7XI/qa2uN6jiDuryLuxuFVgkJr5C3YBB3ez:A6AcrL0l5Hez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791192892, "uuid": "ebe1830f-2bd5-46eb-8b9f-41a23c443658", "value": 1069415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791192892, "uuid": "0760d317-be36-4145-95f1-0554b7e4d090", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192892, "uuid": "a8e1b7e9-45a0-4b73-b60d-5fccea60ca87", "value": "stein.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40aa30d-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185859, "uuid": "8932e3c8-1cf8-4a39-ada3-462bc846bcd1", "comment": "Malware payload", "value": "e623ce6e2aeb7bcef1ccb49ffdb6d61b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185859, "uuid": "c170523a-7b1f-401c-93f9-fede2bf3c359", "comment": "Malware payload", "value": "854d6416a5dade6bf48f2530dd229e84d45f42b75a7bd8e28a73baa8f6a51d26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185859, "uuid": "3a491397-c108-48a8-a200-80d3c42c22a6", "comment": "Malware payload", "value": "763937d6220deb5b9627291cf9fa82ce732dc125", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185859, "uuid": "15a27028-6eb9-4a78-9c0f-51dd83a647a1", "comment": "Malware payload", "value": "d7d27e0861f196d7cd191eaa5e85ab7fb3f296e3cd2c43b6f18ffd03ff41e8490a1b97b4b0d264689fb4a22ae0021e85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185859, "uuid": "78b3ee70-68fd-49af-b4a7-09da7018c7a3", "value": "T129D22891F4C0EE22D6D1557AF35D168933130F78D3E933058D24BE2027BAAAA4F3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185859, "uuid": "39e34eca-6210-417f-ae0c-b7307dbb9ca9", "value": "768:hYgYOS3d6yT8dULfeRijpSEed98o0OO2fdTErJ:hYPpt6STljj898o0OO2fdIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185859, "uuid": "7dec1a0d-3723-4958-9bd7-028fe783d603", "value": 29860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185859, "uuid": "da19711c-62ad-42af-b0db-5690330bc1a7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185859, "uuid": "1bbfb6d9-2db3-43a0-9b70-e87ecc192a07", "value": "dldr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd18d25-c0bc-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791205093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205093, "uuid": "33468135-1cc0-48f3-bf66-cec71ef944d8", "comment": "Malware payload", "value": "0caa08f73598361bb1aa0d8746e15617", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205093, "uuid": "61d841c9-baac-4aef-ac00-c95d5bc7f144", "comment": "Malware payload", "value": "8594cfcc4044a06bce1fdf4a72ba86bfb4de4db4faf83d662539421746f1bf4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205093, "uuid": "eaf4a512-4312-4d6d-b125-3984fa915be3", "comment": "Malware payload", "value": "b54a9b3e60054e97367016dc882eab69006c093d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205093, "uuid": "a35b4184-8940-4d73-b9d8-09c010397034", "comment": "Malware payload", "value": "eaa75f48310c4284d85f1d3ffb917b84ea1c3b5ac7c5293674aecd7e9d4b834381c83a25c1d66bb12784f565fc02c1f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205093, "uuid": "b7158bc0-9f03-458c-b1be-a6184d7c9f0a", "value": "T1D1858E7A7144107DDDBBD7BDCEA19F0BE3B7B4078361A8CF06A116960C998E44637B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205093, "uuid": "2b9f24ef-d66b-4768-a072-6598f91391e1", "value": "f33eaaca9b434ea5c0e690f4238ebc10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205093, "uuid": "5bffaf83-a2f2-4260-b39f-0638a679f466", "value": "24576:WT1LSBOKSTAFUQGTMeExgLdJDAxk/o4WiECr5dM78RpVQlkV/SFEfy:WT1LSBOTTAFUrnzLdB5dM7k8k0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791205093, "uuid": "8eb4879f-4035-418d-81d8-7f3765bcde0f", "value": 1872896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791205093, "uuid": "438ba4bf-7a07-4f27-8db2-e6b2128fdd32", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205093, "uuid": "2ed02b14-ee69-4409-bf5c-c2a1526e7a9d", "value": "0caa08f73598361bb1aa0d8746e15617.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d38075a4-c0b7-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791203118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791203118, "uuid": "0efb2495-75f2-4e38-bb93-e028f3907d4f", "comment": "Malware payload", "value": "5e89b3e3bdc00757577aac0258f1a57b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791203118, "uuid": "1f63be1b-421a-43a4-8c6c-abe63a8e3ba9", "comment": "Malware payload", "value": "85a87fc0baf61c21a1ee1cdf490ae324c85cc83e51c1d9ec44bc41eec98e6d9d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791203118, "uuid": "2447c669-c190-4083-ab19-65fed6172f84", "comment": "Malware payload", "value": "8fe5457a5c296d71f2a395c34684b9cf73b44a27", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791203118, "uuid": "447d8e8d-213b-45f8-b6a5-eb19638009f1", "comment": "Malware payload", "value": "5d9f284d4447b25f32961c3455f5cc1c6e29f46f5ab99484dd3538779e34f18f5296c6e6f326fb6381e8fe74ff3f265f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791203118, "uuid": "c0de48da-7e35-4144-855c-3d58fdbc929c", "value": "T17DB62335C1CD45A1EFFBF73AA4CE0D229A64C8156CDCE6169E78D4930C8E5D2078DA2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791203118, "uuid": "b4736951-25f7-4d55-ab59-861cffaf7078", "value": "196608:YeGkCCBuyF3XIdXxVzIkaNYSCTG3V+4V5qfLwRr+PKUWqawbiNZVI8oKrdm8hL:YI5IlzIkaN5CTU+O5qzJWtwbordmqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791203118, "uuid": "0572c340-ab40-4055-a3c3-9170cd718051", "value": 10607396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791203118, "uuid": "310da987-63c4-432b-addc-e74277996267", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791203118, "uuid": "86961387-04f2-44c6-b403-e0c07c67e3a0", "value": "85a87fc0baf61c21.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "febd6110-c112-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791242275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242275, "uuid": "2aeb48ea-3ed3-4868-a96c-c40810ee0fbd", "comment": "Malware payload", "value": "c223366cf2f6b899fd65416146a7b9f6", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242275, "uuid": "5b947a91-2f86-4df7-b38a-dc9944a9e9b4", "comment": "Malware payload", "value": "85ee6a49c511123c6a108cf6e6b3ba1c00b38d28af3d053a5146ca78fb8df3be", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242275, "uuid": "d1f67951-5109-4ab6-b3e5-e2af5681b799", "comment": "Malware payload", "value": "41443efdf4f70d8a169e53026b71c02651c5a800", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242275, "uuid": "5e23962d-b497-4b50-937d-423388aecaaa", "comment": "Malware payload", "value": "419b473f37b72b3b9aa2499acdab4a1c6db7b99be56e42ca612b70f721fb2b6063eccd2c584cd960c2f07905cd8c5893", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242275, "uuid": "4c9896d9-55a8-4093-889b-c7b6c0158a62", "value": "T185B012E922761E80F02C5E0570D71C50FB87827595545765F8C44C3BCD48601F103F15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242275, "uuid": "51510c20-1027-4bd7-8685-a651f3f684cf", "value": "3:TKH4vGBwkSDETLtWiL71u9GN3+GuVjLWgKoKWnQDFz:hBD6xXL7mGEjuXVDFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791242275, "uuid": "b9a37827-e09e-4532-a90b-41aba5b9a2eb", "value": 114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791242275, "uuid": "944e3899-c464-467e-8541-5ab13ff683b3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242275, "uuid": "ba0f0d06-78c3-450b-925d-e9d856b62e9f", "value": "mbupload-forkchfb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d93d4ee-c0af-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791199457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791199457, "uuid": "598ea2b2-9450-4f68-a9ed-e6aabb774043", "comment": "Malware payload", "value": "a7be44ebdb35844bfbdd5f31a947d9f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791199457, "uuid": "a047c25a-f51e-4253-8d3e-a0722ec2b4d1", "comment": "Malware payload", "value": "85fe17ed8d861794f45fef185763215358bb89b5b62d035228018c0e93f2a338", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791199457, "uuid": "ed7bd3c9-15d8-4440-a25f-ea4d622661ed", "comment": "Malware payload", "value": "a1fb10f006d657c66f064a85d27c8004733360c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791199457, "uuid": "cd8869da-c348-4fd9-b0f6-c44540ca7397", "comment": "Malware payload", "value": "3e5d83fd23a5f96bc275bc97f55beac9841de26811325d27278f38cebaf3830ac884e7e2e3728ab708e8aa4b6dffe711", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791199457, "uuid": "d2fbe939-3f85-4fbc-be45-1519051755e8", "value": "T1B3535B61BC81D542C89C17799BAF83D93303B7B4D2EE7502EC02A73915DE68A0F2FA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791199457, "uuid": "b0f58a5e-6986-4e93-b9f1-e7eebf5bbe4d", "value": "1536:XmdA23WYicbLQtG+QIndnszm59MLtlzHys:XmqGiOLQtGTI2zm5mjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791199457, "uuid": "dc9d279d-b193-4a79-9eef-79c13709c735", "value": 60816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791199457, "uuid": "8b3b3fbb-18f7-4330-af7a-24bee875e59a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791199457, "uuid": "2661d7e1-276c-421c-8e14-f83f4359f2ee", "value": "85fe17ed8d861794.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a92f36-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185920, "uuid": "a759fe5a-0bc4-4940-b433-7a06e1a321b6", "comment": "Malware payload", "value": "71e97295c64e04cbbcfc02d5efb908e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185920, "uuid": "f98c1bc1-a0e1-4c58-8837-6e1c6ec45370", "comment": "Malware payload", "value": "863ad6ef0793c9c717e9ede4917424dcbd0940bb591ddf58ab9d75df63f5a58b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185920, "uuid": "cc012ddb-e22a-4efe-888a-b5846b72da19", "comment": "Malware payload", "value": "94125426b06ef9a0f20e47e8373fff32fbc2ecd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185920, "uuid": "16a4c029-5dca-4e1f-b7b9-b59a523702c3", "comment": "Malware payload", "value": "9690573a2b6d3c7c4fcfbd74fd24b6270ea6736fb8be096da86bd9cbb87c25b38cb6b14f891cdc26bf24fc094ded0d95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185920, "uuid": "2880182d-77a5-428f-bc39-1cf283005920", "value": "T1D5D5E757BD924942C4E83A37ACBE81C833665EB99B8A53175D05FA3C3EBE1D90D39304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185920, "uuid": "3d881343-f882-4787-8cfe-930876ae4c37", "value": "24576:ed21fYiYzZAlTR9IuH7Rx9aZYF+N3zXBZsQtaovWKEhh/IGg3m7d7HGAujj9fPlq:CgJmaRdE51QAOeY56NTx1JR4iM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185920, "uuid": "8067fd0f-5347-4b25-a665-02b1458fb116", "value": 2883710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185920, "uuid": "f9a0b4cb-5fb8-4ff2-ad43-00e1291198c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185920, "uuid": "60ab98ce-69d7-4860-91f4-50d7de6ff11d", "value": "go_bot.arm.bak", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425a7751-c087-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791182259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182259, "uuid": "52f99a6f-ce1e-4798-ad78-ee64f6adaff3", "comment": "Malware payload (Mirai)", "value": "75ea555c10dd08d9a9ca0c6067c814cf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182259, "uuid": "45191c5c-d876-4c38-8d71-c7594ca3515f", "comment": "Malware payload (Mirai)", "value": "86793b28139f8153bdb348076099571e3e77b55ff77ceb78e151618adcb9489c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182259, "uuid": "369441a2-00bb-4ae4-bc03-a802068e79ef", "comment": "Malware payload (Mirai)", "value": "3166252310c700dc703a2d1126a022a780c97eda", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182259, "uuid": "47111cec-64f8-4767-ab90-b0a587db5e74", "comment": "Malware payload (Mirai)", "value": "aa0246e0f83c6eda9a59ddee1f87b1a2c69d2b1aad172d84bafb269b206900398061f95a69efec896e7e0343caeda4ac", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182259, "uuid": "3b3a474f-61f5-4c6e-bb9c-5781e5826444", "value": "T1AE21B6CF53B057A15B3BCE5B65D18B87C004C139B9A32D389458BA25A0E2B1CE4F076F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182259, "uuid": "bb6b81f0-a6af-418e-a17b-5f9b57e1f8fe", "value": "12:dndNtrNu1t6Nu2toGuztIuVGttX/u9tSuatvui0tmDuAptlud:dtrNG6NvoGeIZB/CS7v9eiZli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791182259, "uuid": "b440997d-9b14-4367-8007-d58a4b856536", "value": 1384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791182259, "uuid": "f7ed53a5-8bd8-4e22-a1d8-fbe2a0d745dd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182259, "uuid": "40b3f67c-7801-44f8-a0e0-8cd0f39bda2d", "value": "m.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636637fc-c08b-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791184032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791184032, "uuid": "54384cc4-b6ab-4aa5-bb03-fc9a05852e1b", "comment": "Malware payload (Gafgyt)", "value": "3e5ff1683684099a964fa97085979eb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791184032, "uuid": "2573a730-ade3-48f9-bbea-be2e5fba9f11", "comment": "Malware payload (Gafgyt)", "value": "879df0bee8a6d444d61639500b7df5fb4302713083edc284e4ee53cf5ad95e40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791184032, "uuid": "aa7b5912-d711-40a1-8265-14007b715599", "comment": "Malware payload (Gafgyt)", "value": "4d2cf63e54db2d5e3476245cd10c37180f2847c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791184032, "uuid": "39284e56-eab0-4b4d-9e5b-6d22ddfa8c78", "comment": "Malware payload (Gafgyt)", "value": "4ec1ef33df703ef1d5c3ea8c929dacf330e6c0b5356ce357d9375caa780e96e5c9b917f9f709a0ef6e445236f382ecf6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791184032, "uuid": "d2fb7a54-1133-42e5-ab5e-b814a47cbb8c", "value": "T189341904FD148B6BC6D237BBFB9E42CE37335B5897D733019A246A742BC6B9D1929101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791184032, "uuid": "f3ee9f40-ea82-405e-9945-efb37676952d", "value": "6144:6yC/2q/zq/tblJMQM9r6L4y82zawfV2IWKAXv9dZHlWZgs67ojz3VpO:6U5XL4yjTsI8v9dZHlWms67ojz3VpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791184032, "uuid": "e8d051c6-16c5-489c-bbca-a8742d47c80f", "value": 252273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791184032, "uuid": "32306492-4193-4c95-9be3-c96418628e1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791184032, "uuid": "2d0febbf-488b-4c2c-9754-6ccd09898e46", "value": "dissarm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae645ac-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185897, "uuid": "e5dbb1f2-6218-48f7-8ff4-70f5d7b64a7b", "comment": "Malware payload", "value": "7cae2c3b2d1858441988c14dff24fe52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185897, "uuid": "86c280dd-0446-453f-ac90-8c57e283bea6", "comment": "Malware payload", "value": "881c3c814e108e331c66da218c8430148235766591b604383675b6aa7ba78889", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185897, "uuid": "6aeb6358-8a39-4a4e-8eb6-3a99297daff7", "comment": "Malware payload", "value": "e863d1334d778bd96dafe4b61160c252b82df5f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185897, "uuid": "b57c4900-a906-4629-aa9d-e538f719d8b5", "comment": "Malware payload", "value": "f5112da0fb638dabc89fef9d0502d7fb3c3028c778c2e09ba296747e3bdd15b9ff25220d4ae2019e464f661a3139ac36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185897, "uuid": "88235dbb-8e64-4248-aa79-ead7afbf2cee", "value": "T1393533423D9D840AD54C7EB1A22538E35A11CE678AB04CBD8762B334E33D6416B65FFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185897, "uuid": "823bd14a-d34d-4817-8924-16138cf17627", "value": "24576:lE1ytQNhSa/fDmuRIGbgk4lTCTWqD76zTyTGB11VcJQLoq:ln6ua/SeIKgk4RCTWU7ATyu1HfLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185897, "uuid": "89d24a98-a35b-4d0e-af14-c5f41620584f", "value": 1141296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185897, "uuid": "64eff9f3-e63c-47d2-b280-e8a73e081e89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185897, "uuid": "9d940258-7f8d-4008-8f0d-ce6545dee9ac", "value": "bot.ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e0dc11-c085-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791181679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181679, "uuid": "cdc4ed45-d29d-43a0-b6e9-c2dde1363931", "comment": "Malware payload", "value": "fd1aac562e2709072a4fef5ad13c72b0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181679, "uuid": "03516222-1288-4b86-bfba-be7b48665f1a", "comment": "Malware payload", "value": "88520fc501d166eba13a67657c090e803b868007679c01b9bcd98900a5b75b09", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181679, "uuid": "93ae5c96-c0e0-488c-821b-cb9f9c66f18e", "comment": "Malware payload", "value": "37133627a994a37fc4ae81062e1f2daea67444bc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181679, "uuid": "40df7e1f-5c3a-4c7a-a9b6-c47c2e509dba", "comment": "Malware payload", "value": "4f8057933392ab2071f21b264de54544c028e67822e35c2c66da054737222607763e853df29e072b919820a5256c596a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181679, "uuid": "c4203666-2bbe-4311-aa8e-a01885eb4a81", "value": "T16821ACD721D30974ACE5D963316A4C1871E1A08708CA7F85FEEC38F9488DE447059B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181679, "uuid": "0cf6e46a-f9f7-4485-a4dc-fe0b25c583b8", "value": "24:vOn5gyEOn2rOnPMvPWHsOnKrOnrUOnTwOnq/On/WJOnKjOn4TOn5Mm:vOfEO2rO8+MOKrOrUOEOkO/UO4OoO5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181679, "uuid": "1053a294-cfde-4660-ab31-822e0efc0cbd", "value": 1389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181679, "uuid": "744bbf3a-cf84-4272-9c1a-f12c72d47446", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181679, "uuid": "d82d57f1-7add-46fe-a878-d45ca7609b94", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd990a3-c07d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791177956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177956, "uuid": "ccc90958-e712-496c-aec0-bb00ddc0f82e", "comment": "Malware payload", "value": "f9ff4e78e0b8a4e0adb95500619db7eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177956, "uuid": "c4f2d45a-38a5-4511-a33b-933c0d9c3360", "comment": "Malware payload", "value": "885bf8bae75d79f0911beb71b29caa16e8fdfdb0ab7115164ce1dc3c1951b6c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177956, "uuid": "93183213-c420-40d1-97ee-b8cccef64474", "comment": "Malware payload", "value": "b8818ac515d057c0f0bbb3cfd1d36ea2d0149b78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177956, "uuid": "399540e6-6230-4380-96b0-9891a1b5d4b9", "comment": "Malware payload", "value": "605bf2f195a29a0f7b04cd2d0847359d34086ea8d9a783b22e1371d734d293ce4b8e387b690c612b3a79e34d116980e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791177956, "uuid": "d871cbbf-ea3c-4222-8fd7-15fc9aa7eb76", "value": "T108E2A64F6E328FDDF669C7344AF34A30A759238326E1C686D36CD1501E6024E989FBE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791177956, "uuid": "01007eb9-8d90-4906-a70a-098b6dad9d0d", "value": "768:TFPuV73QkxfPgmj2/S6QvsKkkeDrHyf3sqD:TVuVN8SDviU3sQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791177956, "uuid": "004b6b36-d4f2-4e86-a8c9-3e64d91dcfe9", "value": 31724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791177956, "uuid": "c182b9e8-a10b-4e83-9f88-6af67f848aeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791177956, "uuid": "a7dd77fd-870b-430b-ab15-494a2bfb6621", "value": "885bf8bae75d79f0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2921ed1e-c053-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791159883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159883, "uuid": "54e3ef43-2293-4df3-b7d9-feaaae2bd287", "comment": "Malware payload", "value": "34dd6cf4260b3b9c19d9eefba340efdb", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Foxveil", "colour": "#C2943C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159883, "uuid": "e4c81729-23a0-46e3-8309-53f3341d9c7f", "comment": "Malware payload", "value": "889582f9f03be880d3d9d2708561ad0241f8698df8537edbd0a5dc4fa8b42627", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Foxveil", "colour": "#C2943C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159883, "uuid": "0f2d476c-e240-4900-a9ac-08b545d66a5d", "comment": "Malware payload", "value": "8c2a39c2300181d35547b68c3e9be6ed4c7ca433", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Foxveil", "colour": "#C2943C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159883, "uuid": "6815573a-7135-4c67-b813-f2bb03b275de", "comment": "Malware payload", "value": "1016b67572b64778dd45248f793e6c37fdf28cd1879437adbad2c6a8b9c1effdd870f79fc6f194d672f356ac4f8db738", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Foxveil", "colour": "#C2943C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791159883, "uuid": "bf6c938c-c6c5-4c6d-8106-decce76f3dbd", "value": "T1432502018F614096FBDCC7301E768F378E766660898513DF6A862F989D31393F26726E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791159883, "uuid": "4870ad3d-b819-4b1c-8303-bc01bd467026", "value": "24576:A8EBYSLszpU2dMIjdw4htdf8Nz5g2NMoFNGA/h:Ae22dMEzui2NM2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791159883, "uuid": "73935b5b-34fe-449e-851c-5c7a4eb76a30", "value": 1052592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791159883, "uuid": "141f81ab-5a44-43cc-8e15-bca391eed039", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791159883, "uuid": "dc17d4cb-8a09-4911-90f4-5e03db6d30c6", "value": "macho_889582f9f03b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c18053f-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181738, "uuid": "ad7c26e1-f1d4-4607-9b93-73f4bd6ad27a", "comment": "Malware payload (Mirai)", "value": "1f20df73b9eca208eb55eca030e3d859", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181738, "uuid": "ac52d321-35f7-4147-8d88-c6c9793ea312", "comment": "Malware payload (Mirai)", "value": "896e73b0ed8929a89bfa17771068715f37af2c1f8d4fc6f5999027117c41639a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181738, "uuid": "9341acf2-37e7-4139-9dd4-693092a8b4d1", "comment": "Malware payload (Mirai)", "value": "d5da50dfcfcf9f6fe2ca10e125efcc0431cb6ab3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181738, "uuid": "8dcf59e6-ea25-461d-aa1c-a40d3b35432b", "comment": "Malware payload (Mirai)", "value": "d171ff29f0651174b415d4399f02fa5519592a794501fe7627ccf2ed730b89320e42156f53f32022e1b286039f3e35a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181738, "uuid": "46585ed2-af09-4529-b0a2-94526c67dbf7", "value": "T12D34651A6E22DF7FF668863047B78A30579877D63AD1C585F19CD70C1E2028E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181738, "uuid": "14ce4e46-32a4-4ca8-ab42-64807f6b7a50", "value": "3072:aDrH/7x7q7li54o26l/+4mWgHYKNpgylr7VXsr:aVe7cF2HYKYQr7Nsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181738, "uuid": "e23fb14b-fede-44cb-9d7f-0c02939442c6", "value": 249444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181738, "uuid": "d58c6651-5d9f-4398-9962-bdf9ca71abc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181738, "uuid": "3223cdd9-bebc-4b6b-bebe-ee9c38427cd8", "value": "wife.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c965cff-c094-11f1-927a-4201ac107004", "comment": "Malware payload (AokigaharaStealer)", "timestamp": 1791187913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791187913, "uuid": "32ccb151-f80f-4a69-95c7-ca7dffab5fdb", "comment": "Malware payload (AokigaharaStealer)", "value": "1bd88b143a4e82734ddd1748865dd0c5", "object_relation": "md5", "Tag": [ { "name": "AokigaharaStealer", "colour": "#928EC7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791187913, "uuid": "95ac81ad-5d25-413f-a4e1-0a41eb41610d", "comment": "Malware payload (AokigaharaStealer)", "value": "8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce", "object_relation": "sha256", "Tag": [ { "name": "AokigaharaStealer", "colour": "#928EC7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791187913, "uuid": "da7fd6f3-599b-4ae1-89b0-73cecdbc7731", "comment": "Malware payload (AokigaharaStealer)", "value": "74fcc1fb92e24319ac785375d905ee9b725c57e4", "object_relation": "sha1", "Tag": [ { "name": "AokigaharaStealer", "colour": "#928EC7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791187913, "uuid": "e276a99a-e960-4b26-ae7a-034469ede8a3", "comment": "Malware payload (AokigaharaStealer)", "value": "4a8a383129fb4b9e5ccb013231302e348717928b9a13b1f2d441452f3e54ad4885223b9461a567f9cccecd1368ca0d68", "object_relation": "sha3-384", "Tag": [ { "name": "AokigaharaStealer", "colour": "#928EC7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791187913, "uuid": "696818ed-d9cc-4a84-82a0-894e9d6e65f4", "value": "T1EA969003774C00D8C897EF7484A15A3961B03CDD96357A5B8EA97EA42F1A3957BEEF00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791187913, "uuid": "e9658f87-e15f-4cbb-ba1e-57efd29df6c4", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791187913, "uuid": "cd841307-2a27-4b46-b20f-e3c531ce332e", "value": "49152:GJM5QOz+ScZph1pow5y3ogMGsySbM/DztvTdoER22NnBvUHu0YL04ZgPoIPdhVU:1ZkOtlIPPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791187913, "uuid": "87f13bc1-17e2-47ea-a651-734962f68986", "value": 8629688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791187913, "uuid": "eaea64d5-752d-4fe8-ab19-121239eeb142", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791187913, "uuid": "2b89e704-03fb-4b18-95fb-cbb3b7998bdd", "value": "1bd88b143a4e82734ddd1748865dd0c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f460705-c0de-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791219781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219781, "uuid": "ce053b61-907d-4303-8d09-e56ea23392a2", "comment": "Malware payload (Mirai)", "value": "9abb95ceec4cb80e60fab992fc9592b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219781, "uuid": "7b49533d-b1ba-439f-aa8c-85c8de6aa27b", "comment": "Malware payload (Mirai)", "value": "89a9cb193fc4b0edbbbb602e2e5d54204c7c2a56626a7e690377e4a659ae6e02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219781, "uuid": "37cacd12-f074-487b-b135-3f4c8c111ecc", "comment": "Malware payload (Mirai)", "value": "1060333ec8429c49227a9540c32ae211237ee43b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791219781, "uuid": "568ed592-3301-45fb-baa1-04ecb508b850", "comment": "Malware payload (Mirai)", "value": "034f591794f9c7b2c412e9f5ea7c4db3fd4156fdad688cf5c229a518b890a2bd77904888ab9555d4fd04222ac569c05b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219781, "uuid": "b0e115ae-1a71-4677-8bdb-6a65442d0433", "value": "T178C48E2399766F95C4B7D1B4B4B08B780F02A89642EB6EEDD6A2DDD14547CC0F22C3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219781, "uuid": "eb31e32c-36cd-44bf-b474-e6a832c32470", "value": "6144:DI4YlyV6WTfQqKKNYRsSCg3xBGpXTmHqeQ2AVmzqqyIzoylTZuAhL/tnwkjVPxZ:cJwZTfQvoEGFneQ9m5OsTZuAhtZjVJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791219781, "uuid": "38f46818-ecf6-47b4-92af-c5f2a9b015dd", "value": 589512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791219781, "uuid": "baed68c9-c5fd-473a-83c1-90b5c0a61883", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791219781, "uuid": "44901a16-f2e0-4670-b900-43bb5992a61c", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae00093-c09b-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791190917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190917, "uuid": "6ea64192-0d46-44e3-84b3-65d5ff6e8838", "comment": "Malware payload (RemcosRAT)", "value": "03981a712bd45c50c469459cd278edbc", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190917, "uuid": "69ec9a6e-c0ca-45da-9f96-8866991c626a", "comment": "Malware payload (RemcosRAT)", "value": "8a7699a0dd746c82e51fe115429104fb4109bf806e0c2fe6b6e80e654ee4d510", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190917, "uuid": "3fe04ec2-5956-4284-9ebf-c2c2e4df12f9", "comment": "Malware payload (RemcosRAT)", "value": "202a0b04aaf7a6894f43be004f34466d7b763da3", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190917, "uuid": "592172dd-2350-4cc5-99a2-ffa7b8bdeed1", "comment": "Malware payload (RemcosRAT)", "value": "d36aa966ac0f86f997707139ed249cdf3b097f90ae6d27f8f9b2931204372432c82e2e1ce64af57a137dc1db15175495", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190917, "uuid": "645b335e-d77c-4a99-aa87-5a3cf3c5f2b8", "value": "T17E635C24EE2502158F8717E6FC990BA685FDC225522640B0FEEE234D51066ECF7BF26D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190917, "uuid": "efa267b7-8109-4139-bef9-50f7e477666e", "value": "1536:JGLeIP1Ctwnct/bFQCKqqIYqNx88nfef2d/uAioz:I2wct/bFQt1qk2ef2d/uAioz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190917, "uuid": "7655e1c4-1528-4526-9b24-c947f1eae60d", "value": 66738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190917, "uuid": "0d4eaf62-5b9f-4d11-bd61-fefc55218ade", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190917, "uuid": "e97c5648-4fed-4e1e-9a8e-81ce34610e88", "value": "PRE-QUALIFICATION QUESTIONAIRE FORM.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e09c2fd4-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (PhantomStealer)", "timestamp": 1791190685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190685, "uuid": "f9ceb863-993f-4d27-969a-401ce6af89ce", "comment": "Malware payload (PhantomStealer)", "value": "10b641881d7fa003932b64762d2676ed", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190685, "uuid": "01b9409b-f5ff-496b-80e9-b11227f62461", "comment": "Malware payload (PhantomStealer)", "value": "8a7763fb8494ab3cc18d70db2802a0281ebe77ebbf7ea04f7ef2da01332b8bc0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190685, "uuid": "f5f82264-6c92-4173-8d60-0b8177142070", "comment": "Malware payload (PhantomStealer)", "value": "3e682b1aa13f551af3bbcf15f1c4e8d8bf1ae379", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190685, "uuid": "9fb887a3-3fbe-4984-9462-1ef5d7c39418", "comment": "Malware payload (PhantomStealer)", "value": "878f92dda5e4a3af64d86e1ddc76b6fab9063345cb9e5711d87df172c1cb1fa83d234158db37beecd281fb14147eae48", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190685, "uuid": "74bd59bc-c45f-4b55-9a7b-042060659459", "value": "T198A628A71354A632772AAB8CC236DC60A58E704365C5CF3831ADF208775CD4BB39D6E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190685, "uuid": "b2a2dc36-4c59-4c18-b3bd-b043b07fb68c", "value": "196608:DOzLe9tZJ8jqbWS20QoIQlUV7eKihq8/Er3HtdvayN0RcyUR5zXNvkJmllvSF/Bo:ZbWXXoIaUV4qPtdyy/yi5r2JmXvSHcRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190685, "uuid": "d23a80c1-62ca-41bd-acd6-e4f2728e14a4", "value": 9507522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190685, "uuid": "9c8eb973-1387-4eae-affc-7deb5cc9a51f", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190685, "uuid": "8dbe2020-73d9-431a-a8b4-51aebd88f4be", "value": "263077-MM_SPAREPARTS.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa09d7a7-c04f-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791158515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791158515, "uuid": "e40c2014-7645-4501-b2e2-e20c7a4554ea", "comment": "Malware payload (Mirai)", "value": "ee15a6a57a220207d77fdb4b2c00d8f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791158515, "uuid": "54549bee-edc0-48f9-9c3b-f95893b72fb7", "comment": "Malware payload (Mirai)", "value": "8a77b02b82e8759b6c502d656995603b249284eb9651d41f2c9517acaa65f6da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791158515, "uuid": "1478a984-1415-44b0-b06d-a248607c47e2", "comment": "Malware payload (Mirai)", "value": "bc141c9b0ed05c11b44615df8adb8478bf6383cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791158515, "uuid": "35c1e382-6eab-4565-afb4-de527d011ea5", "comment": "Malware payload (Mirai)", "value": "c222eeb4323933be1eeda0ecd65a7ac4be4e4d0a86765ed48ee2d4ac28a5911aa1d553abac3c37c87e9ef1040d083915", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791158515, "uuid": "304676ca-8f93-4311-aeac-96db8870eb21", "value": "T15203094AF9818B12C5E115BAFA2E524D3313077CE3EF7226AE106A34679757B0B3A815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791158515, "uuid": "0747dc27-71f9-432d-b7b3-9f3bfe619712", "value": "768:ttnvcGn539x6CfbXjPnfnrhpgD5mkcIYGWi0HGBFDKAM:ttnfn53mCXnfnr4g3ImiuGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791158515, "uuid": "19cea745-4fe7-428d-91e7-0dc8b5dc2bab", "value": 38088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791158515, "uuid": "575955ad-f04f-486d-b605-b9ffcd068ed0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791158515, "uuid": "0776af79-27d5-4780-964f-8efe8012b81e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d739ce8a-c0bb-11f1-927a-4201ac107004", "comment": "Malware payload (SheetRAT)", "timestamp": 1791204842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791204842, "uuid": "abb58f5b-7da4-470c-88fd-cf3ac9812059", "comment": "Malware payload (SheetRAT)", "value": "8a9ff886cb5880ed2e2345cb3948c73f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791204842, "uuid": "468ca178-8bbd-46b2-a8a3-d5fe55d1f8e9", "comment": "Malware payload (SheetRAT)", "value": "8ad1e81b511ad76a0dca74d39d82b8d7932d584d2047fb602b1ae4dd2eb6bada", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791204842, "uuid": "e3767f75-ef14-4850-b162-82da87563f0a", "comment": "Malware payload (SheetRAT)", "value": "cf902893a232de1c4e07b3d207e2fba81bf4aedf", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791204842, "uuid": "9f280365-f6b1-44da-a9bc-9abdca5a73ff", "comment": "Malware payload (SheetRAT)", "value": "33bf5cb8728a75d9c7fc24a6ec7b88e6fccac107947f3fadd789f4fececb2dd6d25b50886ef4cb3b89f5dd7ec2109d61", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791204842, "uuid": "a6e293b2-0151-489e-ae9d-055c663e10e0", "value": "T19356140E7E4C1656CF2165FF702E8F09767204CB0A61AC50BD67796AADEA7C0B10C9E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791204842, "uuid": "962193e1-d665-4da2-a717-50c3318fbefb", "value": "49152:VbQ8XLQygKiRO5FzresM8c/9uWBVPH1FBfB+ZevBcF7rIvBKBR3Z:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791204842, "uuid": "dec7c1bd-0d01-419c-9314-70f109069b58", "value": 6414204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791204842, "uuid": "a4000151-d288-4e98-b01c-a9e1d28618ac", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791204842, "uuid": "551caeb7-74c0-4b60-a9e5-6d575c6f5085", "value": "limclean.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08c2a9f-c0e8-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791224185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224185, "uuid": "967a1668-1039-4ab7-bf0e-2b74f3b34f85", "comment": "Malware payload (Mirai)", "value": "f0ef46f4de08a074daef5c48e6daf529", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224185, "uuid": "d2d0b0f8-dd3a-443d-a712-7966951e0480", "comment": "Malware payload (Mirai)", "value": "8b4b8b6dda3e8b653e9cff6f992d09e60d526b265f09236c6f7a7a70237857d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224185, "uuid": "20ff9e15-5344-4a8c-b904-f42a4eb42252", "comment": "Malware payload (Mirai)", "value": "9d4237b6e6e7dadf68e254ccbf3f804eadee3ecf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224185, "uuid": "f23eac68-cfa4-4a8f-82a2-fec31cee1620", "comment": "Malware payload (Mirai)", "value": "89fcc6f138f7e3285a0045559bca04844710ab3511640f666418b0eed399e8112be87c4430a578048a6cfaa16fdf0a97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224185, "uuid": "8d4d6a55-e525-4610-ad71-db3bb7e221b7", "value": "T1D3046C82FBC3E1F2DD0246B5705BAB334A73D97A4027DAC1EBA4AC37AC51451861B27D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224185, "uuid": "a6d293b4-4c3b-4f4d-8ec8-5df98603d42f", "value": "3072:adH/FOkv2VkJDaHJLJ/DDqnRpvpIkCXeetZs+:aN/FOkv2VktaHJdeHRIveetZs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791224185, "uuid": "76b5fa6f-e033-49f8-8788-cfd6c8aee2c8", "value": 183560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791224185, "uuid": "747763d3-6aa0-49a1-91b2-b7dbc82aac4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224185, "uuid": "7fc562c4-7203-4ad3-be3c-0a66f7330df3", "value": "xnxnxnxnxnxnxnxni586xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed61ecce-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181687, "uuid": "a7d3a2e6-8f14-4efa-9bbc-5f0cf3ad5c2a", "comment": "Malware payload (Mirai)", "value": "8d4bf39b37926921c993a4f66e53c50e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181687, "uuid": "99393bb6-ffc3-4432-a200-4c48746d91aa", "comment": "Malware payload (Mirai)", "value": "8baef9bd09ba1754a911b99ca446853a2fe0248da2a394ccd60b67dc831c2ac8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181687, "uuid": "0c0693ce-758b-4c13-ab48-510a7a501973", "comment": "Malware payload (Mirai)", "value": "3be54233b7a6df21130176e44a7baa87b77069a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181687, "uuid": "40c34a77-9e54-4698-9403-1a123c306a89", "comment": "Malware payload (Mirai)", "value": "8b9a6d2f9d67f8c935838f1dd503dae936adb65805cc1edcec061ebedfda583effd0ea049b687fdabef5293aee8beb20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181687, "uuid": "c06e69f9-e091-402c-b070-6ead26d07db1", "value": "T162C3080AEB610EFBDC6FDD3706A90B0529CC651722B83B793574D828F64A64B49E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181687, "uuid": "15e1832f-6485-40bb-916d-08174b1df4a7", "value": "1536:VYHBoLIaHOte3gPdFoBFHGCdz2BwqS97ZmFZCzCvZP2fcTIJpA4ooQ22CnfSh:ShWyeGe8F7v8Fnx2Cq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181687, "uuid": "d7294592-d4fc-4f8b-a610-491c3ca2a474", "value": 118424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181687, "uuid": "05d1b6de-c750-42b1-9675-d01e64d05f06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181687, "uuid": "7b16602e-cdbf-4483-bb29-d610172b49a0", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e0b714-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791190536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190536, "uuid": "d5d8a7a9-1b54-4d0e-8b5e-842c3503edb1", "comment": "Malware payload (AgentTesla)", "value": "6ed408af8591de74f1841e1f7c23dec9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190536, "uuid": "373b7274-36eb-4535-833d-97ba57a3c7fb", "comment": "Malware payload (AgentTesla)", "value": "8c800030a784b8ff60dd483cfb6c79b712a2706fa7b8753227dbe3d60674c423", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190536, "uuid": "61499b29-40be-4c32-82d7-5c167092b25e", "comment": "Malware payload (AgentTesla)", "value": "9bb43770e832dce7761211bacefd9e881c98ff92", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190536, "uuid": "c80bb6c6-7fb0-4ec5-acb4-9d8b63400bdb", "comment": "Malware payload (AgentTesla)", "value": "56c7b734a81fbb1e8650aede55a85c8117ca23193c869c7f35b2fe0fa407fcc4cc92af2415719ab115de75bdacdd86f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190536, "uuid": "2df967bf-e1a3-4cb9-8202-66d263e2446e", "value": "T10CE5AE3DC14FD14E62682529C8786A831AD9B407B5F0AEB9B6E879DE6707F4C72DF004", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190536, "uuid": "3786f610-8166-4e68-8607-a7a272580632", "value": "98304:VRMM/qbxnxyusiTLZrdK7t1101NWC/1TjFeNZEbpmcQK0v9r:HqNeiTLb2t/eNWO0Eb0mA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190536, "uuid": "348f2f15-abe8-48df-889a-cc734d439b34", "value": 3266902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190536, "uuid": "67293df5-f50a-473d-9aa5-825aae0255d0", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190536, "uuid": "061e0ba2-7f83-45a3-9f21-7cfe52770fc7", "value": "PGD QUOTATION SS27.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c770d07-c09b-11f1-927a-4201ac107004", "comment": "Malware payload (GuLoader)", "timestamp": 1791190919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190919, "uuid": "0e7fd041-e044-4b78-a2a8-7b8a21c397d4", "comment": "Malware payload (GuLoader)", "value": "f28392a49325f717f7ed5e20708652b8", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190919, "uuid": "77124c97-3f8d-4c13-8052-3d2999ebc526", "comment": "Malware payload (GuLoader)", "value": "8ea937ef5064740187d5bd0a2bc03da097ab01fa1fcfaefed4c1204e62bc1be0", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190919, "uuid": "90fcb1c7-db80-45b0-a3fa-4692710b8413", "comment": "Malware payload (GuLoader)", "value": "3af6959b543e103fb677d6065b2f439503dcd0a5", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190919, "uuid": "b4d32ef1-75fe-4289-a88b-42e24c40ea2f", "comment": "Malware payload (GuLoader)", "value": "fb7b15f227d6ed046074fe69e0e5a393ea81dff0c085cf9bdcbc8b82cdab22a08f7367aaf056e0fad17b4c7b23974093", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190919, "uuid": "e0955dd6-c521-400b-b3f9-a7e83308226f", "value": "T1FFE2421EF50ABFFC09193526B51BAC1AAA1003B5B83C654D3D8FC25C3B7AB148FC15A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190919, "uuid": "37b0f9ab-c57b-4089-9f36-82e56801dea2", "value": "768:KeY7foryWX+m5wPtDqUAwq97h9ncBWGvnc9Ug1osltocyd:QDmpX35wq97hCf/1JGOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190919, "uuid": "93331809-f474-41fb-a0de-3921f91ef8c8", "value": 34025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190919, "uuid": "ed41d3fa-0459-4296-992c-93fa35fe9e25", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190919, "uuid": "d5ef2802-e635-4cdc-8fc3-c2cd269d9203", "value": "Booking-Batch-B-0013.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90bda4ed-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1791190551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190551, "uuid": "8d166420-e232-4cac-bfdc-2508dff1fda4", "comment": "Malware payload (VIPKeylogger)", "value": "a266d7f5d9257ba4bd8424146b3ee473", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190551, "uuid": "31bacaf1-d235-4e1e-9393-d504e293ae43", "comment": "Malware payload (VIPKeylogger)", "value": "8f963e4f2130940ad1bbf39f21ac0317269ff1cfa42a71af042120e91f49facb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190551, "uuid": "4e834848-3205-4311-9808-88b817b477e5", "comment": "Malware payload (VIPKeylogger)", "value": "a7b8e68ea275a06493196db67bdf4fa95f1d8db4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190551, "uuid": "abf67e5f-1135-4b7f-bd85-605baedc542d", "comment": "Malware payload (VIPKeylogger)", "value": "2e3f34fd1692d9e42d1db7cbc1fb597651012c652bef423fd42285c83cef4dff3a4975bba8a92651035b31c53b76a5fc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190551, "uuid": "444cc6fb-db7c-4969-9a9a-5f1842596232", "value": "T13523EA444D81748423336B7ABA2AA4E5F7BB0A6B0194490BB87C7494EFF1D18DEE4DF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190551, "uuid": "62279f0f-6092-46d5-862b-97f797021291", "value": "768:OoT6s0rdUEVDLCi3yRB7eeO4bl3A69euqtZveJPT+E38TcxDp9wThIuq1od1R/e8:OpUEVDLrW73T7+Wy50C6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190551, "uuid": "28dfac6f-8005-4f1e-b429-484f90fb9b45", "value": 49421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190551, "uuid": "2facb664-0d09-45cf-b381-08338b9c51f5", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190551, "uuid": "f994dff6-0e79-49db-9be0-1b057400dc48", "value": "\u0111\u01a1n \u0111\u1eb7t h\u00e0ng s\u1ea3n ph\u1ea9m m\u1edbi.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd225a9d-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791216395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216395, "uuid": "21245341-df01-4936-9a63-9c006647c89a", "comment": "Malware payload", "value": "028909f99429611f63d33787ab9ac67a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216395, "uuid": "e54e00f0-0fe6-4222-9dde-bcedaed21f65", "comment": "Malware payload", "value": "8fecbb14ecee81a8e5f6e51ac9e9a24cab1c4589b309f4cb910e4b74862d1c58", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216395, "uuid": "632ae05c-2e60-4908-bf09-5baed6757d82", "comment": "Malware payload", "value": "629255ab7d8e39e7be538ca97ca3ae9d8ab6669a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216395, "uuid": "00768aec-37cf-422c-8196-9cca51ea65e1", "comment": "Malware payload", "value": "a99bdd322b01f1f7f476d8d68c00693fef47713fe8b83aa27d44dbd5307b48d8b61d2e6d9da3f80931d07a61800ef68c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216395, "uuid": "823ea92b-1c12-4901-8994-aa17df3c7260", "value": "T19EB49E6062E35F71E3985AF7D4AD808013BAC27C9AFBFF29540F03BC9D027559627962", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216395, "uuid": "b06509d5-50bb-47fc-8e01-da402d6d8f9a", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216395, "uuid": "cfa8ba59-753a-46a0-8234-5106d02f451d", "value": "12288:TfHmw5oITdddddNa4nz96D7HduppjEFYvd/IaX0HTmZ:TX5oItnhG7juvq40mZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216395, "uuid": "ba8c95b4-d86f-49bb-8a15-c9531ac67254", "value": 535553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216395, "uuid": "942f6596-a7db-49cf-9f0a-5f9292ef51e1", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216395, "uuid": "d4f52f23-f76f-445a-9b1c-b8cef6ec8a36", "value": "Noogen.Validation_5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b23f8a-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791216218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216218, "uuid": "74e811e7-8d47-4869-b10c-163ebdea3efe", "comment": "Malware payload", "value": "5c709de924251fa79a82178381081641", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216218, "uuid": "72cfd448-3cf0-4c19-8826-1825f279f28f", "comment": "Malware payload", "value": "903ff60ba40c13a37028c1d05d937780754d608c6bf05ccee297b16966235969", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216218, "uuid": "dedb3382-0c04-4a40-87d8-e48e3565c04a", "comment": "Malware payload", "value": "6c5bcc9327b3f145b7e811eca0521b78dfd0900d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216218, "uuid": "6a539f2d-6dc1-4030-b8b6-e592277a3d47", "comment": "Malware payload", "value": "c2c082af662075e864caf29aaf4dd0e602d847c3afaf1c4e5a221b807b37cb3a893eec90e98e52a4e432c2df8a9d3120", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216218, "uuid": "c5eea4b4-2551-4b67-9e6f-7f23a1212bfe", "value": "T19405D0009E648613DA307FB4CD76E2742776BDC9A911D30A5FD96EFB3891B005E816E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216218, "uuid": "2ecc9ddf-9078-4ae6-b758-edffed130775", "value": "f1b522887e3bfa3772880a26b998ae0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216218, "uuid": "f3bd43ef-a3d7-44e1-96e9-7341c895f510", "value": "12288:8qhm0KQRJ88pMhEl1/eROkqCx28tVw99KBQPMIrIR+NS/dwoI6vyYehY07ueX6gR:8d2xM2lJaOkB28ti99KGXY/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216218, "uuid": "02224274-a6b9-4d7c-86e3-bc594af948a7", "value": 874009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216218, "uuid": "6c460276-112a-4c4d-aa9b-89dd9fc0ce78", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216218, "uuid": "9f88f555-f7f1-4a93-b177-e115469143a1", "value": "903ff60ba40c13a37028c1d05d937780754d608c6bf05ccee297b16966235969.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def0937f-c0c5-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791209150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791209150, "uuid": "f3e78c6e-8090-4172-89e0-d432dbe17978", "comment": "Malware payload", "value": "c0896d640119ef12862456bed35d7b57", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791209150, "uuid": "73c3c242-d35a-4d19-9418-b56f8b686cd8", "comment": "Malware payload", "value": "9113eb3a5f370e10d54bbbf3cabf0a90ae064b3945dc95971648d39d77ff060c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791209150, "uuid": "0abbbaa2-6e29-4242-aa8d-5e0c69cdbf3e", "comment": "Malware payload", "value": "427ace4613d507af8c8561f77879473f5bf7fe89", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791209150, "uuid": "7a666dec-cf7e-4835-925a-ed3163de3b9a", "comment": "Malware payload", "value": "29e15381234bc9b6353001f71d3f823b367d4a97d74b75a8de276f175bd09085c51b5a733edc97bf5e84ae38674a74ec", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791209150, "uuid": "624f88df-41d6-45a1-9364-403f8a57725c", "value": "T1D838332C73484DB0D14B4DF4FA3F84E4D29A915B2E6DFA1B9D1017904ED23B06DA2B7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791209150, "uuid": "6927bab0-ae3a-4938-a703-fae685729cf9", "value": "3145728:bq6qCBQsRoOAeFFhEB6hNiKOXWT+XmHekO5e14l+PCP+1qLM:bq6qb+Fa/2Ezkz++a+1CM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791209150, "uuid": "2b6b7326-411c-4162-a436-975981954d31", "value": 106047503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791209150, "uuid": "538d0b6e-ab4e-4798-a0a7-f27d08786805", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791209150, "uuid": "8d2743de-7d69-49c4-beaa-3852b119e75b", "value": "btmob4.6-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681f8b4e-c0bc-11f1-927a-4201ac107004", "comment": "Malware payload (Vidar)", "timestamp": 1791205085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205085, "uuid": "557b7c71-c5e6-4289-a50d-e781e29ebd22", "comment": "Malware payload (Vidar)", "value": "2c589d110547bb61181f3090ed5102c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205085, "uuid": "53ebf170-e5c5-45df-8fca-2c5485734725", "comment": "Malware payload (Vidar)", "value": "914fee0bd216643b6da22caba20cc208075924b38754e70b433fe5a5e03afb1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205085, "uuid": "eececfb2-0e07-48f4-a943-155e4b37a85b", "comment": "Malware payload (Vidar)", "value": "fe43ff2a815a15555fcec3a460fba66254c16294", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205085, "uuid": "cc1f14f3-2b87-4655-b929-1a2365fcbe7a", "comment": "Malware payload (Vidar)", "value": "1236326c506cbba5fad211b01eed8a9ac6c37f0b6cb4d50aa42a8dd92cbf2940adb5a4189b4064666453383e9b15bfe5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205085, "uuid": "d39a5740-44e5-4168-80f3-5bc3b28b043c", "value": "T127D6E957328810ECC98BD37544F45D6E16B23DEE5532BB4E0F95BEA02F02B966F64E08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205085, "uuid": "4f3763b0-d4db-4665-965f-20924ce8f233", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205085, "uuid": "af66c2c7-2d8c-48c4-b6f7-62657de8dff7", "value": "49152:AjIRyCxXKRNIxzphEnfitgSoEDL7t9UhGGklh5Q0qG:xjHth17IkdoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791205085, "uuid": "7e399844-b5b4-4e61-a508-c5edeb0df236", "value": 13062592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791205085, "uuid": "c332cb11-7e1e-48bf-8e65-75fb49129e37", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205085, "uuid": "a5683b40-4a50-4b95-9bc0-79b49f614de8", "value": "2c589d110547bb61181f3090ed5102c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "660e65ee-c0e9-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791224409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224409, "uuid": "e6a787a8-e8b6-4e1c-abb5-a973607bf4c8", "comment": "Malware payload", "value": "80a146faae1afa0214a25f0081cce85f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224409, "uuid": "5664c4ac-231b-4550-bc3d-db102eab80c8", "comment": "Malware payload", "value": "915f1ab51f9286f3910bee90be93ce6001cdeb5cc42addba071535db0929ebcf", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224409, "uuid": "18bd753d-2027-4407-b912-cd3c18e85ec0", "comment": "Malware payload", "value": "88dbee21b025db309c558ee2f62eaadff1f802d0", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224409, "uuid": "8d21752d-382d-41e5-948a-9b4b762dac4e", "comment": "Malware payload", "value": "d1e52649e1776bcd18622f08d0df10903a75eb597755179feb8266258087500c782e1f7e0e5308f4d156b8fb9866e486", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224409, "uuid": "3e20b6ea-edbe-413e-8473-84b823c03b6b", "value": "T19B32185CAED1A1B0EB1707DEA3AF24690228A087200DC484F94CEDE87F46BDD4A57B57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224409, "uuid": "a9b12143-44f6-4f9c-8232-7bfbb2198376", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzNbqFtCgScPRUM:sXX+/DV7k/3IFtfPRUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791224409, "uuid": "37e5c949-2eab-46ac-b87f-ca4134e4ef1d", "value": 11967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791224409, "uuid": "9763c5d3-5c18-47f4-a18f-6695d04fa6ab", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224409, "uuid": "3a914402-8e2a-4c1f-8c3e-c0d7bf2f2811", "value": "bloodengineer.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8893e9d7-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218884, "uuid": "9b9e8b7a-9d27-481f-9866-f7934dc42360", "comment": "Malware payload (Mirai)", "value": "b69cfec1bd7e2b473556d57246456184", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218884, "uuid": "1be6a72f-b915-445b-9193-2ed6dfe510bc", "comment": "Malware payload (Mirai)", "value": "92129c63acfb139afcd10d43d29287e1da7fae14ac490b77a876ceb4bb483da0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218884, "uuid": "d5977002-aedb-4b9f-be1d-5fb02412d8b9", "comment": "Malware payload (Mirai)", "value": "9818fcb45abd50613a5a985d251a25152bff6889", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218884, "uuid": "71e9c18c-cc9f-4b8e-a883-6b1a59b200e0", "comment": "Malware payload (Mirai)", "value": "b79e4de156a5d070ba218eea0c312c48e4770b539046d38e3dd015d0414ae7264aca734bf71f3aef208ee1acb22d47d7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218884, "uuid": "03440d1d-61dc-4175-91a3-f6b6f44262c0", "value": "T18A6312519AEC96119D8FA231649F3904A9F0F60D234E0BBB5BC802A7CBD5B5C720D76B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218884, "uuid": "2103aba7-2c94-4aed-bff4-806ebc98b50a", "value": "1536:MlhENkkYt6oNwHJqD+yfupGWaSSNl1DBsBLjhGXQnLG2V20nouy8GyaK:MYNkoHaT2pGsSL1DBsBj0AnLYEoutj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218884, "uuid": "42ec6eb8-2564-471c-9124-447dca0a4434", "value": 73032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218884, "uuid": "9029dc05-9623-4bf0-995d-2110255a38cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218884, "uuid": "eb4dc2cd-8b5c-482d-b6aa-2ba1fe811e1e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19f9792-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185908, "uuid": "0c683b8a-5b3c-4fea-a739-f4821d366421", "comment": "Malware payload", "value": "9bcfdf1d439a2882fc48b61157541fe0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185908, "uuid": "d41aea7b-1b1c-4ed4-aed2-a0b33404a780", "comment": "Malware payload", "value": "93739a23c3016eecd1efe832f3e6a5fd74d859010985e251115b03480094c9f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185908, "uuid": "e309dc00-f800-480f-a24a-a179a2db31db", "comment": "Malware payload", "value": "97b5a2f9bbd4571b3ed5814f4afa02ec2a63ec01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185908, "uuid": "168d8858-e3f8-4b47-bf96-38cc89c05cc0", "comment": "Malware payload", "value": "188083a4b43b101b02eca416421a374827ef4001c0de4a06aab468a8d0e026623107a9691ef4cc14eded6fb596c03dcb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185908, "uuid": "cb89860b-d7ce-4849-8907-8601f2d0ffaf", "value": "T103B5E826BEC21F63C88D173489ED62DA63607E454B91072317A8F6783A7373C9F57988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185908, "uuid": "4295b90b-e790-4ca1-a9cb-719c8ee7dce4", "value": "12288:BlqyuSwFevQWa/CElyHRi60HsvrNcQ5ozcHa0UZ6ltnXVn9tUidHjxor0qnHvgwb:BS9yxi6asJcQ5RvdEH5Y6fHTRT1QSWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185908, "uuid": "8e0b7fa4-8751-4b69-9409-9a396e88ca2a", "value": 2424956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185908, "uuid": "18bd7948-2d8a-4de3-876d-5ea2cd7c4ad4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185908, "uuid": "6abd1a00-67c9-44d0-9a49-ada591e496c2", "value": "mb.mips64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "532ffd63-c0ab-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791197749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791197749, "uuid": "00f40245-954b-45d3-b0e5-324d50dd8250", "comment": "Malware payload", "value": "2627c8d761df40cc959314d121f0e693", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791197749, "uuid": "7ddf5cea-0199-4ccf-92b8-764db1324c92", "comment": "Malware payload", "value": "940b14df9c75f0ff8db85d24c9ff3f53b4545faca59f8a56d5dfd0ad4be0ae34", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791197749, "uuid": "46c2188b-6e63-41db-adc3-caa5194a391b", "comment": "Malware payload", "value": "edae065b5f0b7c1adeebf5519fe03c25ca06207b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791197749, "uuid": "4a188e44-5b14-4a2a-97b7-6010d45fe790", "comment": "Malware payload", "value": "0778fa478023482f0712ae8e561ec3b7717405d502d7337d3227035cc1f78f28aed8da672a0a60bcf126bab3e954439a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791197749, "uuid": "27e82fbd-5e2f-48fe-af91-e778736044e3", "value": "T1B581B4A3B9921932714CC035764F6596B38B052F55245DA8B08FA4343F3D8D8E1FDB71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791197749, "uuid": "f9ab013c-b54b-4564-9aba-07fecb7ab9b3", "value": "96:kGm5TqIJZmEkK3+aXCJ7+rwBMEqjiGut+fs79PDEK2Xek:+reK3DXwzIiGut+fsZEK2Xek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791197749, "uuid": "2473bf9b-cb93-4e3a-8944-f827b7520f92", "value": 4041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791197749, "uuid": "17229682-703c-40ac-b475-613968c521ff", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791197749, "uuid": "fbe2abd9-6d3e-47fb-8069-b7b8baa4b9d3", "value": "agent_i.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d339135-c0c3-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791208127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208127, "uuid": "5aa81546-0b92-4124-bf63-7af70006e2a3", "comment": "Malware payload (Mirai)", "value": "703023c6eea78e0636c1577cf77479e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208127, "uuid": "c8dbbf9f-469a-497b-82b5-fe3a0242df0b", "comment": "Malware payload (Mirai)", "value": "945afece38f108d7c1c5c71e785fbf452f7de803ca1f207e6eae1f9dd3d5ae80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208127, "uuid": "46c80a94-cc98-46fe-ba73-f8793f38665d", "comment": "Malware payload (Mirai)", "value": "d09c059eb787c74b2a716d85d843483be3bc458d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208127, "uuid": "476df4a8-4ae7-4da2-bdee-bfdb5bcd9df5", "comment": "Malware payload (Mirai)", "value": "e5f56f7e9c85c5ac63e7c910a25aff2525a55278df38a40cc42e9b374892677d519f4af0d2c3c9dfdc6710de38edfc25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208127, "uuid": "a60b3e4a-09e3-4fc1-8134-cfb432ce5bed", "value": "T17BF307CCD864576FC2D223BAF64946DF33321BB89386F32159B7EAB427C1B581938191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208127, "uuid": "067542ac-0d23-40ec-bf9c-601e772be8df", "value": "3072:6IdYRNkCI0gu0gj2kqn1hP5LfL1tBqPE3EHsNH9QQrUQu0PMLgocAiENAleCLeeH:nzlP+dsa8YsIdKxmeWm+tisQTzXQ72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791208127, "uuid": "a66e4ac1-3c60-4e0d-bc2c-5fdc8b515e6c", "value": 170075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791208127, "uuid": "64da3fcb-d4b3-4ff7-8590-1b7b68001272", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208127, "uuid": "0f48625a-dfb5-4952-868f-c7e813b9bbdb", "value": "945afece38f108d7c1c5c71e785fbf452f7de803ca1f207e6eae1f9dd3d5ae80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43be172d-c0e4-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791222204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791222204, "uuid": "0574b693-8dad-4070-bad7-4d3dc640bc70", "comment": "Malware payload (Mirai)", "value": "1043c639da938fd67959e35090f9b7a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791222204, "uuid": "9791f5e7-dd20-4ad6-ad20-9a5626b34747", "comment": "Malware payload (Mirai)", "value": "948ee909aa96a830d6f620ab26e43896b54f8507900e75a3bd485bcecd669e38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791222204, "uuid": "fee7190c-0962-43cd-92b9-438aee42b601", "comment": "Malware payload (Mirai)", "value": "a5ca316369777ce5d93cda17a751fb0c0c2beb89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791222204, "uuid": "f13d1160-784c-4320-ace2-c4eb66db5666", "comment": "Malware payload (Mirai)", "value": "9777ee92831044b5f6294f698cb8227ae8b0bbfbb901b2c09ea831d990b88d0b4c54dd0b915dda556cf28a9900e29b4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791222204, "uuid": "83299d1c-2aa0-49d7-9808-93ffffe7a42e", "value": "T1CCB327CDE780C577E54315B2E69747230531EA36160ADA41F3DBFCB4AB25184B221BEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791222204, "uuid": "6c86057f-61e2-4bc5-8200-4773fde8f04c", "value": "3072:NepiqGToJpFcXiRfI3wVjqnYF5oDDyo5XE8hGEn:sGToAiXIn85oDDyo5XE8hGEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791222204, "uuid": "d65947a2-7b89-4fdd-b89d-3b8cca12e5ec", "value": 116751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791222204, "uuid": "19cc0a46-22db-4aef-8624-e9050e8e7f12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791222204, "uuid": "ef38f171-852d-4b0c-8f54-ad8f71abd619", "value": "bash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab678f3-c109-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791238054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791238054, "uuid": "ad551826-1e86-4617-95ce-aab5f87d2fcb", "comment": "Malware payload", "value": "0ee59ae82757f58215d22a5c81e32573", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791238054, "uuid": "542b8c27-a76d-4a96-86c5-0240aed91f35", "comment": "Malware payload", "value": "9515a9525a7533ba496952c8060bc7cc2794cecec2674b32adb2c7c0aa3d1a1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791238054, "uuid": "1d29457e-874a-4c2c-9ac1-00b174794ecb", "comment": "Malware payload", "value": "cae057a88f2b6ca84cbf80385bf03735e722f012", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791238054, "uuid": "4c49d077-31ba-4f11-934e-f07173e32c26", "comment": "Malware payload", "value": "f4636718f88a08f136a04ceee3a3af815f4246c43359dd7511946d431d61581c1540ca1d2da7d4b462882bac5954bb85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791238054, "uuid": "c17ed0dc-5fb2-4f54-b22d-68c0955bcd15", "value": "T11196E957728810E8C94FC27584F45E7F27F23DAE5633A78A0755BA902F17BE56B20E08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791238054, "uuid": "08a5c764-b7ee-414e-bd7d-8d10518ee12e", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791238054, "uuid": "e490c0a7-158f-4792-bcc5-5cff2d893ad2", "value": "24576:/PQFTKG7SvXUQR5rhYxaZd2HHvQCKYHM+hCgeDa+BibQDu64wclbOrnxV0OV8HT1:/Pc77S8QpCwrxVtV88sqINl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791238054, "uuid": "f4fa0c23-1fc4-448e-8ad1-9367453bc884", "value": 9049528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791238054, "uuid": "dfc5d454-ce3d-4cb1-80da-17710a0cb587", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791238054, "uuid": "171160ef-9400-457b-bfcd-408ed3768d3a", "value": "S\u0435t_U\u0440 [U\u0420D].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc52d8c-c0db-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791218248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218248, "uuid": "8d7972d0-01f6-453f-bbb8-9b78d9b559c8", "comment": "Malware payload", "value": "651295fc91fb08ed2cb1e573c282c34a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218248, "uuid": "d051592e-e783-40ad-b828-8f2e76bb1b82", "comment": "Malware payload", "value": "95a26fb357a295cf410c5acf03e044fd51996de32489a53daf066f5f8cf2cd37", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218248, "uuid": "4ee446bc-7844-4217-9d17-7b72f862438f", "comment": "Malware payload", "value": "59b21a2c54871ff2cd2869857b230281aef8d7d8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218248, "uuid": "77cfe15d-c9ad-4796-ac1e-9f2eb1776fd9", "comment": "Malware payload", "value": "289bd08a226da09cab2af1c6e78d1769a7ad2fa1f34d7e85c7595a1d527ca3594b2b21b4b75b90e714cea09ea3f75293", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218248, "uuid": "16ad8a70-8273-4a97-a071-be30b71c5930", "value": "T19D844B27EE90DB2EC407A2312C76CA7046C66E726AA11F662358D71C3B303695F977F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218248, "uuid": "9c02a088-17d8-40d6-823a-f4604083d565", "value": "6144:Xghj4JmAqxmdhQYMumxRW/6sg3D3TeB+4TYd4:kj9AuIOlii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218248, "uuid": "426dbd33-b9c7-4ad4-97ea-89207a4623a8", "value": 397724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218248, "uuid": "fac2472e-4449-454c-94c1-fb397193ccee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218248, "uuid": "8707a363-95d9-4077-898f-ec70cbe0610c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a10aca-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218932, "uuid": "bf293138-902d-42d8-b607-6f0aa0be9197", "comment": "Malware payload (Mirai)", "value": "906df92ce30c3dc9171a3fe951a91e74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218932, "uuid": "0e38219e-b225-4931-bd94-42d16531eed7", "comment": "Malware payload (Mirai)", "value": "9617c42bc6e44fbbe6e5cdb073f41d0be6801912fb14778f998716b16e2a910c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218932, "uuid": "320f53c4-1afd-461c-a52f-a3f8040e427d", "comment": "Malware payload (Mirai)", "value": "ce0ea7df8cb777aaa20594795688f894cc3fd5dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218932, "uuid": "8ea7fe74-8acd-4c42-a90c-da1e213ea8f1", "comment": "Malware payload (Mirai)", "value": "daf99b2128c96cc9076d42fca635c9df2623fb03017682b1711020e3c099524af8e314c7093724f0fdc26b436a485c88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218932, "uuid": "757a75a2-2a71-413c-8781-d4737d493d04", "value": "T11EC34A85AE516A1BC5C5737ABAFE928C331723F8C3DB3122DE154F6532C902A0E76E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218932, "uuid": "820dc5e2-e4e8-4873-abf3-ac3a8a0b2662", "value": "3072:at/dJmQIyau0iCA/FJGT1TckvMNknokAYYemglXp:W/dJT/0yuNr5YemglXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218932, "uuid": "b764b110-1f6f-47f3-9371-9343a0086ce5", "value": 128404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218932, "uuid": "05ce652b-394c-4bf3-ac21-77e9d778d869", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218932, "uuid": "1b53d563-0419-40d4-9051-445b80bf71c2", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8885625-c0b7-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791203126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791203126, "uuid": "25466da5-05da-4302-930d-3a57e6a81c92", "comment": "Malware payload", "value": "91c143dfafa69a0b9cf1b88fa0700475", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791203126, "uuid": "7706b892-5f6c-490b-a43f-06bcbcca6ede", "comment": "Malware payload", "value": "9653da786450d66cdaad848403d3457c8ce59c8b1b1a07729e0c3238352233bb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791203126, "uuid": "803b0d82-33d3-4e0c-90e4-da83ece93a1a", "comment": "Malware payload", "value": "6f287e09e68070547e2280f32502b72c5d37ed34", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791203126, "uuid": "cd079593-7f9a-4399-a327-5a2864721be3", "comment": "Malware payload", "value": "6bfb74e79df99f183d34ed92fcffbe8039387edbba931b974971b0d5b0e7580a52fbe24a2146d50e66088eb9ae6e7fbf", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791203126, "uuid": "3c647d5f-5e30-47b6-8694-0327bd128764", "value": "T19594127BC43E8451E50AF738E96AC621CB9C519FD3B0891985C306F4DDEA8DD9A07BC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791203126, "uuid": "d8b3e49c-d736-4e08-a530-c70b8771aa39", "value": "6144:GI+tGDvM4cQJcLbcS8mRe1xcTam1LQBq1FNHSeakrDi2OIj6k3pS:GJsDvBOcR2QKfvNH7a8W3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791203126, "uuid": "80edae61-fa0b-4f29-86f4-d5cacebad886", "value": 412804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791203126, "uuid": "7b0fbb2e-308a-4f65-a7b0-4c28d0a988eb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791203126, "uuid": "1500f046-dc1a-48e7-8f31-a13de7f475bd", "value": "9653da786450d66c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd09253-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185952, "uuid": "d6527675-d749-4ea0-9a3f-067a0916170f", "comment": "Malware payload", "value": "ec15c1692cdba0c54a619fa215a0f249", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185952, "uuid": "15d92ee6-7386-4beb-a9c2-52af36b8b038", "comment": "Malware payload", "value": "965f3049fd0df23acc24987dd4f89fa85f896ea7b7da3d3f1f0dcd9e435f2a72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185952, "uuid": "07e4907b-a110-4b42-b0eb-5c80269306ff", "comment": "Malware payload", "value": "3a74dab60beaa20fcc7aea04a98de7d7e735632b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185952, "uuid": "b273b024-083c-431e-ae4b-cd894b0742b0", "comment": "Malware payload", "value": "4422dd28c28fff4a0010a17f529fa6c939cbf1f85286e653411cf6e15e1fb0e75b465de1b569bdf663d05c1cb5a0f210", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185952, "uuid": "ef7d6dd7-14ee-4220-bd52-cdf0608c0193", "value": "T19AB518137B28DB0FD61422314DF1C7D86B265C8A06D6E817A686F318B8B30AC5D6EDF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185952, "uuid": "fa49cf42-da2c-4cd6-822e-2d9de743cfab", "value": "24576:dfOkD6Flg84MDL0XUv1nAVzTlYiDn2aqNGZhLBTmEghQ2WIf4LhkboU05Ntfpj:df4fIXUw8Cvtfpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185952, "uuid": "61975df5-f897-4999-a501-67a52c345589", "value": 2359451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185952, "uuid": "f9f71be2-e90c-4ad3-8f97-e90a73859450", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185952, "uuid": "38a622ee-3425-4cc9-b5ce-1ec83a112cb6", "value": "mb.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a335d3-c0be-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791205829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205829, "uuid": "4f99df99-1326-4190-a93d-5cd8978ee95c", "comment": "Malware payload", "value": "cfb101564d9b8552b18e40a3001e7482", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205829, "uuid": "93f0413b-4441-4bac-ba92-4301a3ef6092", "comment": "Malware payload", "value": "9684e148168e71743784d6735b0bd38026fc9c11b199757db98185882e41c876", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205829, "uuid": "5f38feba-735c-4567-8111-282d9aade15a", "comment": "Malware payload", "value": "c8c48d669840e70410d8731b9b1036005d2b81f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205829, "uuid": "bda4ff05-5c94-4a12-b7dd-019a45b3217b", "comment": "Malware payload", "value": "d043da1f9ab6f21311b09f690ae01fd243bd9d89723fe46edfdc2ca9060fc9841f44d46c5aa7e57f35185b672ec14a56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205829, "uuid": "80fdb666-eec7-4a94-af18-c72a6ebc043a", "value": "T159246C5577A50CF5EC73C239CDA39112E67278110370DAEF03A0466AEF2B7E1563AB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205829, "uuid": "e2872d32-b34d-4332-93a3-69e45e94b82f", "value": "0674faf10da3d541a27e42d98f1e66dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205829, "uuid": "399be3b4-eb24-4716-915c-6003d31eecb4", "value": "3072:LWeWIhwDMd1DAQMZ0Oq8vDrf79TuBIyNuEYV/z/AC0V5+JbfRjtj:SeWIKw3DDOq8v3f7Jgc/j90Eft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791205829, "uuid": "d6655c22-f29d-4b20-b925-a533f57bb37e", "value": 226304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791205829, "uuid": "b13f3792-4014-473f-a90f-8a4aeec8f8c3", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205829, "uuid": "3687cc87-6e78-438e-89da-c185f72eee5b", "value": "9684e148168e71743784d6735b0bd38026fc9c11b199757db98185882e41c876", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dea0dd6-c09d-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791191834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791191834, "uuid": "0320765b-31c6-4a2d-81f8-2f54bf2fc57b", "comment": "Malware payload (Mirai)", "value": "0267cb1e0b2dac4ef007c4d3520e5a37", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791191834, "uuid": "d3f5a868-af0b-449e-8a1e-dd1f1f5077ae", "comment": "Malware payload (Mirai)", "value": "9726301cd60c587b599d6ead4609a17e28546459ff80cab8f80179db9c81a2f4", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791191834, "uuid": "809dbdeb-a16f-4c8d-b62e-639ae2946ddc", "comment": "Malware payload (Mirai)", "value": "45621fb61c2c90edcf8ff1440a860e69510aac34", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791191834, "uuid": "71e48978-cdc0-48fc-b741-18326693d768", "comment": "Malware payload (Mirai)", "value": "e7815aee4b7a4bdfe9ea4559d72efaf2c19b3ed8755221a928b6190e014c8dc1559dc242cc7241e99fc75250b2aaf96f", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791191834, "uuid": "53225318-0155-48e7-ba62-13d0c8ebe456", "value": "T175C3189BFC91DE6946C0277BFE2E418A331327B4D1DF71139D041F28B68A94F0E6A652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791191834, "uuid": "03524f16-a57c-4557-92ff-15c1ff083e39", "value": "3072:T2s/ITo7WCkybotgsJ913DhrbW4UYSx7QpUiB5IQggEuaJhi:T2s/gAWuboqsJ9xcJxspJBqQgTuaJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791191834, "uuid": "a76b715f-eb71-4dc9-87a0-7bb77b9409ab", "value": 129633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791191834, "uuid": "a3012ac4-dc03-4edf-b43d-2371b833121e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791191834, "uuid": "2b384ffa-1e61-4ff0-9c59-6cfde05c8655", "value": "9726301cd60c587b599d6ead4609a17e28546459ff80cab8f80179db9c81a2f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb00da5f-c09f-11f1-927a-4201ac107004", "comment": "Malware payload (MassLogger)", "timestamp": 1791192876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192876, "uuid": "7a8bcc30-51f6-483f-84c8-4b467320322b", "comment": "Malware payload (MassLogger)", "value": "4b4ace9b39e08e676a1f10dfa5604438", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192876, "uuid": "5ae2017c-2759-4339-8745-5029cbbe0744", "comment": "Malware payload (MassLogger)", "value": "9737e265844d2d17681d6536c743f78cfd737d910abcdaaa32831030479202cf", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192876, "uuid": "3fc6580e-1a05-4a54-8af7-6893ba02bff3", "comment": "Malware payload (MassLogger)", "value": "323a8e1a2a123ff6564f3d3dd199f50d9d4a27f5", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192876, "uuid": "53827b5d-b0de-4223-8ce3-12ec6f3d6ed3", "comment": "Malware payload (MassLogger)", "value": "72548701518ac3e5aeeed6ebe745fb1d79a4ddcc8b3e2a868881e0317719533e4b5d5230f1f9439ae6138377f2bea33c", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192876, "uuid": "bc26fc74-fdd7-4131-b41a-c59f6e9b4e38", "value": "T1B745231D5A0E11EE8D13A5B6F649B881F49923C34C83170F63BD85723BF4538E897A76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192876, "uuid": "6844d058-d86f-4c08-be64-cc17df65444a", "value": "24576:+Sj+O10d7DchCtKtdPPjf53j+4Q84F0rHlNVJ/SDFTpoLWMZyIZ:1rE8tdnhumrH7VJ8jq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791192876, "uuid": "63dbe6b9-777b-4d4c-8e4e-9ae033f5997c", "value": 1216219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791192876, "uuid": "d9ec7917-50a2-4826-b8b3-63c114ecef66", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192876, "uuid": "022dd710-37e6-4bd4-9158-4e05c6c7fc8f", "value": "secured_stub.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804c6eef-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload (MassLogger)", "timestamp": 1791216293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216293, "uuid": "4ef2f20a-27a9-43bd-88c2-fc570006138b", "comment": "Malware payload (MassLogger)", "value": "8e587c3050c5c9d55ccf274827c1c6a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216293, "uuid": "d88446a2-96e3-4644-b7cc-f86327a8b6ae", "comment": "Malware payload (MassLogger)", "value": "985df2cfe2d10aa55c0a893a51218e8dab64ba5f57e0e7a8155e06455b3d8e87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216293, "uuid": "ad9d3e7d-a606-4ba3-8adf-d07e55c18faa", "comment": "Malware payload (MassLogger)", "value": "4543f8a257ac318c383d745e1a1249a80c7230ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216293, "uuid": "511c2409-5bc9-41e7-8a89-2a625fa75909", "comment": "Malware payload (MassLogger)", "value": "cef35ddc0a86476cb03e7b2461a46e4184ed98c5b46da91519d902dbd3b2ac2885248eb06b1bae8dd89e8c7a82017162", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216293, "uuid": "04a39e83-480c-412b-acca-33ac338d8a70", "value": "T1D793090977EC9814E9FF8672E67151110B7ABC854A36D21D0BD8B4ED2B3BA8085C7BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216293, "uuid": "9f1edffa-5d19-4295-90d5-4f77d9e0cd59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216293, "uuid": "385c5d2a-8a72-4eea-8165-5174915b76cf", "value": "1536:7mhwtUhR7Sjnjxh+hThN/UP/UJS/UJ5/UJpg8ib7YpLN7FMRFZ0p43U:IwtUhR7Sbjxh+hThN/UP/UJS/UJ5/UJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216293, "uuid": "471d7206-b326-4fea-bc03-42818978ee33", "value": 93696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216293, "uuid": "65f8c5e9-a326-4ea4-b52e-7b9753d5ac34", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216293, "uuid": "65c59276-93f3-4988-8ff4-55aec3d16e67", "value": "CloudServices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a168621-c0fc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791232469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232469, "uuid": "ffed5589-f0f8-46cd-baf2-415135f6ff48", "comment": "Malware payload (Mirai)", "value": "877a7ec209544dc2a19357715a935097", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232469, "uuid": "d1d15130-6a6a-49d2-9dcd-6090e48eb924", "comment": "Malware payload (Mirai)", "value": "98afbffff9bc240d21b4f27ce913dfce66c07b97ea23a58b80c79231ba1041b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232469, "uuid": "c1bbe08c-a265-4dfc-9211-d0cc49319739", "comment": "Malware payload (Mirai)", "value": "ab6e4b09e300e50fde40f7ccff3607888baf9327", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232469, "uuid": "8470478e-cd7b-43ac-b735-5d5ca2d5917f", "comment": "Malware payload (Mirai)", "value": "2ce94816b24d5fe82848c75f6c75cf2b469923c87e1df0df201ff84e14f87ef97bd9ae2d813ec53039ae5f9d45879b52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232469, "uuid": "7a1071fb-0016-4eb5-9d92-0d0e748b34e9", "value": "T1B8E32B46F6418A13C5D61777FAAF41493322D794A3DB330699285FF43F86A9F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232469, "uuid": "b90ca0de-51a8-45a8-811c-e43c86c2fb00", "value": "3072:FYvMxqixyDJAmUzdBJXu9WRtotmLFQTihvVX0clM/9h4b/kP:yvMxqixyDJAmUzUSotmLFui/X0aM/9KO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791232469, "uuid": "484ed0cf-19d2-4839-8e0c-2fd26bfd1378", "value": 143845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791232469, "uuid": "28ba3d2b-4814-40e8-91fd-450bbd0215a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232469, "uuid": "dad7e19b-7a8c-430b-84f5-df33943879ce", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9ae20c-c0fc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791232443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232443, "uuid": "10a02b8c-0c84-4651-ab7e-588a29421c97", "comment": "Malware payload (Mirai)", "value": "530d491f42b7a18891d14ca334f846da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232443, "uuid": "9374cae8-eb8d-4ff7-a8b2-279f64fec039", "comment": "Malware payload (Mirai)", "value": "98c0f6bd070826e51ab1285427e8f449261e51920f5749d25888a47abf419653", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232443, "uuid": "50796da8-2a55-4ae2-b67f-5c08ff6fbd1a", "comment": "Malware payload (Mirai)", "value": "7658c849cddf740e5ac75832517f501a7df0691d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232443, "uuid": "86b99171-4f4b-41e3-bc4d-a27d9963cb89", "comment": "Malware payload (Mirai)", "value": "c9236b717ee01994f3d846dbd68cd10f8eea07ef7e72288ec5aeb8b1b13433a154cff5ccaa28c80ba30f394b1989b6c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232443, "uuid": "4e9f6da1-11db-405d-aaca-67d94a649254", "value": "T181E2E011651A847DEB308471E0F6858777692FBDB9FEB1A244A2024DDCC394293E2ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232443, "uuid": "ab99e348-da9a-42b2-88fe-0fff9a99e96c", "value": "768:5EKkUgXAnURCr6HmDFStmYtmSPU7S9q3UELd9:tkEn7uHEemLlHLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791232443, "uuid": "07164c66-b1ac-4706-85b5-5e73d4de603e", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791232443, "uuid": "a57cee19-7061-4f7c-9b8d-dd7f73fe0a8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232443, "uuid": "2451d14a-2e13-4cb3-8579-a1c6b002deaa", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a4d7a82-c09b-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791190889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190889, "uuid": "9ac9ea71-7d3e-4bac-82be-ff3bc4c8ec21", "comment": "Malware payload (AgentTesla)", "value": "05fd3fb96ce9e0b28be992a8c5f0e277", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190889, "uuid": "e7cb2c00-d015-4a3f-b6dd-2e728c078bbf", "comment": "Malware payload (AgentTesla)", "value": "98c2feb097ca2d7cf47dea5b0852933595dac618b7e0560eee6ae747a17c1b2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190889, "uuid": "5f827a76-16f4-4c1a-8a23-0da35fb9d952", "comment": "Malware payload (AgentTesla)", "value": "470b3f00315fd63fd3d74463ffcf9006f5773bab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190889, "uuid": "92ed8be1-971a-421a-a4fe-7bc0efbc2604", "comment": "Malware payload (AgentTesla)", "value": "a1eedd20cc9bc10ceda65257247f81e8fa017a7e1086ff58dc2f31a7717a0cd619bfb4a5e1bbb32014d5fc7850ef038a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190889, "uuid": "36d44fc2-78b2-44b6-b35f-b5892fc132e2", "value": "T1C9E5F6B9121C98B9A5BE675CC03AAA9006CC300771CCAF7E39F836457391653779F8DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190889, "uuid": "e671ddeb-f1df-4f16-9eef-9bdf508b1015", "value": "98304:WwdJULWqJ5pMrf7IkuTzceanm1YBXkWwIxd1h9N6E8:JoLl5Grf7uUe+JwoNN6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190889, "uuid": "7c5c9381-6f9c-4d70-8d64-3f21fe46e19b", "value": 3285120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190889, "uuid": "2bc9a81e-5ae4-40ec-b8fe-5b2102564536", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190889, "uuid": "129774e2-85ad-4617-a9bd-40bd857d9ed6", "value": "REQUEST FOR QUOTATION_25117_2026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6dd3252-c05e-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791164925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164925, "uuid": "73e4c748-692a-4b59-b3dd-04b891c49e72", "comment": "Malware payload", "value": "5aec7a7a816f79ec5e2d276ea99d60cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164925, "uuid": "69639628-3cdf-4df4-972b-d5353eefa8f2", "comment": "Malware payload", "value": "990fa84a88d86a9dac77882de2629849222c37d13b433ccce41bc6cf7780af6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164925, "uuid": "37d80599-7803-4973-aed7-34d24b2e78ac", "comment": "Malware payload", "value": "43a6f95c9b20329d49a719dc7335a0aa3416f1d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164925, "uuid": "bd16be70-e61d-48e9-89c2-7272f47ba16c", "comment": "Malware payload", "value": "16fb0720ed1e790f46b9d29d7951edbcef1975c353d39b1bac54bcf71eebaa6b97bf4f0f169b073a61cade681db6eb56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164925, "uuid": "8ff86637-013d-49a5-a96f-b462ef2ba4dc", "value": "T1A6E5D02B9642E6FEE01909353439D10009377E52A8480CDBDAF8F99CE7375753A2EB76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164925, "uuid": "3a46f9d9-68cc-4ecd-9c6b-17f99b5fab24", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164925, "uuid": "38c1a2bb-d15d-4c0d-9e7c-44ce831ee508", "value": "49152:guI2hi1uPtffMIKHqTL9j07iun6HE4+Ymy+vvRbHR6a8CXcNoW9JZG/:g5OiWXrKHqTLO2xHGYmyo36NCXXW7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791164925, "uuid": "7de20ece-322a-4f9e-a1d0-cb53bf53e65a", "value": 3217851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791164925, "uuid": "60e1b224-fd8a-4b8e-bd4d-0c5de6b1bb12", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164925, "uuid": "803ed4af-7238-460b-8283-5ef5d8bf215d", "value": "990fa84a88d86a9dac77882de2629849222c37d13b433ccce41bc6cf7780af6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd190b76-c051-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791159325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159325, "uuid": "d50f37d3-47e1-4e54-87b9-c688f7a3a26b", "comment": "Malware payload", "value": "eb29804c69ccbdc40b7ce8887057e7f6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159325, "uuid": "8e1859ba-32b4-4b5c-a34a-b2728fd81a61", "comment": "Malware payload", "value": "998bed38abfa7e807bb2c8d0e0d54cb499c56f0583a99984ac24341b51c4d9e4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159325, "uuid": "2325cdc9-b732-40eb-80df-02ce56a473e6", "comment": "Malware payload", "value": "f50141395e07d95ddbd2988a0971ee58b4e225f1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159325, "uuid": "d0dd1f74-628b-42de-bd3d-38b15f193827", "comment": "Malware payload", "value": "09567e366843014319697841c82411715dea3de1130f3490ae20e4f0b68c062dfedbb10126f7cb5039cb927e1f84ce96", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791159325, "uuid": "b5559fc7-20f0-4715-879f-528f3f9be51a", "value": "T16CC52707D3FA81D8E1FBE730CAB262731D72BC195538E55E1685DA251E30E709F29B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791159325, "uuid": "ef1b7f84-2ee7-42e1-8eb6-90ffed9eb2a2", "value": "1802a55ddb2aa93e2a4096c636b74c52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791159325, "uuid": "37c20fa8-25d0-4c37-89f4-f8493a161987", "value": "49152:tekPsdLwGm1Jd8ucriMAQFEt2SbKeRBdWN5uCT8:ta/wFMAQStjKeRBdWNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791159325, "uuid": "bc2c438a-1093-42c3-bf33-549370d429d5", "value": 2592256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791159325, "uuid": "0e0b9f44-286d-45db-a789-063ae3ca2c38", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791159325, "uuid": "2086f340-234c-48a5-8b68-3dcc9feaa91f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae944379-c0af-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791199620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791199620, "uuid": "ebde13a2-3414-4bc0-b85f-f05af75b6182", "comment": "Malware payload", "value": "48dc27e168fcde344a6f17ac7fdd3764", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791199620, "uuid": "bb7d56df-2339-4971-b2d8-98b383468078", "comment": "Malware payload", "value": "999a6755b04a3da1b9839728f4f390706e1f63bfe5302c400e66fda14d5e04ef", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791199620, "uuid": "20be7ba7-2177-4044-bd1d-e2476accfea6", "comment": "Malware payload", "value": "3566da913dd92753b0ba48fb9ac8332aa4fbcae1", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791199620, "uuid": "fe810660-2dce-4a9f-bb6b-0ce3f641e919", "comment": "Malware payload", "value": "c677f505c80402ba9c4d744cc72abd1fe3b15a4012999e5858744befa92fd5e978d687902756ea829960ffbdee7f915c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791199620, "uuid": "7ee22ffa-e830-4f86-9de4-8786733a5601", "value": "T1B5321B9CAE90B1B0E21753CE37EF2419122491C3140AC684FE4C6EE9BF467CD6A97F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791199620, "uuid": "9f75b135-03e0-4fc2-a9ff-a2bea5ed9183", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzM36cnsEJTYh1LCaOk/es:sXX+/DV7k/3M37sEJTY/LZf/es", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791199620, "uuid": "7f9781af-2855-4bc6-a132-8bf8f9ce51d2", "value": 11878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791199620, "uuid": "7ed07464-3bf2-4722-91ea-1f2806ceac21", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791199620, "uuid": "edc94ef0-0bea-434b-ad41-71cf73908477", "value": "Captcha.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ef20ec-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181729, "uuid": "a9d18e01-2983-4fde-a411-7798aca7c115", "comment": "Malware payload (Mirai)", "value": "5cbbd6d166be2c5178e19bbc04cde5c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181729, "uuid": "6dc40f04-a5ae-4037-a556-d7ea78d599ec", "comment": "Malware payload (Mirai)", "value": "99c2f7625de458251a4f61937838ab4dab152b7803ff18fab25bc870030b013a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181729, "uuid": "db4ec7ae-5679-42d2-b0b8-d7dbfcf1d0f3", "comment": "Malware payload (Mirai)", "value": "3b14969e66a6f90d4ebbd2bf27db9d7a972f4c1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181729, "uuid": "86c882ea-5830-4fbd-8bfd-72a5a433f8d7", "comment": "Malware payload (Mirai)", "value": "f19d4044e0c4a62ceba855dfa07771f7be417394b9dca93bff9e1458d84efb2a2d96b3ceb2fd8417d842f788e831a24d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181729, "uuid": "e1b3ef79-0af0-4d23-9e7f-ba421aea71b2", "value": "T139531A85B8819A25C6D113BBFE1F018E3316975CE2DE73128D145F647BCBD5F0E2AA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181729, "uuid": "93841793-0345-4097-a599-fa0fcb6057e5", "value": "1536:YdnWpBh3cLDNoATqHjjO5yAMQ1fonWmLdI8niD7noKWp:lH3+po+qHe4XQtom7noKWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181729, "uuid": "88ad0315-5493-438a-ac55-f0dee0de4ec6", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181729, "uuid": "85177278-d2c3-41b9-a0b6-91af5799298a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181729, "uuid": "f054e665-8e21-4f27-a6e4-f90fa34f5df7", "value": "87sbhas6as.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51bcf4bf-c0ae-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791199035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791199035, "uuid": "2e941d3b-5570-49d1-8ea8-ad1298d655c0", "comment": "Malware payload (Mirai)", "value": "cb0014f8b11a2ec280192b75bba7da49", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791199035, "uuid": "fc1e9aea-77ba-443e-9681-8b89bb27bf1e", "comment": "Malware payload (Mirai)", "value": "9a441a3b1c8da58b30543d91e1cb82bb8609a0f60b4c942d2696c23b9748863a", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791199035, "uuid": "a4fdf00d-6bbc-4afa-ae49-2c39ec876623", "comment": "Malware payload (Mirai)", "value": "d75b4ca208b0bdebbd3d020a6df4bd375d20ed6f", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791199035, "uuid": "d7acbb6d-150d-4e90-b105-1b2d0896bdd6", "comment": "Malware payload (Mirai)", "value": "9b86afcff6b0fa8eaa04ab81f392dcaa1e98d9f93af766e5bc7a0b9d2239d7305c920d0f17851a3d52d8f29ad753c341", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791199035, "uuid": "9f52c8c0-293a-48b8-9a09-83d580a35890", "value": "T15C24198AFC81AF5595C127BBFE2E418A331317B8E2EE71129D145F2477CA94F0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791199035, "uuid": "aba404d7-baa3-4dc9-bb7b-14c354bed0ab", "value": "6144:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRhVabE5wKSDP99zBa77oNsKqqq:T2s/bW+UmJqBxAuaPRhVabEDSDP99zBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791199035, "uuid": "0e60689b-545b-4f86-868f-ac40aa4f8058", "value": 210928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791199035, "uuid": "24f418d6-4f1d-4757-8212-404e67f24ff5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791199035, "uuid": "77f9296e-8527-4780-9a5e-225518ea7699", "value": "9a441a3b1c8da58b30543d91e1cb82bb8609a0f60b4c942d2696c23b9748863a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97cd8f6a-c110-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791241243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791241243, "uuid": "457154d0-d847-4c81-b2e3-dd1fa243328e", "comment": "Malware payload (Mirai)", "value": "2d29fb27da3e3000618b826809cba043", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791241243, "uuid": "b933aaa6-d3f3-4724-9953-8a4f680b32f7", "comment": "Malware payload (Mirai)", "value": "9abb41cee935825a50e7f96dd2bc66b149755e06124019cc9b73c68fd216319c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791241243, "uuid": "328d79df-c60e-4795-a03a-b83c6d4be4df", "comment": "Malware payload (Mirai)", "value": "65597278c3ba518560ddd63bf8910843d0475ebc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791241243, "uuid": "800a3354-79ce-4d0a-9114-c75d480082cc", "comment": "Malware payload (Mirai)", "value": "2b7b216d2d3393c2ab1fd29fcd5f0a827e328dbe2b664832b60d2db0ee29d604cae527db30d2c4cd437e9af727047425", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791241243, "uuid": "59327f90-182d-4ac8-aaac-eb7a8e2c4cfc", "value": "T10705EA076F409EBBC42FDD3705B9861235CCB8837265363A3174DB5CBE2A94749A39B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791241243, "uuid": "9f87c230-9461-4133-8ef4-fddaf86a6487", "value": "12288:4a/LCdG70o5QhwOZfAP8ninLyjYHXKUNEK0QsclQR:xjC470YQh33eKub0vP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791241243, "uuid": "48886df6-8b8b-4e2a-aaeb-19f67ac166b6", "value": 830756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791241243, "uuid": "42d609b5-4bb5-4b9c-9b05-b1fab274279c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791241243, "uuid": "b6bf3c48-1c0b-4a61-a691-e154cbbb97eb", "value": "eclipse.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d6d5a5-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218881, "uuid": "4fa679ba-e3d1-4949-8d85-4f359c81bb5c", "comment": "Malware payload (Mirai)", "value": "1e4e00fb96617290d8c330c99830b888", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218881, "uuid": "6568d5b4-2231-40cd-9c9b-cf14b9837cc2", "comment": "Malware payload (Mirai)", "value": "9c23b857f89747407a268b5a372d2d79644233b95fbed2e66c82265fd8779b5a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218881, "uuid": "8298652f-345d-4b40-8810-dfd193b5e57e", "comment": "Malware payload (Mirai)", "value": "c5e4be79153573b1f0202e68b248c71eed82c072", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218881, "uuid": "c8ef9ae7-f532-4324-86e5-89725bcb08a1", "comment": "Malware payload (Mirai)", "value": "5c39cd39a71cce1f1a740b16f5d4fb6f6522811e8b35c8ae1bacf692c804c11c82b933e397a67486eebff46957057913", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218881, "uuid": "c535abff-f7ae-4143-813b-bc6dc3329642", "value": "T1D19302CDD2495DA0FEA6C166086F76E47FA00F8BB78C5AD354919E431368233690AEC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218881, "uuid": "613f2925-3372-4ceb-82d9-59494c1176fa", "value": "1536:VThn/3uTtuXU2hri9czsO8EByCUkus+P2UN3/1P3Ygs831BDHf+KL5mdV4u+qgwR:H/3u4Xzhrin8ByfkumS/JogtLD/+NV4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218881, "uuid": "bbf54724-a4f4-4b40-ba69-5d3f30271ed0", "value": 93124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218881, "uuid": "840b342c-bd75-472d-b00d-29af8ecac175", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218881, "uuid": "730906e7-b16d-41ca-a04e-083f3221b5fe", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efca5d92-c0bb-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791204883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791204883, "uuid": "55b98df7-1524-4d03-a9b5-5ddaf00dcf09", "comment": "Malware payload (RemcosRAT)", "value": "11a5e9652cdf3b6eeeaee5f006044831", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791204883, "uuid": "759a8c7f-36f4-4bb4-b498-31b52341423d", "comment": "Malware payload (RemcosRAT)", "value": "9c40652739b80dc1ab87b447fde0d4956f362a956138173baddf4b37878af0b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791204883, "uuid": "274ee688-e2ab-48fd-b3a2-328ab016c0c2", "comment": "Malware payload (RemcosRAT)", "value": "34b6d4003cf0e99c3db1eb8ab9630d92a8d94f85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791204883, "uuid": "6a26a623-2b1a-42cb-94a9-6e02bb3b4c27", "comment": "Malware payload (RemcosRAT)", "value": "9ad2d1d7dad410247aea6341bafb72c64f45d305e2a105c88a56f9d969646b9ffbf273b91e7903ed57c55690fdbf0700", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791204883, "uuid": "b6840ac8-fd7c-4f8c-94b1-405ec001ecec", "value": "T1DF26E6A51FA7A172B321AB9D8235EC31940AD41365F9CB3031BDD61B352CD4BA31F6E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791204883, "uuid": "1739a02a-799c-4056-8416-09cb7428f765", "value": "98304:iVweaFbephJ74T5wD6DgZsgerIBALOHmWOC33SuE0cDEe4vE6VTvSJ6QSyXmiN6e:iVweaFbebJ74q6DgZsgerIBALOnnPE/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791204883, "uuid": "204571a1-d0f2-46e8-9886-9d0d3e334c96", "value": 4446962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791204883, "uuid": "a8805593-48ce-4d63-baae-a6ca62f7d1df", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791204883, "uuid": "cd092194-9145-4317-a132-ce8557738f95", "value": "SWFT.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab24c44-c0a0-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791192903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192903, "uuid": "a2bef68b-dee2-479a-a2d9-18bedb340558", "comment": "Malware payload (Formbook)", "value": "2e09f801afeb5ba3482aaf3ecb6db4da", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192903, "uuid": "cd7f76af-c02a-4192-b53f-5ecf34d43ee0", "comment": "Malware payload (Formbook)", "value": "9c44283c1430c19f78f74298902b442d948374a34de9332713db4877eb707d25", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192903, "uuid": "51c285d6-771d-46cd-9d36-e3424c44886c", "comment": "Malware payload (Formbook)", "value": "eb2a236d6a9e1ad7bcc9a88a940a3c686d5aaa0d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192903, "uuid": "b5228391-ea77-403e-92c9-40448688b1e9", "comment": "Malware payload (Formbook)", "value": "7e7ade782c9cc7e3fe997e7efde771f9d867c4db87d3e92ba4f032f62e0d1df2839067624ba87ded66bb09c41ed27634", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192903, "uuid": "41c7a8da-19a6-4b39-8fd5-39ed59045c47", "value": "T14192A7404A81749497776B79EB2BA8D5F77B09AB0094490BB82CB444AFF1E18DFE4DF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192903, "uuid": "4f1de0a4-723b-4cc9-b216-d0a992a6c499", "value": "384:d/H5XuRuhYmU+JgZJiljBOZZzXsrXFFn/Bi9DVCLFJXPOQDxfH3qcLVItVnkq:d/HpuRuhYmU+CZEljBOZZzXsrXF9/Bi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791192903, "uuid": "2c21f5b3-662d-450f-92c1-d3848bcf50f7", "value": 20731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791192903, "uuid": "e36e0e24-aaa5-490c-9981-05153344bfed", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192903, "uuid": "d74ece7b-6319-4a38-adbc-64f26d13c1f5", "value": "Specifications.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9836e20-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791182029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182029, "uuid": "d007cfaf-6c80-4b37-b3d0-3ee41f62bd86", "comment": "Malware payload (Mirai)", "value": "224b36a9a03f4fda0f47953b25c36918", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182029, "uuid": "7aab7bbe-57ea-4670-ac49-5d111f49fc1c", "comment": "Malware payload (Mirai)", "value": "9c508f7fa461e191a18e3399729ca519b5ded5e081195f62b0c3785e626ca58b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182029, "uuid": "db44d848-bc21-4a08-8bf5-32477ae549d2", "comment": "Malware payload (Mirai)", "value": "e2ccfdb32c90d7ab2ec08ff3875c902cdf09a24e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182029, "uuid": "8abbb063-b9b7-4735-b523-de9b4e9d999a", "comment": "Malware payload (Mirai)", "value": "9263c6c0b74bb3801207cfe52db757a4d3217860e07284f642a8d97adc750203312fc02cbe99a5a1cf295e6c034eca2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182029, "uuid": "bdfde0ac-cc88-4d22-b381-5abd0de66b3a", "value": "T1E2043A02770D0F43D2532EF0277B17E183AFEDA219A1A684751EBEC892B1DB22545ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182029, "uuid": "5939af0a-bf4f-4aee-ac8c-ab63aa2e9e8f", "value": "1536:GFyNcOZ2kkHac2A6OAadxbnisMlzrxPFPK60Xl/9ifKTW2uu1DgMloDy2nKfQgly:2mcjXxbnZMNxdPul+IoDy3f64AAMB5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791182029, "uuid": "9a8e5837-cfc5-4a47-b610-84fb88ad6b46", "value": 180200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791182029, "uuid": "37385170-4b6d-4dc7-aaf4-e8a6e50186d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182029, "uuid": "64435d7b-06f7-4b79-bda3-90c32011ccdf", "value": "wife.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b92bddd5-c098-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791189759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189759, "uuid": "fac5ccd7-a714-4f53-9df6-889e23c353de", "comment": "Malware payload", "value": "e7dbca0055bb94560a9978bca42c68fe", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189759, "uuid": "d4d55e12-f131-4d2b-a2be-96326552d406", "comment": "Malware payload", "value": "9c786541f3c625bb6301c29e818d0f7dd15ed325abca67358926a811e92902ba", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189759, "uuid": "10bdd8a4-173b-4220-879b-7afef4910643", "comment": "Malware payload", "value": "eda7410097a859d1026069ee83be29d06adba28a", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189759, "uuid": "f36690e7-5b15-461b-9627-b6579ceef5ca", "comment": "Malware payload", "value": "71be665c4d443f9e3dd3a837773511251e3d88a99070af582d8d77293c90e564a0e4a5953c8a4d6a91ce31f2e412a86d", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189759, "uuid": "f8dd69ba-4bc5-4621-a36b-3b883de75d08", "value": "T14032195CAED1A1B0FB1707DEA3AF24690228A087240DC484F94CDEE87F46BDD4A57B57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189759, "uuid": "8932a4bb-a7b5-4d0c-8657-5ad16740bb2d", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzNbqFtC8SjRUM:sXX+/DV7k/3IFtoRUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791189759, "uuid": "2f142abb-8ff1-456a-8e48-f5d6e589608f", "value": 11950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791189759, "uuid": "56481dd6-61f5-4a8b-9446-fd643484fc9a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189759, "uuid": "feb3dc3a-8593-40fe-bbc3-edd099eeebca", "value": "teach.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caeb3937-c08c-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791184635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791184635, "uuid": "2b47e48a-1679-429e-8e0f-06c515257e92", "comment": "Malware payload (Mirai)", "value": "89bf816e841594547f5549388e3e1a26", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#AFD6C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791184635, "uuid": "e80bdca1-32f3-4998-a268-490a2eef0262", "comment": "Malware payload (Mirai)", "value": "9c79c50c5ecb81dd89ad9386670e88154f6aff3dc6645ed7f38e81742ff6dbd2", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#AFD6C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791184635, "uuid": "54905b6a-fee8-4663-a29f-c7891110877e", "comment": "Malware payload (Mirai)", "value": "4ab6bc34cc419cf892a8e7bbeed5dcd9589c0dfd", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#AFD6C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791184635, "uuid": "2c3f197d-0f9c-4009-aaef-e8f926eee79e", "comment": "Malware payload (Mirai)", "value": "829ddace7c37ee8135561e44f31a92546922ae2904110e8732c9014cd81172fbcb702c266e0b0d2991d4036bb7ea73e4", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#AFD6C3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791184635, "uuid": "55b2e8e7-1a90-4a1f-aaaf-5e0fcc4ab346", "value": "T19734298AFC81AF65D5D422BBFE2E428A331317B8D2EA71129D145F2476CA94F0F3A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791184635, "uuid": "73cbb1c4-c465-43df-8d63-e0455b4ab264", "value": "6144:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRhVabE5wKSDP99zBa77oNsKqqfPqOq:T2s/bW+UmJqBxAuaPRhVabEDSDP99zBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791184635, "uuid": "fbb90585-6831-4be4-a5fd-2b838beb897c", "value": 240263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791184635, "uuid": "157d697c-f7e7-4bba-9ca1-f9205b9ee65f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791184635, "uuid": "22b8952a-2a9d-427a-8ef7-69f5ab75d93c", "value": "9c79c50c5ecb81dd89ad9386670e88154f6aff3dc6645ed7f38e81742ff6dbd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc49457e-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181658, "uuid": "d3184edf-2627-425d-bbf0-c7db9203e777", "comment": "Malware payload (Mirai)", "value": "f24ab2f9c133e3567089037cc2156db8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181658, "uuid": "07ab706d-718a-430c-bfab-57217ea4574b", "comment": "Malware payload (Mirai)", "value": "9d92d096d4827ffcf3a05e679b5e319e4e6dc5e811ee183ad8ce3e9f6fcfb6c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181658, "uuid": "36810863-3242-45e7-a7fd-b02d3f69afc5", "comment": "Malware payload (Mirai)", "value": "374ac25e5b464bbd1d57836936e64b717a2d61f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181658, "uuid": "71f0b226-653d-45cf-ac27-e3f26b4a6fd0", "comment": "Malware payload (Mirai)", "value": "b0a37e64655493a40489f161a25f408cfaa346c626ddfb8c54c76fe9d1745a82000c7f447ade8077a1598814acc1f783", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181658, "uuid": "e7746521-4d2a-43bf-8db0-e1c1ee4ae992", "value": "T19AF30706AA41AB01E4D736FAFBAE414533536BBDE3FA3002DD205F6523CA99B0F36515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181658, "uuid": "ac799fc2-1b8f-4fb0-81c3-16ac227ab13c", "value": "3072:S0F1RVEuDIS4/rxOJ3TF8ZabarKi/nJ36oateinEgsnRvri:v1PKEJjF8ZabuKi/nJKDe8EgsnRvri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181658, "uuid": "b9f79283-3dc4-45c9-ad4a-5be9d65de57c", "value": 167252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181658, "uuid": "bff589c3-7410-4f30-94d7-a55c9b74b508", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181658, "uuid": "64f6803b-373c-4194-a26c-401231800887", "value": "wife.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d8f826c-c09b-11f1-927a-4201ac107004", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1791190894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190894, "uuid": "78742159-3eb8-41e4-9940-ffa97e836ddc", "comment": "Malware payload (LxBaseRAT)", "value": "892740b772fe6fcec18bd03f3f492473", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190894, "uuid": "8af5bbb8-2c2d-44df-a91c-a18cf8a40530", "comment": "Malware payload (LxBaseRAT)", "value": "9dc8057788c2c891da6013e5054146442b1f33792757e40abe6a0174aafa341c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190894, "uuid": "83a78dbe-1a22-462d-b0f0-1ca15873359b", "comment": "Malware payload (LxBaseRAT)", "value": "05f10e0da157170a58b2708f4838fb9ce81e1667", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190894, "uuid": "fa7cdfe0-6ff2-463c-ba89-71e6ab35e401", "comment": "Malware payload (LxBaseRAT)", "value": "f3351b25e25dfbc8cb20dccd9d1efd8a963214681c0e080c5af6a2be01330cd5bd0d565c8eeb3fdc6593621bc8da1f96", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190894, "uuid": "11745d35-99b1-4a9d-abcc-019b5fa1ae22", "value": "T1F0F49E31627C805D2D67A45B6377B1737A0EFB2DD21A2A0045FE43C271E61BE91378AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190894, "uuid": "969985f6-6bda-46c8-8ff5-eab31ad0611f", "value": "12288:bjng64SxX05SvSEEjN70SVMijCBlVFGzfW/zGYzIzA2TJHmCe5jBYqJnD1G3aWgG:Xng6lxXcSv4ZQSVMijCBbYzfWrG+2tHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190894, "uuid": "7603eb20-1c9e-4c46-b691-0ef8fe437851", "value": 725323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190894, "uuid": "b2b64e4c-0fd7-4d67-b40d-eb2b7a70809d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190894, "uuid": "5f30a784-7e55-4e3c-801d-cfe631480150", "value": "ALPHA WEB BANKING _ \u0391\u03c0\u03cc\u03b4\u03b5\u03b9\u03be\u03b7 \u03a3\u03c5\u03bd\u03b1\u03bb\u03bb\u03b1\u03b3\u03ae\u03c2_w.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56cb551-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791190639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190639, "uuid": "3adb613f-da37-43fa-ba29-7354c72519ba", "comment": "Malware payload (AgentTesla)", "value": "093dfe4c1f9c9d3e0e043bbf08f1d2ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190639, "uuid": "90ed665e-0470-49f9-a7bc-d22eb20a4ba4", "comment": "Malware payload (AgentTesla)", "value": "9e6709a3592821873b15703187513541df9b178743d9d7c4c62806b83d227106", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190639, "uuid": "b5525e05-5dd9-4347-83e1-c2c97944b0ce", "comment": "Malware payload (AgentTesla)", "value": "728cd480d56e4728e98ba12446b65970c1d6c5b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190639, "uuid": "928a07ce-fbf9-4bbd-8f59-26b7fd085748", "comment": "Malware payload (AgentTesla)", "value": "3bad54dfe75198d5f21d76b684b45552d2c8b428c30be288de1e52f20c9cae0ae7f6cd7bfa731cf0b059edfa6616d7fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190639, "uuid": "975f7fb7-a6c4-4c01-b3ff-cb1fd7bfd196", "value": "T1F1E5C4AC5384963673206B4C8B7699B065CAB45375C1CB7430ECF2483B5CD17B3AAAF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190639, "uuid": "f42265d3-fbd1-46f9-a8b5-944649c838f2", "value": "98304:hkinrYZonxo6JDz5rs9gHKYptruqCVXViN4XULGRgLk1n6ojxOdw:hkinrYZoxLhWgqYpt6qCWmULGR3wo1O+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190639, "uuid": "d7d46bcc-c507-4471-82d3-05ea6ae315f0", "value": 3286920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190639, "uuid": "b15a8f20-d5fe-461c-bce6-36b9ce7dc3c8", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190639, "uuid": "5b37a94d-c58e-4dd8-a1cc-fb419388b840", "value": "ufgqywxa.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435f2e87-c06b-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791170234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170234, "uuid": "ccc794d1-4210-4d2f-a99b-5c1676dde553", "comment": "Malware payload (Mirai)", "value": "68c87fde0119f7c64fba8e4234d6ae88", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170234, "uuid": "7818082a-c096-4ddb-8e3a-741d89a70897", "comment": "Malware payload (Mirai)", "value": "9ea606cb554ea1f869dfd2c1f16fc63abd21275d2da7e7c2f8144d599523c671", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170234, "uuid": "91bea4f9-f1d6-4459-8c78-0b7385e2b669", "comment": "Malware payload (Mirai)", "value": "13a65a7245a2aba0e08dce11cefd69c3597ab383", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170234, "uuid": "820cdb68-bd4a-4c42-b747-114a5d96e746", "comment": "Malware payload (Mirai)", "value": "82c852bb7d3758f52da1dc31f53f15bb986f401b9dae4e0ef08383c4a7d2276fa6f963d682de916ad3e8eac6307da115", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170234, "uuid": "826d86a3-a549-4269-8733-2c317b98daba", "value": "T187E3199EFD81EE6546C127BBFE2E418A331317B4D2EB71129D141F2876CA94F0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170234, "uuid": "e2ff8f39-3e3b-41d4-b013-4de04e6814eb", "value": "3072:T2s/ITo7WCkybotgsJ913DhrbW4UYSx7QpUiB5IQggEuaJhnR1rmaabEtnwZ:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791170234, "uuid": "8480f7b7-2a7b-4409-8e3f-e6e88888c2cd", "value": 157240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791170234, "uuid": "d493412e-bcdb-4c5e-848b-2531114ebe30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170234, "uuid": "74ed2793-c0ea-4a2c-a1b4-2e1a26614d10", "value": "9ea606cb554ea1f869dfd2c1f16fc63abd21275d2da7e7c2f8144d599523c671", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f1c1e9-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1791190660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190660, "uuid": "87caaf04-f93e-43da-8ea2-c8282189b9f9", "comment": "Malware payload (LxBaseRAT)", "value": "ea26758135d1ad4c8764b07165e347a4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190660, "uuid": "898ac550-3f8e-4e6e-b755-25e2c5503798", "comment": "Malware payload (LxBaseRAT)", "value": "9f1125bf7dd9ea6545df89f856157fefe2275efb2bd900492e14e3df02264dfa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190660, "uuid": "e94f5af6-96a5-4e2d-9350-931f0c59071b", "comment": "Malware payload (LxBaseRAT)", "value": "c877b75ffbbf9a15b7dcb5080c80ae28cf9b1199", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190660, "uuid": "a97f05a9-9976-4ef4-abcc-84365e214617", "comment": "Malware payload (LxBaseRAT)", "value": "27c7186b20c5924492642edeea3f65e6094e962c14f9017bc566b3ee254dd323186f7587a227672abd22ffbf8f11e8f2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190660, "uuid": "68fc4de5-1222-4d43-9037-8c06461fb87a", "value": "T19CE49E31627C905D2D67A46B637BB123761EFB2DD10A3B4005FE43C271E61BA923789B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190660, "uuid": "6c20a9ce-4e16-4797-8d48-7e5eb1f7c7a8", "value": "12288:XBwVJteFaCjTt1g1rP79i3IoPeR6PGpJbhweKV1ELUfqEyfpKnZPC1Z/eXDVsoAB:RwVJtCaCjXg979EIKmvbbyeKVqLXEyBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190660, "uuid": "724c7117-b8b2-4dd3-b7d3-9e02a65f85cc", "value": 714089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190660, "uuid": "1e45e5a7-e4d8-48aa-b756-3a95486316f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190660, "uuid": "cfbb5526-0913-406f-bf42-ad7d95138879", "value": "B\u00c1O GI\u00c1 P1456 1331 0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a63291-c08b-11f1-927a-4201ac107004", "comment": "Malware payload (Sliver)", "timestamp": 1791184168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791184168, "uuid": "63b25a96-7ae4-4b5e-9bbb-a087b55482bd", "comment": "Malware payload (Sliver)", "value": "be02c9890e938e672165c1c10bc99bb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791184168, "uuid": "804d55be-69d3-4840-b7de-b3fa2bba679f", "comment": "Malware payload (Sliver)", "value": "9f51ab6d2c23a1d89f3fdda78243e2a975984e9ea496c6ecc95d155fafafcfd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791184168, "uuid": "c8f30811-70c5-4f13-b12d-31a833cce2f6", "comment": "Malware payload (Sliver)", "value": "2688fb01200335f8a1f0239b5f7ccbf9263426ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791184168, "uuid": "7df672da-ad12-43da-b575-19314559ef23", "comment": "Malware payload (Sliver)", "value": "cef9bfd3364689dc7de51d9a5b09606a3621c036163006bbb96418726e90c3b826f23f22cd15835316766a9ec9521867", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791184168, "uuid": "1c997ddb-96e3-4fc0-8ae4-52074649e50c", "value": "T1F8835B0B229254F9C55FC274C1D7CB31AB32F86605307B1E2DA9E7312E25FA09F6EA45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791184168, "uuid": "26eeddb1-39e7-41ca-a967-e6707449ffaf", "value": "574357db2a72a38a96c69f48b58e64cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791184168, "uuid": "4ba11d0f-4834-49c3-bfa6-20f134af893a", "value": "1536:4Db8bX/S59AP4Qj1wTGGSgCHXOvBO9L9scyqHAFkN8v1y:4aS59m4c1DGSX3mKL9lynkN8v1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791184168, "uuid": "fd6641c3-6e0a-47df-a9cc-a5890c851efd", "value": 80912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791184168, "uuid": "3f4f6f4b-f044-4ed2-9cc6-7255e675c0dd", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791184168, "uuid": "d6d2ddda-91d4-49d7-ba59-0b45540e18e3", "value": "9f51ab6d2c23a1d89f3fdda78243e2a975984e9ea496c6ecc95d155fafafcfd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57520cf-c05f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791165326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791165326, "uuid": "6078a6ff-80ea-4263-9620-6f02c10c7997", "comment": "Malware payload", "value": "f5eebcb1963bffe782e1a4cc7703abd0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "hijack", "colour": "#D7C062", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791165326, "uuid": "ed85b788-df70-4c51-90fb-ebb3db5f5e7e", "comment": "Malware payload", "value": "9fc2368188b4ea8c90ae7d8e4803170d873279b93f74e16b4d2f24a9525421a8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "hijack", "colour": "#D7C062", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791165326, "uuid": "4ca5c197-6d57-490f-8d67-babc74d88b18", "comment": "Malware payload", "value": "4e016d2db93c9a71f42b8349c09da66b6c8bbbc7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "hijack", "colour": "#D7C062", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791165326, "uuid": "ae711450-05da-4507-a9c9-a59d79269693", "comment": "Malware payload", "value": "54ee4e9cd500fc49cef20faf99a456905e5bd641dd7e2118d4677ef435e339820055aa9b21e62e9e05b6be97ac9146c3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "hijack", "colour": "#D7C062", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791165326, "uuid": "1fa680fb-28eb-4e93-9521-cf27af49d339", "value": "T19D263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791165326, "uuid": "88704359-0ad9-49a7-a1d2-8566900044c9", "value": "0392aa966668f99fe783c0ba6bdd509a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791165326, "uuid": "755b4897-2254-4117-917b-b9d62ee8bb30", "value": "98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmym:BMWKfU+BcUTHCCCfqCiUffnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791165326, "uuid": "55741d0d-5426-4b40-8d19-9a56b34ca79a", "value": 4812816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791165326, "uuid": "07a1531a-962d-4439-9d13-1dd562f01e57", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791165326, "uuid": "f533d7fa-0665-4a70-950c-684c17d05b7a", "value": "9fc2368188b4ea8c90ae7d8e4803170d873279b93f74e16b4d2f24a9525421a8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b6c2a4b-c0c6-11f1-927a-4201ac107004", "comment": "Malware payload (NetSupport)", "timestamp": 1791209252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791209252, "uuid": "546c501f-4ae0-484f-8b10-d7b9c630fa3d", "comment": "Malware payload (NetSupport)", "value": "5b9ab619b39fc68758680195fead5a29", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791209252, "uuid": "3ebdc165-704c-48f7-bd89-88afc0032b1d", "comment": "Malware payload (NetSupport)", "value": "9fea29424c093c0652a3c3e6dc22df33c1521745660f588539e33bfd533ec713", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791209252, "uuid": "9866ced1-53ed-4d3e-95e7-e38a342dfa1e", "comment": "Malware payload (NetSupport)", "value": "b2afb606d06af02b2bc907f0574dc6ded2dc6b3f", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791209252, "uuid": "cd26a2b0-a4c3-4fe8-8514-6bbb9627afbf", "comment": "Malware payload (NetSupport)", "value": "15146fa47ea9b2fb04e76f8ef13147236f7a8e9e4ec727c28ad505c42cb894dd86ce7995e59f3df4eea76023c85bc481", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791209252, "uuid": "e632896b-7502-43f5-9467-35a170382367", "value": "T15756176CE55C0E19F1B9E47C40FDC62CC32C9D309D10E62A74AA96A469F318B27DC79E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791209252, "uuid": "88400f19-be1a-4dcc-a80a-70e8efd6317c", "value": "61fa20e04a6d92b332b9552404fa2577", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791209252, "uuid": "df46858f-91b3-4e71-8032-a2018d9e209a", "value": "98304:v0bp82+qQ41+e9lizUf8mPO+qnooooooKOULo:v0b+qQSHqzm2lnoooooo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791209252, "uuid": "8e02ece0-568c-4662-be47-aa57f9772aaf", "value": 5999104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791209252, "uuid": "b743723a-8f73-4be1-9feb-580dde919300", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791209252, "uuid": "00bef712-92fe-4824-8148-777ed93fba9e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abba23c9-c0e8-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791224097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224097, "uuid": "6cb7f4c5-85ff-4dcc-b922-6fafbd36487c", "comment": "Malware payload (Mirai)", "value": "3a7d0da7a305b872d0da424cc34ebcc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224097, "uuid": "b41e3bfb-0f06-42bb-9ae4-790a797c67f3", "comment": "Malware payload (Mirai)", "value": "9ff17408d16c03c423c04609e1e7f7bfc23dde8b60eb1b0b298d5d4de6b07b46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224097, "uuid": "a07242d8-cac9-4b43-bf29-d651bc998836", "comment": "Malware payload (Mirai)", "value": "77c748aff087b28e0326cb6110ae8f6010171c6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224097, "uuid": "8c282975-d5a6-4e5a-9b53-14aed3d74ed4", "comment": "Malware payload (Mirai)", "value": "6017173d0ab3cf7c5649eea4ba81381d0e585c7b5065ea552841c952ce4dd8457b041965def6152d04202abd64e62be0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224097, "uuid": "f3221f21-6919-4570-befd-aea2ed7bea05", "value": "T1436302609D282D58D69467B7FF8691CE4A428E38E18D785744F953EC3318F287762BC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224097, "uuid": "7ec70827-8474-456e-83c4-b69d657ed321", "value": "1536:gtNPBD4LXs/8fGvsaDLS7EqS6FLduUgWIFGb1CVcRATa72DdgFA4tDP16UbQ:ID4Ds/qaPmdfwpF1cRAa2DCAE6uQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791224097, "uuid": "4029dbd3-8877-48e1-ab90-8609c6645be1", "value": 70896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791224097, "uuid": "3994fccb-70d3-4092-b083-73d4d8b37c56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224097, "uuid": "48daf3e9-713c-4ad4-a3a2-a84760e41258", "value": "xnxnxnxnxnxnxnxnarmv5lxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97b4bdc-c116-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791243957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243957, "uuid": "f78396e8-2d77-4b60-9285-1a1dc24fdf9a", "comment": "Malware payload (Mirai)", "value": "0d0e1807cc4cf6f05343b5f4a6b05498", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243957, "uuid": "b6bda8ff-8d46-4d39-8c29-5b27dbd4935c", "comment": "Malware payload (Mirai)", "value": "a001b03265da510b2c8b5f3cbc85e8690c7d19113da7eb0ff528cf1ed23e998b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243957, "uuid": "367a3e5f-ee95-4a84-b5d5-5532336e2b84", "comment": "Malware payload (Mirai)", "value": "fd0e898fac6e9a882620eb1a53062f6efa9aad2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243957, "uuid": "d7f6d61e-c4e5-4c7f-bb2c-65fdb4e7fc0d", "comment": "Malware payload (Mirai)", "value": "058210ff774449021a975c92c817a896497fbfe2bc3067650678b099e4b7da6ec3c463c35e2c5b1ce4d8ef3b8a9ad396", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791243957, "uuid": "ffedbe36-306d-4f5e-a766-80b22bfa190e", "value": "T15EC4AF43B77A1490C8E6C4B865E207FC8957428B56F7E1DBCF4A99D5B926481333C3C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791243957, "uuid": "c8245d01-23a4-4d36-b283-8677bf665fed", "value": "6144:BR4yYSm5/aj/+DNaj67Bstag2i/DCnhcIMIB9ELdZil25eDCbMVeiJDWAAq:Bh44+Mj69Iatiuh3MInEbTb8JD3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791243957, "uuid": "1bfe4465-2ab9-4be8-beab-8a232350b6e9", "value": 550828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791243957, "uuid": "7b0bce07-66ed-4e8f-aabe-e89a43e0a9c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791243957, "uuid": "c2fe27c1-f4a1-49cb-b26a-289e70aac22a", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32d3180-c07c-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791177804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177804, "uuid": "b5325172-1ebe-4589-a6d9-db1d88394b61", "comment": "Malware payload (Formbook)", "value": "0ab8080fb2028181d7241e824d569cf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177804, "uuid": "bbd34981-89ca-4b92-9f11-8aed4d4c7a9a", "comment": "Malware payload (Formbook)", "value": "a0aaff2946ba2bf57f5e94c081bf289a8ddb7f2edee21ba0be9796c769946f76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177804, "uuid": "3a6e8a58-3fb8-4b78-973d-fb4fef5095c7", "comment": "Malware payload (Formbook)", "value": "ea3fd1dbcc5800814033fae89859a62973bfc6cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177804, "uuid": "94ec5e5f-83d0-4b54-9311-37421528f24b", "comment": "Malware payload (Formbook)", "value": "45f3e01b917018a9b99da10f897af0bf2947e3fcfd1f8a2b09b85139dde4806cb078213f4f790176525ca7210af6f368", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791177804, "uuid": "0dd055c3-e2f4-477b-9128-cb2d08eaff74", "value": "T16715F114335ECA12C4A957F41D30E6B807B4AD6DA421D3078EEAFCEF793AB5069142E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791177804, "uuid": "aabc7334-b68d-480c-a611-25a39a9ca914", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791177804, "uuid": "6830f6f7-753a-49e6-957a-24f57f722d5e", "value": "24576:aR8EIDoc1Gz2baGiBn5of/UFmueqhXMaA/ngyJIMLl+ZB:MDID/C2sCf2mueevA/gyJIUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791177804, "uuid": "9e6e6d89-5460-4086-b30b-3e30173795fd", "value": 935936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791177804, "uuid": "88f387bb-ac03-4684-b31f-6d6f4bd26022", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791177804, "uuid": "5f8ff90a-ed50-4262-8461-9f1418492f0f", "value": "FLF7997_SHIPMENT_DETAILS.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6346b0-c0e0-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791220583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220583, "uuid": "528409e7-7718-40e5-b509-6ac965bf3deb", "comment": "Malware payload (Mirai)", "value": "97288705c37dd1867d66125067ee12a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220583, "uuid": "e96dfdcf-2604-423e-bd08-cd164fc2a18e", "comment": "Malware payload (Mirai)", "value": "a1761b26bdcfacf63411793919dd7a850f51c07be1173d26117624a656ccede9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220583, "uuid": "4d2ebec6-c5f4-495a-87ac-a4e23a3f279b", "comment": "Malware payload (Mirai)", "value": "bd7e1b24ba9987f508de21e1250df569dc58833c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220583, "uuid": "5cc86593-5af2-4d65-9a7d-b64450a2c4bb", "comment": "Malware payload (Mirai)", "value": "80b20bca91f115750b62bd066dc55a248ed940df9ebfa4f0a7d16d34eb0ab634f069ce74dce6c508fa4faba076078a58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220583, "uuid": "036c757d-2b86-4f86-806f-a5997dadefe5", "value": "T148D46C16BD919B91C6E24ABBFB9E4368731757BDD2FF7006CA045F903BDA4810A3E241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220583, "uuid": "cfe01e60-b252-48f3-9818-882c805ee3dd", "value": "12288:q2io6tL5UQs7cclDYISJKvCkPYHZiML8zAPcpy/HMIPFe:Ao6bo7cclDYISJKvFsLHMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220583, "uuid": "598f5482-dff5-4f88-905b-952c38ef6f68", "value": 625928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220583, "uuid": "0dfd237a-a409-4b22-849f-028fcbf7ba43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220583, "uuid": "3056f1bb-1398-4579-b12b-1b1d566b2139", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380a89eb-c052-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791159478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159478, "uuid": "4df4276f-8262-45e4-935c-7e4d0260a0f0", "comment": "Malware payload (Mirai)", "value": "d11d12b0f00728af2807dd2b2f5eca28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159478, "uuid": "cfd34231-b225-4109-8d9c-8b9f545179ee", "comment": "Malware payload (Mirai)", "value": "a1b9cf98985d4b1a3b571828bfec90ab03727a9c43f88adfe58d096dcb8ec568", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159478, "uuid": "00e49785-98d2-4fc1-9506-402376672e53", "comment": "Malware payload (Mirai)", "value": "834fd683110eb53c6b0968d3614f7329f72a9dc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159478, "uuid": "0813985e-fa3a-436f-ac35-674ceadab054", "comment": "Malware payload (Mirai)", "value": "269c94b9bdb596465acb156622b13ef40f3a11d2d4895b9650db4953f02d756516662df081bb1acf568bcdfd4b0c146d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791159478, "uuid": "9b4d27fa-dbd6-44da-9cbf-978adf089164", "value": "T12D047E03B0033F1DF0D21A3A426E5FA53FA891D76B720D969251A5E76BB32B02E5DC71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791159478, "uuid": "1c189c06-e4b6-4321-a6a8-fe7ea065afd0", "value": "3072:M7A/mGYNJ/5VpJjETWqxE8eSuD7n7iMHm08TS41pkQE:M7A/mZJ/5VpJ4fE8GRH38TS40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791159478, "uuid": "8ab46d4e-be57-40bd-8849-2c70ff0f7281", "value": 174288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791159478, "uuid": "db1f688b-3c65-41b3-81fc-e5b413ec7278", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791159478, "uuid": "be6998ec-2e7b-4606-9da7-88e1893d1fc8", "value": "kushnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67d8871-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791182051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182051, "uuid": "2b9b0de6-8a56-4c06-abc2-ac90df3e5e69", "comment": "Malware payload (Mirai)", "value": "6881b227c648a58b33cdfe720e5c9ef6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182051, "uuid": "f58c5bb8-c7b7-4109-b501-1121c1fcafc0", "comment": "Malware payload (Mirai)", "value": "a259a30a105c4ecc225b3457ca9f9859207cecff382d5d24919b316fa552d847", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182051, "uuid": "20801e6a-2a5f-4117-9930-5a545ff44fef", "comment": "Malware payload (Mirai)", "value": "1d7e8e13959c01b0750b982d5925b7b2631d9b8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182051, "uuid": "aef147a8-2dee-4c77-9b1f-640a8107a6c3", "comment": "Malware payload (Mirai)", "value": "c5a1f307044c835f046c9d83dcb181644595da0b3041743a1dc613ab89b1918224597fe4debec0f5d6281c3ca0486b07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182051, "uuid": "9b1b50ee-9ba9-4810-95bc-f474545815af", "value": "T1C123E8C57882B639C3D057BBEE5F014E330497DCD1EA3357C8281B94BA8A94F1D66B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182051, "uuid": "398481ca-4c21-4cdd-8700-0b979791e8b9", "value": "768:oMjcmSayWpShJu7RvFZS1uM1LnjvGDoCerCGyR0rCf6UkeSU7wCVy/rCxHghW1/y:MmyyShJ3FjvuR0rCS9nvhW75EtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791182051, "uuid": "39a47a9a-9e52-4b0c-93b6-0031712b534c", "value": 49496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791182051, "uuid": "f5af4d05-00c7-4d43-b1a8-8d9fa6beadd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182051, "uuid": "8dc9d6f5-ca85-4802-bc18-da5ddee35ba1", "value": "87sbhas6as.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b275cd8e-c0bc-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791205210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205210, "uuid": "c413f4d1-779a-4fc0-b486-578b4f2fd058", "comment": "Malware payload", "value": "9d423c1b260c7bbbaaac4b176195e36c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205210, "uuid": "c1d91419-306e-4cfe-bf45-9e005270bc74", "comment": "Malware payload", "value": "a3215094193808969522b6d6259ffb67a0dbdec5fdad09e9c1abaf2b858f0d50", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205210, "uuid": "5f407207-bd0b-4040-8de5-3d4cb68cb14c", "comment": "Malware payload", "value": "830e2a088fbcbca30ace090bc21908cc47cf3b72", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205210, "uuid": "6080b42f-8bde-4f12-b9ea-9bc1a3b689c3", "comment": "Malware payload", "value": "ab5f5808bc13b8fcef3c5e61ddc6203f7a8b30df03b9243b8187ac340738119acc72e2c77754188c1a0940787b292856", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205210, "uuid": "68d491ba-4f43-447e-93aa-3e6108bc3761", "value": "T142465B27DC28AF36D00727E94FF65E52F51FECE9E3935484C618A982D255EC307AE1A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205210, "uuid": "820bab23-aa07-45d9-8f68-16ce4c734407", "value": "12288:x13Bved9qmiHRtN4YoJXvKe7ZQyVpr1y0BAoFLvOf+Io74PGtSNJFOoS+Sc3ayzn:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791205210, "uuid": "b2541eca-865a-4bc7-8ab7-4f3482232cc9", "value": 5496622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791205210, "uuid": "d93e0e00-a741-400f-9aa7-c6db05e1ff1b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205210, "uuid": "66309f28-ab30-4ad0-8327-36959c7198dd", "value": "z29DraftFinancialStatements-25-26.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178a3b0a-c0e1-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791220842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220842, "uuid": "06794894-0070-40a1-aa0a-505420590cd2", "comment": "Malware payload (Mirai)", "value": "0aa3c89defa55b7c6e653f9be469d2dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220842, "uuid": "7a6a6649-63cf-4a35-a946-dd2d69bfec68", "comment": "Malware payload (Mirai)", "value": "a372daacaa756ebbdabbc29b5aed3cb61fcb2bf07066da0a7a828ab1d6a324c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220842, "uuid": "032306b9-08f6-45e1-b2e5-82f9ed78b2c5", "comment": "Malware payload (Mirai)", "value": "1bfec3f133311c38c570951df9aa02f3bbca3630", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220842, "uuid": "4bbd85aa-dbaa-4220-9bd9-249f66a99e19", "comment": "Malware payload (Mirai)", "value": "d5a359b8c08cb7fb77a13bb160ab30be6fd9db3778c97121d744afcea5346fae4ede223d5e347a2f51636aa563696ee1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220842, "uuid": "bab03b99-f991-4af8-af92-54c6a159ae39", "value": "T179C4AF43B77A1890C8A684B865E207FC896782875AF7F5DBCF4AD9D57926481333C3C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220842, "uuid": "88f39dfb-c0eb-405d-a402-53f4eb9c93f7", "value": "6144:SoLkyhpFyjeStNaR69WNmclCvP/0l1MW97JflicE4BOT52vgCPDeDLzAAq:SqN4iR6Q4c4vkHMW99Ni47VqLUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220842, "uuid": "333fa6cb-5f91-43a7-8cd8-c31a2cc44a4e", "value": 550812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220842, "uuid": "48398a5f-772e-471f-9269-45033e44c652", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220842, "uuid": "31bb0a29-8db5-462d-9950-8749348a8d9d", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccdf711f-c0df-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791220287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220287, "uuid": "dbc29ab4-de6c-4724-8e31-57b95d7c8f2b", "comment": "Malware payload", "value": "bf06c094fbc270b1821e9a05faff37fd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220287, "uuid": "18c079b2-a35e-4aa5-b423-c07edb7c204a", "comment": "Malware payload", "value": "a3e2606163418a34dcd362f34667c504e9495b74c51ebc7949960b827f18b5f3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220287, "uuid": "680fd430-a68e-4997-80a3-6d888693ebdf", "comment": "Malware payload", "value": "d751356be16ec46a3f41e68f1da24d96088d1d22", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220287, "uuid": "379e5127-ea0d-42a2-9a84-37804a2e9784", "comment": "Malware payload", "value": "4d966081854048b14df8e1526ff4268d95aebbb10ff1381b392be3add7ca29a0cbb2858e59fdbaca3f7099e790b6bc70", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220287, "uuid": "086c74b1-6389-43dc-be5c-4b80b78f121b", "value": "T1F66618136B28FB0EC22861344CB2DA9467692C8506D79517B791F31DF9F20AC9DAEDF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220287, "uuid": "06f3942c-04cf-4594-b613-f0ae838dcf5e", "value": "49152:11IywjxXEuGb8d4OtGskKclmvwpYfUP8rcNlxLcqclxGw+sXAjHHEt5EH:7KbwHNDcnt/QjnEjEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220287, "uuid": "e054193c-9c9b-4fe0-b8ef-0226354e4422", "value": 6619351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220287, "uuid": "6df17cb8-6a2b-48ad-a7bb-2953d68e694e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220287, "uuid": "b517c398-bb82-46d2-9f90-948b07655dd4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b51617c-c068-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791168959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791168959, "uuid": "960dcfc6-67e5-4cf2-820d-7e415266934a", "comment": "Malware payload", "value": "eb3439675d0b66c9c76c930948300059", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791168959, "uuid": "1a6cb932-e250-41c0-ba6d-4c8c9cfac45b", "comment": "Malware payload", "value": "a43c876139e949c497c70df6c23bd12276befd246ce8fd91915829dd6456c12b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791168959, "uuid": "447be43b-c0ea-4c28-91b3-d6f640f448ae", "comment": "Malware payload", "value": "a34971e4cc2528222766da5b5229929f9bfc2b21", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791168959, "uuid": "bfe4bf42-6c5d-4329-a3eb-b5c9b0d5e8a3", "comment": "Malware payload", "value": "17736b33da5f88ee8ef788c8ca57d201de7701a96574dfad907641e7384a3de2e28bd318d490d06d7ce4edc538394f9e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791168959, "uuid": "1378d05a-a567-45e7-bfa6-1c2b73310f31", "value": "T15DB5998A1748C891D85BEFFF7E31E2E0E1197DC6C3C1299DF754B53CE888525AA88781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791168959, "uuid": "6440f074-57a4-4b30-b421-5e373a79ed60", "value": "12288:E9UgExyD2SagzMZNkICRZUZpxOBjkVUzjxVnMFht1tcjvkE/eJwdLoDr0vvOWoVg:Q+bhBT+DGtgLble8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791168959, "uuid": "54f588b6-a7ba-4ab1-be12-377f1b02daab", "value": 2300975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791168959, "uuid": "29ff974b-b6fc-4281-85e1-e74dba573394", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791168959, "uuid": "6032f510-1d7f-4193-99ca-7c60c4e50369", "value": "a43c876139e949c497c70df6c23bd12276befd246ce8fd91915829dd6456c12b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baabe543-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791190621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190621, "uuid": "a6868014-a942-4e89-a7df-0178d6c746c9", "comment": "Malware payload (AgentTesla)", "value": "b0a658c2d34403faeaa2b14b42917901", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190621, "uuid": "f03fa39e-807a-4ad5-903f-367d502b0a57", "comment": "Malware payload (AgentTesla)", "value": "a4a239a142be13a6995dc9d270ad25a93515b67395b815324b0e92e7dc43c142", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190621, "uuid": "0358c4da-e1ed-4e87-b844-d620661b936d", "comment": "Malware payload (AgentTesla)", "value": "227ee910230f9ac00cff314d5e26d3643e09612f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190621, "uuid": "2f514557-bd74-4903-96d9-d5f71de375cd", "comment": "Malware payload (AgentTesla)", "value": "28be3660bfe146333880368c7703e5a0bda82344691314886a1869090c9eaaa9da1b7a5ea3b6ac6cace02ba712a310b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190621, "uuid": "13cfc64e-62d1-4a4f-a8d0-b92483b6f322", "value": "T15CE5D4691350903273256B4C82369D3096EA724334C6CF3871ECF219BB5ED67736ABE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190621, "uuid": "8adc273e-e2e2-48ae-a057-eaf09a55a09b", "value": "98304:niHJBLkRVBkl2LMh4Gso72ixrn3P7Bu5n9nX25LXQL2qIEbz:iHPkRVBkc+4ahBMRG5MoIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190621, "uuid": "1e86e023-dfc4-477b-91d8-7c9bbb195e71", "value": 3241546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190621, "uuid": "c841c958-0fb7-4d75-a421-4ddade46fea1", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190621, "uuid": "577a8ea2-a9bf-4e54-9eee-30bca6b9bb79", "value": "New Quotation 10124644.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699aa884-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload (MassLogger)", "timestamp": 1791216255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216255, "uuid": "6f089009-241a-41f6-b36e-b39f2aaac7b5", "comment": "Malware payload (MassLogger)", "value": "10ab09df2fd29cfe08124bd4928ffcab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216255, "uuid": "4d7db4d2-3cdc-434d-aff9-a432b2828e38", "comment": "Malware payload (MassLogger)", "value": "a4bc6811c27dd4089c59cd0230a79480fd185a98bf43462816d7c3dfd87e3640", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216255, "uuid": "eeb23a7e-ccf3-40ad-bb89-9d5f15995374", "comment": "Malware payload (MassLogger)", "value": "e15532a9645dc4bc944b0c4ae8fb4510142db21a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216255, "uuid": "96282d23-8d31-45b3-b7ff-ec64d5a3dcc6", "comment": "Malware payload (MassLogger)", "value": "ea0d01b94bf26b71ad5e8ec3897e902775e25527d368515054f999d9eb2e9756499de18e6301f284ae1fedadc9bf3855", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216255, "uuid": "857bf62c-9ff9-4b87-87fa-1e6790fa8af1", "value": "T12205D02832E48E02E03D577989B2E27423F42D5B9516D70A9ED8FCEF3D217D65E09683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216255, "uuid": "7bd57e64-d432-4e5f-8a05-91714b0882d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216255, "uuid": "26e1f941-7fe9-4585-b52e-5807152fd81d", "value": "12288:XhVpdocAH4KV5ek0hmAWWhAaQzg+G6Qd3HzzOVSIGatL1sL9xKw:X5daH4KV5ekbAWRz37mHHOceV1sL98w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216255, "uuid": "d9a842ae-cf52-4ad8-8be5-7ff00ccdac8f", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216255, "uuid": "d9f36abc-d290-4227-8236-264b57e655d1", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216255, "uuid": "e3143418-c283-4ecd-9f2d-efd1fd57fbc8", "value": "a4bc6811c27dd4089c59cd0230a79480fd185a98bf43462816d7c3dfd87e3640.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f6b2140-c0df-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791220049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220049, "uuid": "86f6ae1e-3ea8-4b89-b0b2-24796ce740ef", "comment": "Malware payload (Mirai)", "value": "c9954acc37a0b0922771f8f4f0322525", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220049, "uuid": "a8a202ab-9856-4023-b0de-101bd8d05bf9", "comment": "Malware payload (Mirai)", "value": "a4c541461fb43666901ef0b857902d8ff393bf6a26aef748d27f724e7f81f789", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220049, "uuid": "a2c9cda6-7bff-43eb-a918-a9b526a92fba", "comment": "Malware payload (Mirai)", "value": "1485f8a8a609fa8bbcde22d5ea32b53007dd3eb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220049, "uuid": "31da87d1-d753-4b65-9cec-85271ff1c5f9", "comment": "Malware payload (Mirai)", "value": "075a4e53e8a4098ddda6aa2aed4dd2ca229cd61e65c93229caba7e94097e9de0e12541382363f192660138fae14716be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220049, "uuid": "d400f2bd-329c-4665-8f9a-70d41d93b4e6", "value": "T1430472ADE7A19EB7DC0ECD3381D94503108C956A42D9AF6FB2E6C518E78BC4E04E3D94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220049, "uuid": "095931f9-20ed-4a31-b2dd-d3e4611b94b0", "value": "3072:mO3nOaY67sB/hPCFLTjaFgD/pSceS8a8tC5:mlTpPALTvD/pSceS8a8tC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220049, "uuid": "c2aa19db-3954-49bf-8f44-6c918a2839f9", "value": 190090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220049, "uuid": "50a87d0f-2c2d-4522-b08e-1a5ee8968de3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220049, "uuid": "7ea75a7b-c071-4331-b4ad-a4202e9ec0cb", "value": "ntp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1caf7795-c113-11f1-927a-4201ac107004", "comment": "Malware payload (Expiro)", "timestamp": 1791242325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242325, "uuid": "30cd90e0-6b51-4825-8cbc-d8aa8fc39cd7", "comment": "Malware payload (Expiro)", "value": "79318a5d4d52bc0ff30ee4bc4e976815", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242325, "uuid": "e7356a81-21d5-4ad2-b8ef-8f3a882d01ad", "comment": "Malware payload (Expiro)", "value": "a525c76919698b097df01e31958a58ad700c2faaf0d927961b67c5fbb7f67069", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242325, "uuid": "7c999d49-1cee-4acd-85a6-e37fbcb5a6a6", "comment": "Malware payload (Expiro)", "value": "96bd51719ef4652428aed167051a5cb4b7ac7bf7", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242325, "uuid": "bacd0252-3546-413f-b96a-c7cfd5293f57", "comment": "Malware payload (Expiro)", "value": "dcf17c4277c1c889da83368bb6d0ccaf14295cccfc6b923454569679c7b332b055789993a25ebafd8e9aefffe39f447c", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242325, "uuid": "836d0f3b-11ec-4ff1-88bd-31f1ab2b591f", "value": "T1073633A8A22CA1FCE0550DF440A3C92EB5773C69ABB94D1F9BC085BB0D53F5A9FD4502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242325, "uuid": "7656f2a1-5e53-4c9d-90a7-17797a8e3f12", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242325, "uuid": "468531ed-64ec-4925-8e9c-91f08d6a4d91", "value": "98304:DDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HED527BWG:DDqPe1Cxcxk3ZAEUadzR8yc4HEVQBWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791242325, "uuid": "e5e37ae3-1a7e-4aae-befe-82297374d45c", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791242325, "uuid": "f9efd45b-2a08-4403-bab2-779cc7d5a862", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242325, "uuid": "d4b1b407-c8d7-40f9-ae02-22ce7e061280", "value": "mbupload-8g0nwl8h.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbaebbbc-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181657, "uuid": "780ea918-3c59-4983-8289-0b9eddbdb19a", "comment": "Malware payload (Mirai)", "value": "aa51800955137b7f503c6eb1069af894", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181657, "uuid": "99003d99-3837-4354-a5ed-a207ec84ff1b", "comment": "Malware payload (Mirai)", "value": "a5f37ac87958b3352100d56c0ab8bf6b6b83098946a2fc0af5ff021c45675ddd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181657, "uuid": "5c09641a-a9ad-4cc9-9773-61315f1476a8", "comment": "Malware payload (Mirai)", "value": "4743fef3c2e21624dbd3a584578d82c9858447cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181657, "uuid": "87f1ad65-6b53-46a8-9f67-91670098a9cc", "comment": "Malware payload (Mirai)", "value": "5c751b9e34e737bdd60080d2769ee67e13f0a3d679d01370a339db8024ea0fdc917f9c52fa3d7c0e72bf6d429795bfba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181657, "uuid": "29e0a0b0-d660-4baa-811e-73d3fffefb7a", "value": "T188333ADAB902AD7DF98BEABE80170E0AB23123541053073777EBFC937E321549956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181657, "uuid": "b101ec51-a380-43dd-8b66-4d5f02fcb098", "value": "768:mLGOe2kf9e9X9nberzI2vcv/QP3w5gFHviPuzWeHXpi2UJTMDnH638gV:mL/4f8F1eB0ApFvimzpZi2UJanHY8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181657, "uuid": "21acc960-7896-440d-827e-1a13bc0b3646", "value": 53056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181657, "uuid": "56d01bc2-3896-41dd-b2ec-854c0bce45f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181657, "uuid": "b3a52802-279c-4770-bded-6e7755c7c9cf", "value": "87sbhas6as.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc2b4df-c073-11f1-927a-4201ac107004", "comment": "Malware payload (VShell)", "timestamp": 1791173632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791173632, "uuid": "50338a87-6433-4c49-b67d-267ed119400d", "comment": "Malware payload (VShell)", "value": "cec4f5da1c578aa3a9e08523ca436aea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791173632, "uuid": "2beb2097-e00a-4605-ab94-b71e63b99a98", "comment": "Malware payload (VShell)", "value": "a61ba4f611fc68f33bbd445ab53b7d8d3fc373746d99ae264d77961a52a071e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791173632, "uuid": "0be97472-f18d-4382-b242-1c8dd1c8b396", "comment": "Malware payload (VShell)", "value": "48fe88c9b066b832a37d600dff06ed2477ac781b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791173632, "uuid": "0bb3ba46-ed22-41f1-b409-5225f5f0f4ec", "comment": "Malware payload (VShell)", "value": "581a24652e5c079b6192d1fccbcc03683944423f65f584a0791a332550172cdd94b97c822818fbb38515d180a5e7e4bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791173632, "uuid": "b8cecf45-5ce0-473e-bf4c-3b93a790caf0", "value": "T136715088F3136EF1E42C46F901D3A664D0199BBCC150BF4D5E60281D3C210BA259AF96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791173632, "uuid": "15ceebdb-46d7-4ddc-9e93-fc6992dfd837", "value": "e82dd51b077167be63c004bed23d0c1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791173632, "uuid": "32712046-f4cb-477c-a4da-6b71bb3c7322", "value": "48:6Icwm03t2WVJ8zrD7TLjpSpc1ZsSYr8XxhxhwcRaK:4j+tnSNSYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791173632, "uuid": "5c407f26-f6dd-4336-b0ef-d559d2d34e28", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791173632, "uuid": "fcb49889-48dd-4263-8f31-9289f3370343", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791173632, "uuid": "142f7098-0e7f-412a-859b-52985787735c", "value": "a61ba4f611fc68f33bbd445ab53b7d8d3fc373746d99ae264d77961a52a071e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "431d442f-c0a2-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791193856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791193856, "uuid": "9c6bf238-1967-438e-af4d-4117eda975f6", "comment": "Malware payload", "value": "223cbd96e18255fed709003c93e1685c", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791193856, "uuid": "b2496d98-6018-41b9-a48b-2e01993c31b3", "comment": "Malware payload", "value": "a64187121eb5967440f7c9136c4faa2800dd41ede8181b0b4af4f044f1891cf3", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791193856, "uuid": "67c1b95f-754c-4d53-bb62-76cb9ab27def", "comment": "Malware payload", "value": "d792314811c80e4447cb4e6b258b6036e5e78102", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791193856, "uuid": "b2318e33-eee0-46c7-bf92-28acd9a9c2b2", "comment": "Malware payload", "value": "df70f2aa96db2787fd3d42a61def90c88e892c0149e4ff1459db72f6f9247616153dfce57a1470007873f113a5e06e8f", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791193856, "uuid": "246795af-0f0f-42b1-b130-527c3e28f360", "value": "T11332195CAED1A1B0FA1707DEA3AF24690228A0C7240DC484F94CEDE87F46BDD4A57B57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791193856, "uuid": "da7fbdbe-9d5c-4b23-8758-d1573ee0256b", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzNbqFtCVSQRUM:sXX+/DV7k/3IFt8RUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791193856, "uuid": "a755596c-6877-4868-96e6-74b0d5ffba4b", "value": 11964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791193856, "uuid": "e9083036-ce3b-425b-83c8-e2b7a38f908e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791193856, "uuid": "05b0537c-7a48-47b4-a507-3392dcccfd11", "value": "classcomputer.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b09ecd6a-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218951, "uuid": "d894ca8a-caf1-4ca4-9242-e8553601d02c", "comment": "Malware payload (Mirai)", "value": "7a405a838186d94dfa896607f581e931", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218951, "uuid": "d5b25f11-e897-44b8-ac27-28d0d293876d", "comment": "Malware payload (Mirai)", "value": "a6bd971bbdc847ee64ee1388c11040e1c2a84c75e9c5342f0e950818aa58435f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218951, "uuid": "337fa60e-4743-4e27-8645-7b6cde04f593", "comment": "Malware payload (Mirai)", "value": "67821b8772bec385c4e4a6db629b29065997809d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218951, "uuid": "a281392d-5a86-44de-b1ca-4bacc90cd7c4", "comment": "Malware payload (Mirai)", "value": "367e238fbf72f3da5074e6a976236106818d8db5032f2b866aacb15b47595d658e9d0f40d2a9f0a4fadb513d9c5dad6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218951, "uuid": "53f97f41-6c38-4f06-a6df-6f71cf0151ae", "value": "T155247D01730C0A43E2A72EF03A3F67E597AFD9A130B4B945254F9F898271E721589EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218951, "uuid": "abaa9ae9-640d-4ea2-b327-15b649c97b5e", "value": "3072:7BOvK606d25RI8ZHGTDAiKruCrhXKUIjxeJRU9WUyt2WA6D:cKS25OFfVCrh6UIjxeJRU9T7WAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218951, "uuid": "baa1fbf3-cddb-4e6a-a96b-de942611bc74", "value": 224980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218951, "uuid": "088ffeb8-e9f2-4c3f-af36-c2ece66fef4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218951, "uuid": "c79c13e9-0212-4075-aefa-0f831689f95f", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8629e305-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218880, "uuid": "9d959d8d-dd58-4a98-b999-cdbbe752bbef", "comment": "Malware payload (Mirai)", "value": "2ffca9ceb4e1f4770df513148b296bf8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218880, "uuid": "665e1b23-5666-4fa2-9312-52a8d7c4cf13", "comment": "Malware payload (Mirai)", "value": "a73af6704e4dbd1f034e54e94e24e6c0efc7b9e6c79bae36f1a0d538683143ec", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218880, "uuid": "89c7b78a-0ceb-4425-986e-da969c547fa7", "comment": "Malware payload (Mirai)", "value": "442808a55c7818cdf29a10e9c25ea9368fc8005b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218880, "uuid": "6e7cbde8-08e9-4ead-a1b0-e160496f9392", "comment": "Malware payload (Mirai)", "value": "afb04bbbd537bbb047cfbc2362d027ccf5905484bdf338dcfe01ff92c6cd31d27163d3765ce1d94d07967265390ba0df", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218880, "uuid": "cc8d014b-8ea5-42b3-9411-58cecc84b847", "value": "T1A6344BC7FC00DDBEFC1BD37B4527490DB230B76141521A33A3ABB96AED2A1950963E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218880, "uuid": "a91d304f-3347-4f6b-a818-98e0c4fb3c47", "value": "6144:DxhV39VtSUQZmxAIzxIDqykYz5bW57sxRWLI50z:1D3fQJIY0E0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218880, "uuid": "665336a1-d444-43ef-9207-929694a8c469", "value": 232576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218880, "uuid": "b5e023ea-da17-47d4-a5c8-089c76a9a05f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218880, "uuid": "55c85161-8e9d-4b93-9ddd-c2730e090306", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b3d89d-c04f-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791158513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791158513, "uuid": "7b6dea7d-62e6-4489-a33a-9db7e7e81a1b", "comment": "Malware payload (Mirai)", "value": "7c52dae94478042eb3a3fddf13c50bf1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791158513, "uuid": "43622074-731c-467b-a0f8-ffb9badc24c0", "comment": "Malware payload (Mirai)", "value": "a7997215ca6cfe70aa70cdb4225abc514e650307e6f6e2cf48a565d7b11a56af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791158513, "uuid": "14a1bbd9-99af-40c9-ab8b-e19c80888e5a", "comment": "Malware payload (Mirai)", "value": "2c4f6fca37906474bbe024d4d3682017a7e1f666", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791158513, "uuid": "a6d6d110-9b67-47fe-8a1e-24081579ac67", "comment": "Malware payload (Mirai)", "value": "2bfb774c9005f3258d280fbac916ebcf2397ca662588df865b251beaf2ad1cfff45338ba269be929518258fe86a7aa61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791158513, "uuid": "b54dac6b-a84f-4c3a-8862-9017134e1981", "value": "T1ED041846F951CE51F58012F9BB4D83D83B1303FBC3FA74029C195BB86B97A5A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791158513, "uuid": "c78a8fc2-6801-4ba6-bf01-587e91245682", "value": "3072:1AlB9PMR/viyca4txCUpDUHCFUe++ydb39LRo+WXQsBUJ6FDc8nQFUqd:SlB9PMlviyca4txCUXXkfWXhw58nQFUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791158513, "uuid": "2b5c67f9-f8b1-473d-82d3-73926c08a87c", "value": 190084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791158513, "uuid": "8660c330-0cfe-40cf-a5c9-7f35816ccba3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791158513, "uuid": "c166b7ea-56d0-4bcf-a230-fc8baff073fa", "value": "kushnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f369b81a-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181697, "uuid": "96fb414c-362b-460f-b729-0fe8d2bf9fe4", "comment": "Malware payload (Mirai)", "value": "a94d3bdaafe9c1334116f7794c8794c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181697, "uuid": "125960de-9655-4de0-8d80-9ffdbdc08a98", "comment": "Malware payload (Mirai)", "value": "a7baaf3b04e71fd47e1e528885fadfa27aa4ffca46e39a24fddf89f94f4bc11a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181697, "uuid": "0f6fb0d6-c239-4d1e-83d2-3b30f14debbe", "comment": "Malware payload (Mirai)", "value": "530aa7416b217b63108481fb424f0211bd5e232c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181697, "uuid": "b55221c0-8f23-46b1-9b58-33a29561ab81", "comment": "Malware payload (Mirai)", "value": "e55377732fc7443d4034a3404a0dbc92524b139b76e954ce4e50876db509ce4cab7a828013c4d9e0e5985e3479c5e8f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181697, "uuid": "70942d1b-a409-4228-aae6-8cd61de9c98f", "value": "T1D9B3D84E6E218FBDF768C33447B39F21A75933D626E1D685E2ACD5001F6024E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181697, "uuid": "d6386576-59fb-42cc-a900-6acaace9e251", "value": "1536:vfBpz4AytK+SPoH7Obrop5DfWZ+VcvV3TTj0LZuz8/e7GaUTCNetW:vfvawoHOYuV3TTiZuz8tT5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181697, "uuid": "9f179db9-6ed7-4fe9-9bf7-ec87cf7acc02", "value": 114328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181697, "uuid": "e81f13eb-bc06-47c9-8bab-ddee8f364a46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181697, "uuid": "56a574c4-1bec-49e8-a34c-df6b9331f99a", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e3f797-c113-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791242480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242480, "uuid": "57639463-ff62-4e49-92be-372ef7860885", "comment": "Malware payload", "value": "bc094b4cdd7d6e9e244db1df7bc6eb19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242480, "uuid": "20cbc25d-f9ff-4d8b-af53-73862d1d4a1e", "comment": "Malware payload", "value": "a7d94a2847c91e0d5aaf05577fb0c435a310b0e77b376a5d4eabebd4e79c1810", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242480, "uuid": "3359b41e-4b58-43f9-85dc-82734ecb3447", "comment": "Malware payload", "value": "79074c269ddbb9ec06cef88deb3b1e2be109dc1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242480, "uuid": "3e1550d2-57c1-447a-b358-8ea6c902e62c", "comment": "Malware payload", "value": "dff2b6ae3fe59e8063b99270a129e14057307536f369554df663d9c94265fd984b27ae0785203f0693931f81668bc643", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242480, "uuid": "81075726-6a9e-4bc4-9045-e59a08246b81", "value": "T147466B55FC1D6462D6C9B6752F6212D47339BC488F82C7232A24FB3DAAF63948F12271", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242480, "uuid": "e67a2268-b248-46c4-a418-805fb4a05ba0", "value": "49152:/McXT9D7ER+4C47im1wqW7fih+rF+dl7+OGz5EG:/McDZ7443m1wXl+nGFEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791242480, "uuid": "e6815d4e-0062-4568-834d-8949a9b9b3e5", "value": 5767330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791242480, "uuid": "dd76b8d3-83ff-402e-9810-75433f7aec21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242480, "uuid": "18834765-6976-46a7-b76b-66dd50457083", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6830ea-c103-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791235510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791235510, "uuid": "9d5766ee-5b26-4b28-96c8-41e1aec8105f", "comment": "Malware payload", "value": "650ca1974619ffc540fc107bf298feaf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791235510, "uuid": "be1bb8f7-4a52-42e1-833a-d05abab1a285", "comment": "Malware payload", "value": "a80369d59765adf23bad3b6b18e7f3c87e528e69581ff68cb4b575e8fe00e48b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791235510, "uuid": "1ace4cd6-f70a-4190-ac26-383de1de186f", "comment": "Malware payload", "value": "89245d0c5ef41af783ec76b661616842148094a9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791235510, "uuid": "09573800-62b2-4ed7-af03-cc7114ecb951", "comment": "Malware payload", "value": "fd91ae8b0dab53edcba6b061bd8938ced2ce3481d80ddfaa102f964c204c8fc7383987cec75360ad5dc5775ef2897f0d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791235510, "uuid": "3fe6edb3-028d-42c3-a268-e288f440c4e8", "value": "T118753307556CA853FCB242B48B8D63EEC6C5700A0ED49A6B4D794631CD4FFD84A3C9BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791235510, "uuid": "df6bff55-25e5-4a04-85d5-6ae0aee689bd", "value": "24576:K8ko7NsSDeiApAiF9UEOYlmgyzRdrtmKR0czPVmaf6JXgYdxWTq5zfPPn3RDQ8WK:z1ySCiApAU9ZcLtvR0EkaiJxdMO9P3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791235510, "uuid": "daa90598-8232-42d3-bcfd-55acb78fb79e", "value": 1566685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791235510, "uuid": "cf6a9530-eaca-4cb6-8a3d-32b1bf2ab97d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791235510, "uuid": "f3001001-b699-4773-9b19-57ce83606bc6", "value": "a80369d59765adf2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff361cb-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185932, "uuid": "2738c322-f7b8-486f-96ed-2790e5cac715", "comment": "Malware payload", "value": "71e69ea8099debad197477ddd782e268", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185932, "uuid": "6e799b19-3b0d-43a8-b0a7-e9118715615a", "comment": "Malware payload", "value": "a85f6d9c86c2b4e9453c8441d53416bab8775ad9739bac095eaab7947acb1fee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185932, "uuid": "1ec9c3b9-cd10-453d-befc-5797572586fe", "comment": "Malware payload", "value": "a3d95d60bfc6b7230cb91297c66c2f56fc39f3af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185932, "uuid": "1ad00532-bf3d-4213-ad8e-fb1cd45f11cd", "comment": "Malware payload", "value": "72efc7d7e6517cfa999d9427481c0c1172c5b4435b74c09a0ec376bcf99e790cea64fb4893da541eb6076cff8c071da9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185932, "uuid": "4c6dc8f7-5c30-413f-b68c-fb0b5e5fd126", "value": "T129E53A137B68DB0ED12522345DF1CAC8676A1C8942C2A617B349F319B9B30BC5E6EDF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185932, "uuid": "1f3bacfe-31cd-488e-b863-9faf0c18765f", "value": "24576:mj21w4eYUoLUF2IBjWKbq8p2B99KNUSXVyNUAMB3pVWeLoTtlPbzReY56NTqj7jR:mj21GcZWRCHeY56NTM+//8YXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185932, "uuid": "d1967b5c-b738-47d1-8b00-ff7db6fccfdc", "value": 3145885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185932, "uuid": "e33603d5-3fbd-45df-a71f-3932542b7077", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185932, "uuid": "11735810-8320-48d7-8362-0d61bb10b426", "value": "go_bot.mips.bak", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48903c30-c0f1-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791227796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791227796, "uuid": "045f8527-b1fe-465f-848e-d687de401da3", "comment": "Malware payload", "value": "2e6351ef2da8ee43766c18ccecabd24e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791227796, "uuid": "1ef43527-927c-421a-8088-d10de1a0c1e3", "comment": "Malware payload", "value": "a89c4656a0c978efe446704cf08de06328cd5e1d987dc145abb409a52b44d82f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791227796, "uuid": "07d82fdb-f1c9-40d8-bc18-de1b2d540482", "comment": "Malware payload", "value": "8f9ff0bdbfecae7daf2bf2679e5aa07743f07cc7", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791227796, "uuid": "41e82ecd-e240-4d45-96be-4e3e5f5f0400", "comment": "Malware payload", "value": "55c63ad38b63cc13c4ff4bf7cb4d8ad9170df6577247f66779b9422ba6a16286b635aa4dae1e32fd08db4190c2118004", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791227796, "uuid": "146c19cd-86de-4305-8a9b-a010fa808942", "value": "T1BD952322F1CC37F6C90F42BAB604D814293836768B127A6780F8579F5A5BBB54F49738", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791227796, "uuid": "c87eac64-cd36-4be9-bca5-b74143cd8084", "value": "49152:9a14f06LU1bFKK8k6R5XxmLy3e11BFxUl2kGwgwF:I14f0zbI7ke5kLn15xUl2kGD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791227796, "uuid": "3b9e3497-e609-404b-aea5-73ac3f7d319b", "value": 1881142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791227796, "uuid": "9e543e63-c0df-4faf-82d0-b1e3fcd9aad0", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791227796, "uuid": "0faebb1f-eeec-4868-8df3-723a6877e019", "value": "AmethystClientCracked.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcff8b8b-c0e1-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791221119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221119, "uuid": "7dd24ca2-46a2-445a-817d-a520a069045d", "comment": "Malware payload (Mirai)", "value": "9a4d6d39eb0e720b632fcb633bdc8b33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221119, "uuid": "ddb0c4a0-e532-4990-b4f0-a9ae6f12d023", "comment": "Malware payload (Mirai)", "value": "a9d02f241e146bc98805dc1a4d15d98c8ec178e4dc3f0d263322e1dea580c44c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221119, "uuid": "938142d8-5001-47e0-8f93-a1ed421ba00a", "comment": "Malware payload (Mirai)", "value": "44eb89e06676b40e924bdd10e1f73c5d328e3317", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221119, "uuid": "b2ec4a3e-e0ae-4005-a082-20ff25595fbc", "comment": "Malware payload (Mirai)", "value": "1df780835033291efa1957a4e277501714f84770c92d47068cc53ff99700d81d4478d0265a5c05a29bfc47e19eeca8f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221119, "uuid": "b47cf0fb-4228-43c0-9212-0f5f5d74aa8f", "value": "T1336409066B218FFBD85FDD3306F6871518CCB84326A93B7A7270DA5CB90668B49D3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221119, "uuid": "f9c5d2fe-5f6f-4d88-bec3-b4e88e539f59", "value": "3072:hMUyh2KxMKeOBaGniirwMuLu+lwxDxwUY3qZCpUpc5ZIccYi7g2+HxIW:stWOBr/rnyu+lMgQc5ZuDg2qI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791221119, "uuid": "fc61b5a2-15e0-4af3-b873-b7ec80b128f2", "value": 336248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791221119, "uuid": "b2777c5c-4653-4b3b-ab81-33514d4c7fed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221119, "uuid": "a17a527f-3003-49dc-860e-8ddd984f6740", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34286807-c085-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791181376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181376, "uuid": "81489174-4ac9-4719-a8f3-3b9d8ac26c0c", "comment": "Malware payload", "value": "09e6811b4636f6528e81984b975c72cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181376, "uuid": "a456cab6-a5a7-4496-b8f4-69898fdbf7c6", "comment": "Malware payload", "value": "aa8cee03b4d3548afd67414ec52427684c432fabdf4e0803d1dd67557458098b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181376, "uuid": "b4985d97-661e-472f-8ac3-08f5da899371", "comment": "Malware payload", "value": "a90514c382df4a98ae61a5d6c5b0b5ffb9949f70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181376, "uuid": "7249f0cc-314f-420b-ba38-cfea1fb60dd6", "comment": "Malware payload", "value": "b6be8e76c6249649345ca407e221fd4c7a11c22858711631679f6573a3caebd8be1860ba607a79b3817a7e10e29933b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181376, "uuid": "298b1f48-fb6a-4b28-9135-db1cb9671b63", "value": "T1BCB24D86FD414917CED11136FA2E828C37664BB4E2EF3307AB265F641746A1B0F3A545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181376, "uuid": "b38ad32b-251b-4f4c-a5d6-a0c20ebbf27d", "value": "384:Zi1e4fKN9F32SkSb1TGdAy31pB5SW5efRBjMeY/Fx4e:ZaePt32SVNGWi1jbQjMex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181376, "uuid": "f259d4a4-9236-4661-b61b-27e76aebd086", "value": 24600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181376, "uuid": "dfaab8f7-c736-4087-af6e-760027f77df3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181376, "uuid": "5c853aaf-7a46-497f-920c-4870788e7f06", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846a18a2-c0c3-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791208139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208139, "uuid": "e7d4edcd-fcaa-45c5-b664-3649eff5b433", "comment": "Malware payload (Mirai)", "value": "9098ecceeafb28637f1dae86d1fae706", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208139, "uuid": "d4c71778-e1cf-4e00-8a4b-5f647a4e572f", "comment": "Malware payload (Mirai)", "value": "aa92fb3015e189bd59372a0fb43708d6127f936e7a4ede2c424d906023e0cfbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208139, "uuid": "50eaa5c7-a2b8-460f-b30e-a284c4f04f65", "comment": "Malware payload (Mirai)", "value": "69e6980aa503ac8b506618936e1166008f00676e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208139, "uuid": "22aaedca-3618-4205-bc0c-df6756f64982", "comment": "Malware payload (Mirai)", "value": "9bb42389f53b9a0712cd970578198b4e2451b8d4db7cd22911410454ef582dd082b0a8f23bee3a28cc1ec960005ce2f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208139, "uuid": "8e1e72f3-232e-4394-b362-43f756b699a6", "value": "T10FE3F5CCED54972FC2D223BAF64942CF37351A789397F32159A7DAB42BC53481D291A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208139, "uuid": "8479bbcc-7580-4621-8f41-f00760feb9dd", "value": "3072:rkARBcCI0gu0gb2kqT6QSsSmaSXNiqSEVAmiL8qka/2agGpOFxqSe3tSbtOzFGNw:xoRN39MeuX3lnn9mDNAnQHqlR59v5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791208139, "uuid": "464c63e7-2bd2-4d4a-bd9b-9c1563168105", "value": 152160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791208139, "uuid": "192c064c-e8f9-4754-9077-93879248fa4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208139, "uuid": "a39694dd-15be-4e0d-a052-95e23e3a831f", "value": "aa92fb3015e189bd59372a0fb43708d6127f936e7a4ede2c424d906023e0cfbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f890f8e-c0e8-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791223888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223888, "uuid": "00b4858d-f7bf-4fb3-9d8c-b62183b88f3d", "comment": "Malware payload", "value": "218bc14cce5a93f6c848cba43f060c60", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223888, "uuid": "3e6fd927-9168-4304-b2e5-a49e91d131b8", "comment": "Malware payload", "value": "aaa2e8a2ba631becd8c0430dfd42bb96b83c21948ce3c293f019b27c92b022d9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223888, "uuid": "4d66a2b8-a78e-466d-ab4d-3d1249495561", "comment": "Malware payload", "value": "30b9bb00746c27a7f5ab8d6f06c3907bb588a2c6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223888, "uuid": "97684aeb-cf5f-4c5d-9639-2a1205d63fbf", "comment": "Malware payload", "value": "806fb3d27dbc58aaf7e9343b564c860341f34b90be91e76a1210ae725211f618fdb70f3822c1030d0ad328d3b275b60a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223888, "uuid": "4595fa39-6240-4ff9-83d4-8436cf4509bd", "value": "T1C1C4C01BA39364FDC117C17192AB5372F573F8151320AAAF6B54CF312EA9C504BAEB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223888, "uuid": "464a209a-1af5-4276-9a9d-ea605cff3c32", "value": "276e2c880ef6ec8b7e09cc179fa4ac62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223888, "uuid": "f1b12f78-0da4-44cb-8af2-96950cdfc1aa", "value": "12288:dQH9a1aHgPlAiVxDps+tjZoC0U0pdxq1QZjQ:dq9NHpiXNs+tqC0UmY1mQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791223888, "uuid": "a927f384-2957-4930-8b05-377eeee6c791", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791223888, "uuid": "3b471cec-bfe3-4a68-99e7-4061898a6dc9", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223888, "uuid": "a556e1e5-194a-458a-919d-5fa52c0c2b3f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c80fc9-c09e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791192334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192334, "uuid": "211e7acc-bb4a-4fc2-a462-3ab2c12f13ef", "comment": "Malware payload (Mirai)", "value": "0f1e239193347568ae8aa77171fcfb76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192334, "uuid": "703b3fb2-2ac6-46ff-96f9-632f50e81df8", "comment": "Malware payload (Mirai)", "value": "aaf17f99b04919e882e54a64e99d4209ce8b726427c8e7ecb0cb232361800aee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192334, "uuid": "cedec6f1-7384-4ee7-bf26-c1ae35aef7c2", "comment": "Malware payload (Mirai)", "value": "c661d4c0a907700958e91eef07a43fc13c41c1c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192334, "uuid": "e54360e0-73aa-48ae-836f-d08b828a6a93", "comment": "Malware payload (Mirai)", "value": "4653fd66802560aed3ab71a272eda6d57cde8b25b7abb2c269cc6641310ab912508e96ac297a6cf72056c276591961d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192334, "uuid": "b4786d6a-f9ce-45fd-8cf4-00762962c154", "value": "T1FD443C55F990DA22CAD0267EFB6E428C335B07B4D3EA7103DD149F2532EB94A0F7A941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192334, "uuid": "963cff7d-32d2-447b-ac90-d07ac9d6170b", "value": "6144:LhO6cHu5vv8Gan1KFnswQebOWIwh6kC5VY8cNRZrX1g:tNv8SswQebOYSVY8Cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791192334, "uuid": "97fcf9c0-e07a-4d11-b449-526c25ae52c9", "value": 255876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791192334, "uuid": "39b94d16-2a77-47f1-be61-137884412d07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192334, "uuid": "e6dd1659-a3fb-4829-8679-ef363c3efccb", "value": "6ad7962bb545eab3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6c35f9-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload (CoinMiner)", "timestamp": 1791216311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216311, "uuid": "28deb64c-7aa1-4ef8-95eb-3e25ecbd8358", "comment": "Malware payload (CoinMiner)", "value": "096622abc355ce5302f4154d45751620", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216311, "uuid": "ba7e9430-33b7-4d4c-a690-7226829ca3df", "comment": "Malware payload (CoinMiner)", "value": "abda1607910d3b8653aed50d74bf7e8d7189db192d553086a3c1b85a78bb7235", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216311, "uuid": "563e5511-d08b-43dd-979b-940249f41d6c", "comment": "Malware payload (CoinMiner)", "value": "0cfa7f7be36e8d4c67efebac3bc21ae4c89849e5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216311, "uuid": "b4bdbe03-9d5e-4b97-a7cc-8a2b6d0668b5", "comment": "Malware payload (CoinMiner)", "value": "af78b47f3086474bda6ccae7063996aa402fb5293f4e566c2a0a5cfa8e6cc0b48ae8886859d62d73e9e8b205dad8454b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216311, "uuid": "79d9bd63-64e9-4464-9291-6e2c6d45415a", "value": "T1D693290BE14610FCC8A9C577C53AA8339EB674040A2175BF77519F18EE3A7907A2EF85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216311, "uuid": "305299b9-b02a-4c30-97b7-70b7d7366dbb", "value": "ba87276fbaaee0970947784741cd11aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216311, "uuid": "e99b1ddc-b5e4-460f-9680-51ce47db9d73", "value": "1536:qjtmXi1tCEVe5k0fKSj+GzkQvSffAlUXbXk05jGxTh8Q99eFxPa/em8:qjtmS1tCce5k0fKU+Gr6ffAKD0xThaxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216311, "uuid": "622fd0ac-6b87-4392-86fd-1dd16e51a732", "value": 89600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216311, "uuid": "c61807a6-d4db-4563-ab55-872b3a86a892", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216311, "uuid": "0945dc02-dde9-4a69-93f4-0488038c757f", "value": "formatSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de251ce0-c09e-11f1-927a-4201ac107004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1791192398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192398, "uuid": "93b46e95-cc7b-439a-ba37-268f250e17f5", "comment": "Malware payload (SnakeKeylogger)", "value": "eefe6cb79e5b4f8d7e24bb64df290322", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192398, "uuid": "d6e8ff48-a6fd-4baf-a1da-ef36c6ff95e8", "comment": "Malware payload (SnakeKeylogger)", "value": "ac927aaf104545b1fa57b638a9ae8a7e1401b72095936bc8b36788fd2aa1c306", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192398, "uuid": "f5cb0cea-156c-46f1-8560-e6b6c0b6d2ca", "comment": "Malware payload (SnakeKeylogger)", "value": "6ab0a01813a53824fbed0ef9814221fd95b2410c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192398, "uuid": "f5926b64-8991-4481-9d56-c8535330a914", "comment": "Malware payload (SnakeKeylogger)", "value": "bea75ee79da8e9175a6baa451a039745a0ee1cf5353c186c4c685396b193d01ea6075d4dce0d142e172931a70ac71600", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192398, "uuid": "1ddafb31-096f-43b7-b767-adf9f7c48495", "value": "T1CDF4F148225FDD06C4A10BF40C70F7B95678AED9A920C3538AFEFEABB97A10535142D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192398, "uuid": "72adc2c8-6301-448e-a9db-af598ca7f7eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192398, "uuid": "f9a90fb2-48ea-43de-a5e7-e99a907d1fab", "value": "12288:yl7n4P0QDOc5xRbLYDs5vScYs0kAhqZIy2bRwga/gSSscruiyi+fg+09mER:MMDOc5xRfPSds0kAhFy2f1SSs7Bi+NOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791192398, "uuid": "8c2ec749-16f6-48a1-8a30-7c2f513765a6", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791192398, "uuid": "b896ddbe-86c3-4e39-8535-e1b1deb263c9", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192398, "uuid": "ddc109a6-737d-4cae-bcba-aa6a1c5eb4e1", "value": "Teklif Cetveli.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caff2510-c0df-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791220284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220284, "uuid": "46954472-7402-4bf9-993d-5130784ffcb3", "comment": "Malware payload", "value": "d0e2c66ad210a76fc682a450aab4e6ed", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220284, "uuid": "ca082453-61be-405c-b7a6-48196593714e", "comment": "Malware payload", "value": "acac55eebe395e335113c8bc77c5cbfd8cc2eb4c981a8d11cdd13d87a58d4178", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220284, "uuid": "d2f93339-1d44-40fc-aca4-7f8741ea3042", "comment": "Malware payload", "value": "0340b6e026ced6cb07fa560340328a6d935d3b8a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220284, "uuid": "daabdfe9-371d-41b1-abeb-488395e768c9", "comment": "Malware payload", "value": "d9ee11e8d373dd3264bebdbecc89cf2a7b107834760bcde4e37920a9eeba97d5d8e403ae5f84cbf6aa86f018bfd481d8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220284, "uuid": "81493b01-f781-411b-9ebb-5426162c9d68", "value": "T109561897B9925942C4E43A77BCBD80C433630EBA9B8652566D05FE3C3EBE1D90E35318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220284, "uuid": "5cc6ecd8-7340-442a-a5bd-9d023126baa9", "value": "49152:k38LCZaSeUfyHtJBW7lh9AprZCeK8YH5EY:qE0BfYSeUEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220284, "uuid": "211632ec-eae5-407d-910b-6fb9568f04a6", "value": 5963960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220284, "uuid": "2da9479c-9551-4831-831b-4aaada66c86d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220284, "uuid": "2d3bc4e0-d3c8-4bf7-9080-25fbce11f271", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7620a7-c0df-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791220044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220044, "uuid": "75809bc1-e794-43e3-8b3c-5ea84b6f0c3c", "comment": "Malware payload (Mirai)", "value": "c1f04da1a5cb3bf8808f7b9ce971e1bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220044, "uuid": "e47a513d-3845-402c-bb83-b24759ba4764", "comment": "Malware payload (Mirai)", "value": "ad258530d80b100202c2cfc9aa42e041cd0a66aaae92b78600c16a9ba999dd72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220044, "uuid": "bc859b5f-2f34-4795-8c12-e8e8d407b3f0", "comment": "Malware payload (Mirai)", "value": "724328752f2e19f3d2b1a6039f0cb0357386f0aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220044, "uuid": "197319d2-fd39-49e1-9eb2-7e1ec0615db6", "comment": "Malware payload (Mirai)", "value": "dd430d537026afda1f3bc1eb9404f99c8048bd1d6a3780717f347c3840235336fed2a02676fdedc89c085b355d67b511", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220044, "uuid": "7990def6-bd99-4fab-b9b9-6952db81be2e", "value": "T1A8B48E07E6B7E4B1D4A142B1215597B94872C9B3157BE88FEFE52C90DE64280F31C3AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220044, "uuid": "28af20c3-1650-43c0-bc66-43eaf741995b", "value": "12288:v0FG/YRdoDgLIVsVKBNY4nVTE8OZrVu/:b/YRdegL+IGC4nVT6rV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220044, "uuid": "9e99a314-7e0b-4497-84a9-223b884a9dd7", "value": 535996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220044, "uuid": "afc6398a-0141-42d5-b957-9dd7e70a4b48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220044, "uuid": "da35728a-de29-4ad6-b5f6-d80c9b42cb92", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed54cd5-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181689, "uuid": "0b77255e-d638-4c55-8770-b07910f69b12", "comment": "Malware payload (Mirai)", "value": "da62a52e31059f9aad186e2e899d297d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181689, "uuid": "a7d94060-e222-4ace-99e4-359cf2d07527", "comment": "Malware payload (Mirai)", "value": "ad50b49cdee827005b2eb6542c2faba011a6a7fc30d1802ecc70252867bd9421", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181689, "uuid": "b47fba23-2b13-4e22-9eac-13820c32f130", "comment": "Malware payload (Mirai)", "value": "df4e755ff68850914bf30d816023660c2299900f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181689, "uuid": "e7effd92-7cc3-4e10-be75-36b64384bd27", "comment": "Malware payload (Mirai)", "value": "9d6d5eba8ecfebdd52d7b23d61170268585240275d28e790a2bb371c232088bac212630d438dbb0428f0c2565f64ccce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181689, "uuid": "60c61459-24b7-4bc3-8703-ac7899100c00", "value": "T188735BC5FA87D4F4F89605716037E7364677E639102AEE82C779E932EC13940A61B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181689, "uuid": "0881d587-fb75-4bd3-afa3-d31dc1b4eaef", "value": "1536:voaqY7BHZWpIgxwaPr3aLkWbd3t1M4a0hsHu5FiSU4FyXb:gni5WpIgxwaPDaoWbd3ty4faOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181689, "uuid": "60497604-4b41-4c28-97ef-fdf97389b2cb", "value": 75440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181689, "uuid": "8036d6ac-5af0-417c-982f-808e8aed9dad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181689, "uuid": "34057396-3fc7-4937-a518-2fb7b8ddbe77", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "728e4140-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791216270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216270, "uuid": "9089ce2d-65f0-4330-b182-11bb8a754272", "comment": "Malware payload (Formbook)", "value": "36e73c5600a6c9ee9b1ae3d8f113683e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216270, "uuid": "ca82aacb-39d4-4f74-bae4-3321ad742054", "comment": "Malware payload (Formbook)", "value": "ad94161a022aa30896c1a8bcd8dbc85771295f860cbfda0926bfeaca9546f094", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216270, "uuid": "b82760d9-2fb6-433b-981a-9b559d1997c0", "comment": "Malware payload (Formbook)", "value": "4e58238888e17d1ddbc00b1de7e5bff740aaeeb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216270, "uuid": "55b88228-1e3d-4fae-9a51-ecea40b918a9", "comment": "Malware payload (Formbook)", "value": "00a1017c2b004973830769c5c15cb04d526c52ad1b8b547fcda1b72576145f9cc6d470ca9567ec6cb791b96b3c316532", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216270, "uuid": "5aa90f86-ceb9-4b3b-8b65-15d8904fdcbd", "value": "T1210501942264DA07C96667F85A71F17903B97EDEA420E30ACEE5ACEF3932F014D44693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216270, "uuid": "853ffacf-147f-4549-9798-7fe5592fe8e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216270, "uuid": "794b9d12-3775-460f-b08e-1c3838cde9eb", "value": "12288:LghmIZLKtWwplXG7GUujEXRE8f4gLDLDGaK5OUDLRHPb:LnhItGUujEXRffFitfXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216270, "uuid": "3f05fe26-ac67-41a7-878c-7e658e95a29f", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216270, "uuid": "c86abab8-ac45-422a-812c-a1473a30cb70", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216270, "uuid": "8e3f4572-d34d-40cc-ac64-203ccbaf1af5", "value": "ad94161a022aa30896c1a8bcd8dbc85771295f860cbfda0926bfeaca9546f094.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ebb68b-c09b-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791190964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190964, "uuid": "678ad395-38ee-4a3f-86b7-a533a17d6701", "comment": "Malware payload (RemcosRAT)", "value": "5d0aaf44b40b73e6e3261de2c3c58852", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190964, "uuid": "82099f3c-4889-4e3e-8511-9d51ebdbb365", "comment": "Malware payload (RemcosRAT)", "value": "ae6174191f8dba6fff8f7ea55171ff0c88721990bb427a36ef7ab055295ffd59", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190964, "uuid": "56fcabcb-caaf-4ec2-b9b0-c494c673c1f4", "comment": "Malware payload (RemcosRAT)", "value": "76b6b307d861e5d285cbf05824d1b4c539985c49", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190964, "uuid": "18b61857-1ab1-4f6d-89c1-50b36935b96d", "comment": "Malware payload (RemcosRAT)", "value": "bcf5a32b162d716e74691465f21e20b04b7ffd18beed34060ef3e6f66c82ce7a05a31b35400dd5bcf13473d3e8b73a08", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190964, "uuid": "1a4619d2-5c22-4ea9-9b87-2145885805e4", "value": "T1BE451273F8B225F78FE2C157A119E92FDB75BAE27D8D45844121D78500BAAFE0BA1C04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190964, "uuid": "9bda20ef-5151-4d92-9e29-daf7228c2e3b", "value": "24576:W1CrLhK2F5L54xS/G0Uhco5jxZxGrXwSwnSrjREODNa7Q07Z0/WqpgbN911xN:bbNMxcclZwtrj2OZiB76/Xgt7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190964, "uuid": "6c98dd3f-88eb-4c3c-abd9-d2867737c80c", "value": 1227167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190964, "uuid": "880f5e67-161a-4a00-b68b-fe6bc3b259ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190964, "uuid": "aaf1af42-3665-4e1f-b6b1-f671c4d187f0", "value": "COPYENQUIRY OCT-06 2026082294 OFFICE_Doc.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ea775a-c0df-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791220332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220332, "uuid": "f9d3f428-4f92-48ed-8840-1e7ecbc7f76e", "comment": "Malware payload", "value": "4686218436e02aeaabf4d65fc254c221", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220332, "uuid": "af8bd10c-ed3e-4f0e-971e-89c29b7b6821", "comment": "Malware payload", "value": "aeda2ef53b77d9384a437cfbcdcd022d5584a14485dc990940fce253594dc6d2", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220332, "uuid": "76d0f073-9488-4ae5-aa0d-c230c0e1bdbb", "comment": "Malware payload", "value": "41d1417f3cd56b4f3fbf1764b66629241b0d8049", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220332, "uuid": "f877d31e-ecd4-4496-9676-2c5f49c60ded", "comment": "Malware payload", "value": "c5bd9e67e05be97ead6a8c56c3cac0d1365b27a8eaf94e0201ad56e556ccc7b783bee77704fe6e9bc91d7f645061cb04", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220332, "uuid": "19dbce7f-efa2-414b-b987-f53900afc02f", "value": "T177320A9CAE90B1B0E21753CE37EF2419122491C3140AC684FA4C6EE9AF467CD6A97F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220332, "uuid": "93502c5b-8cfb-4c60-9f62-8a1bc4a6af9b", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzM36cnsEJTYh1L9UOk/e2:sXX+/DV7k/3M37sEJTY/Lyf/e2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220332, "uuid": "757059de-c64e-4d1a-aeb5-b08bc4025e8f", "value": 11899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220332, "uuid": "85a8cdf6-ab3f-4512-83bd-3765128fc165", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220332, "uuid": "baeac148-a309-4e13-a6ac-e47c89ab30c8", "value": "Captcha.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef21ab0-c0a4-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791194681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791194681, "uuid": "ce54e024-2fc5-4095-be18-000e111f8b0c", "comment": "Malware payload", "value": "18574afb782de70a00eae72adf564791", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791194681, "uuid": "f68179b8-fe45-40fa-aecc-d524d85a3d62", "comment": "Malware payload", "value": "aedb264e412ea574ad4ef2bdf5d857397b0fdfc429cfbce47a35d280b15ca503", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791194681, "uuid": "33fe1f6a-2c33-4d86-b0eb-c3dc71152b33", "comment": "Malware payload", "value": "c6f1597d1c24a19d5e30a570b4f2b4970cfe1fd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791194681, "uuid": "662b3340-5149-4351-8cbf-1095d6bca70c", "comment": "Malware payload", "value": "bac6d21e67ec3214a263185fbb86e189d16fd8d3fdf5db9b3febb317611ea6008f108d8edc1d02fcf1ff4a65a4a71d8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791194681, "uuid": "e4ae9090-13b3-4309-87c1-9dda84f5a48f", "value": "T196C37C5773A530F9F5B68378C4910A45E77278361B609FEF07A842961F236E08E3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791194681, "uuid": "85286557-0e44-4158-8667-bd054fc14dcf", "value": "9799c1b5c44a422d3d7077d33e43c558", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791194681, "uuid": "1b87eae3-246b-4a7d-b6ff-15e7b4108e4f", "value": "3072:VbA7WWJ9mbmvKi3A1jFVGxdeBUMU5Et0AwP:5IWjuKIAideUn5E1wP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791194681, "uuid": "7edfee05-a05f-4b5f-92f7-bc346c56e116", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791194681, "uuid": "88faa001-c280-421a-94fb-99522ec53af6", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791194681, "uuid": "7fadcfd0-8b27-4f91-b528-dc40e9efca40", "value": "7.0_64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b050ea94-c07b-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791177289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177289, "uuid": "9da4728c-bbe0-4ae9-996b-e0e33a1d9c5c", "comment": "Malware payload (Formbook)", "value": "bbfc72c4fadde04742ec7a5fecbe27b2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177289, "uuid": "88b5adf4-0960-4389-bf73-d6fbfd2689ed", "comment": "Malware payload (Formbook)", "value": "af1615e256d0847216db684529c49c5edd93bc86960c9df82258ba2255447b1f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177289, "uuid": "9e7bdda4-04ab-41ff-b545-5f0b29817aed", "comment": "Malware payload (Formbook)", "value": "484dfefb1298fb558c519681a06be9d11462f7c0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177289, "uuid": "4ca462eb-f49c-41c6-96b5-638938881689", "comment": "Malware payload (Formbook)", "value": "d712e9422f9cf995e6677ae65bc4691476aebdedea43f8af30bb237908c0e8329c172fea3b31aab0d9a2fb851c18d238", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791177289, "uuid": "9c626caa-20b7-433c-bc81-5803d335ebd5", "value": "T1F7752378445D66DB0B01B2B6FA7EB84431ED23CB8DC2121A53DCC66233E9A68537BD35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791177289, "uuid": "076ebc20-6975-4531-8c38-eebe09983340", "value": "24576:CsczWGndDEkz7HRWa5McftDDJe4r4fB8NcrryMvp6aF86kTet3riYgxwxdpOOeLW:CscpCkN9ftDDEK4fAUr1BwDyuacyr59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791177289, "uuid": "3af13843-beaa-4b80-a0a2-56eb7bbbe80e", "value": 1551220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791177289, "uuid": "14370e1b-1d47-4273-a82d-0c17a61952bf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791177289, "uuid": "201dbfda-3247-4a11-9ea1-0f819eac018c", "value": "ps_s1zdQ12P3Oik_1791176539862.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a4d576-c10b-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791239221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791239221, "uuid": "34ec8f82-3a80-46e3-9363-d79dbf7dd997", "comment": "Malware payload (Mirai)", "value": "3ca6602152bb861e166e80a133b232d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791239221, "uuid": "576218e3-86dc-4827-93aa-321faa58c308", "comment": "Malware payload (Mirai)", "value": "afbd4ae8668c23bf41c12cc1c7924874fd4e6eb36dac3e2f34512a53b25e32e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791239221, "uuid": "c402d5f9-cad3-4fa0-8e14-c61f70ff3e49", "comment": "Malware payload (Mirai)", "value": "d12aebbf1c375b4343c8be50609466d9848ce2aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791239221, "uuid": "16b40990-ba0f-4812-bd57-ff54047bde20", "comment": "Malware payload (Mirai)", "value": "104db0b15d25c11009c02f97a3a46f4c9f9c5e9017119f85bdb41ae6d3f43f34ce4042e412dab0c5d7bf9b1b17d7c25b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791239221, "uuid": "b5ceea9e-ee31-4c66-a88a-40276e8143c0", "value": "T192758D56B2F364BCC067C030874FD753A935F8A911227E7B35C4AA342E66E705B2DB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791239221, "uuid": "cdf9047a-557e-4f41-90b6-15359bf591cd", "value": "24576:Npdd6gPMSXQr3N+pbzBTWuKfmpVZPdTJcRr281He3Q+:jddrUoQTN+pbzFWuKmpVZPdTorJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791239221, "uuid": "ceb6b1b0-f00f-43dd-a6da-7227fd6541a2", "value": 1698184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791239221, "uuid": "e7d6287e-d1e1-4f83-ac8f-0b1d192856cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791239221, "uuid": "84a70784-4f8d-4323-ae19-2dce4658623c", "value": "SecuriteInfo.com.ELF.Agent-CVW.87757952", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa0ebfc2-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185869, "uuid": "fe3b8677-cd79-450f-b362-a12894846a48", "comment": "Malware payload", "value": "a3fe42452d81054934c25ec5c936238e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185869, "uuid": "3261f7b5-5b10-4314-a78a-7cfc7a8550fc", "comment": "Malware payload", "value": "afd970e214143aeeee75914f7be04b3651fde5b2ba910a393521b26db7054145", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185869, "uuid": "7d5964e7-129f-491f-8451-146a29e9a18c", "comment": "Malware payload", "value": "1308abb6c5aa877322aba68d7be0182bafd71d0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185869, "uuid": "a43f4740-4336-4c69-9d9a-89e58ff0df20", "comment": "Malware payload", "value": "c697d2b8bffb4be9814f6677fd7b870af41cb398a92b76529e48d88c1b9f3f6336677229ef945d25099d3623ef8860cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185869, "uuid": "ebb2dd2a-98fa-4827-8ecb-5c7df9c1bb60", "value": "T14BF21946FEA15F9FC45ECE30025B0327269D8DEA83D1633A523CAC4C75B96448AD7D8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185869, "uuid": "69194cf4-2db5-473b-9ab8-18f7eedd43bb", "value": "768:JWW2BYU5NClMGo8UBwyRucMFX3KWeevDEr:72BY+Hw+ucMFHKW/v4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185869, "uuid": "01be83d8-41a4-474a-8c08-438850319124", "value": 34548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185869, "uuid": "e55a27d5-56f2-430d-8660-88b9ca2b424a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185869, "uuid": "28794eed-6437-4e84-8356-aca37a3deb5b", "value": "dldr.mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd0d5190-c0d7-11f1-927a-4201ac107004", "comment": "Malware payload (Vidar)", "timestamp": 1791216851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216851, "uuid": "a38771e5-249b-4b5e-abd8-0954645cb435", "comment": "Malware payload (Vidar)", "value": "138ca7a6667d8347b236f2aacb134e09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216851, "uuid": "90e886b5-c6ed-4559-8d0a-8776fc612701", "comment": "Malware payload (Vidar)", "value": "b014e51e30e352689b3a2d1a8b4f100eafc9d7273b2d848e655eeba0513e375c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216851, "uuid": "23f83d11-aa62-4ebb-b2f4-170bf36a5d01", "comment": "Malware payload (Vidar)", "value": "008a64efd96b1a92cd182fd3523d44e348b07fba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216851, "uuid": "6a58a047-5808-4ea0-9470-392f70942cb7", "comment": "Malware payload (Vidar)", "value": "aedce21c42f44a799e524a7ca94a0bd59d7782828bc8a2d1c5c324973b91e9656364ab7bed20a9eb5a1bf23dd099f0b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216851, "uuid": "6edd52d7-07fe-482b-8fe9-74706dcf908d", "value": "T18B381217768840DCC54BD3B084B05D3A16B13CAE9632FB8F4EE96E941F167D96FA8B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216851, "uuid": "00cbbb96-fd3f-49dc-9aa5-80ca9449c840", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216851, "uuid": "3691f2fa-46f8-488d-ac84-1caabc9cd95e", "value": "1572864:92wzaSFSf4tUSvR5g9AK+gEkB0VKbnJyPe6wKEHi9f5XSL5D9Zkw:SfyJg/iK7GePKEHeXGPkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216851, "uuid": "afe676fd-b0c6-4ffb-90c6-eaac14161bb9", "value": 104387464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216851, "uuid": "74542182-dea9-4fa6-94f8-109d9ddc439e", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216851, "uuid": "18368bd9-eae3-4d95-84ae-8303f412a9ec", "value": "b014e51e30e352689b3a2d1a8b4f100eafc9d7273b2d848e655eeba0513e375c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b384e6-c0f9-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791231529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231529, "uuid": "e7b66ed7-3c33-4f9f-9bd1-cecba6508dfd", "comment": "Malware payload", "value": "7487e6f937ee305f24ec76a6b17475b9", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231529, "uuid": "ab638141-64a2-4fee-9392-ad4aa0f33c3e", "comment": "Malware payload", "value": "b05b21709350713ed40ed52381c7d2ff164de159e95f9c1d46ecf1b6cbd67671", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231529, "uuid": "64b5f18b-469e-46d7-a2c9-72138120165e", "comment": "Malware payload", "value": "f0f9f6f139984e28176f5170a46bce663746ad30", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231529, "uuid": "7c256475-2236-4b56-8b4e-cb4970b448af", "comment": "Malware payload", "value": "a7187aca7e4c2d1c7eb3097d6431401e3feffa87dcb557e54ac5acf7f80466e5a3022f44a06f0c4b5591276fe258243e", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231529, "uuid": "69cefb29-d018-4395-8219-1bf95ca04b3c", "value": "T11D63E024B341D02AC16ADD3E8CC5C2DB1B44FC52AE53CA0B71C4B75F187E9939727A6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231529, "uuid": "dcbe6f4e-3f03-4990-89a5-a0f115c68242", "value": "768:LTWBPjwi8U0/0zqKu7eijdVanH+aMBl8lxxoVvq+RC7v/F6UYzvpS8kzyFm+y6JE:fWsi8LV7eijlcxx6vALY7IyJyufmNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791231529, "uuid": "cfbaa614-b944-4c7f-a826-f30c941afea4", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791231529, "uuid": "206e7788-ffe0-4fc2-81f7-e8f4daf627c3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231529, "uuid": "57905c68-8765-491d-8d00-eeecbb8cf407", "value": "Plata INV90399.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80deb43-c116-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791243955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243955, "uuid": "42aaf5a4-a600-4461-bc5c-9fca8df7cd52", "comment": "Malware payload (Mirai)", "value": "d54a026d829416ccea044f5a94978f9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243955, "uuid": "5169241e-364a-4069-9af3-4a2cfeaf3a99", "comment": "Malware payload (Mirai)", "value": "b1043e307528fb731fbe4d1f2e3938ffa44b173762075144c4be7107ccdac7c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243955, "uuid": "7d9a5f8e-e740-4db2-8e4a-2453851bc3ea", "comment": "Malware payload (Mirai)", "value": "c74d901aeb9808ae52835b192921302171c75d9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243955, "uuid": "0eac38c5-af08-40c6-b40e-6a704e42ab26", "comment": "Malware payload (Mirai)", "value": "4f4c092516734377e9037e3812d32267c19d09c5516911780ecdefb04adc5c3bd92b931e727d159a51537d1c624da5ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791243955, "uuid": "65ad7608-71c7-4704-ab65-fd9aef5edbaa", "value": "T1E8D45D66BC919B90C5E149BEFB6E437872135B79E2EF7106CA045FA06BC98D50F3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791243955, "uuid": "57e1f1a5-dec8-434b-880e-6c6d96b0a715", "value": "12288:11Bgrbj0zPzNguRk7jSvUsofz6pauSgHppRRmQzQ2T:7yrGknzjwfhRRhzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791243955, "uuid": "c5086aed-77a7-4df5-8a1c-fb39649b8227", "value": 652604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791243955, "uuid": "b7596f43-bea6-4616-9530-59d97a985806", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791243955, "uuid": "79e1d249-cce6-4ff3-88d8-4ce723697d41", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e39a20c-c050-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791158764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791158764, "uuid": "a36a44e1-9cae-45d1-9ae8-ef7d6e07ae6a", "comment": "Malware payload (Mirai)", "value": "7c16ef3d885480b33a831395cb01bea9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791158764, "uuid": "1c786b05-8818-4a9a-9966-261ed5e9ed52", "comment": "Malware payload (Mirai)", "value": "b126a5682d497b3f0c2c4d6c34c52091ed973e475ac7019f65f941d9690efe27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791158764, "uuid": "0de3e385-e6e8-462d-a0e2-5801afcce26d", "comment": "Malware payload (Mirai)", "value": "ea4b9836ea844e2d13af46fe0ee55c36d5060e8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791158764, "uuid": "1471648c-65ef-4d9f-98c4-a999364ba822", "comment": "Malware payload (Mirai)", "value": "4164c8dbf9088ed30cd243fd39104791738d4d21cd9163a54a5caece43e14ef926fa15e9475d64148a934302b1ba60a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791158764, "uuid": "71e8026f-eeb2-49d3-91d0-3d202c945d25", "value": "T197B24C86FD814517CAE51176FA2E928D37665BB4E2FF3303AB261F642742A1F0F3A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791158764, "uuid": "8d8c7239-5916-46de-9ff8-cba6289c6770", "value": "384:dG2m2FfIQp9Mgj6JwqQ87+2eZvaBcjQOF9hM4CXc5aceBy6jdmFx4eU:dfyRVg87+zvaOPFLMUqy6jF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791158764, "uuid": "cb16526c-819a-4aa5-8823-8383fd737670", "value": 24504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791158764, "uuid": "ebb13652-ab45-409f-8952-aa038df35ed0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791158764, "uuid": "819fc9b8-354f-48fe-a09b-e2bb614f8af8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff46adf-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791190630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190630, "uuid": "fd025dc3-2f4c-4430-b8eb-34cac89bb6d5", "comment": "Malware payload (AgentTesla)", "value": "3f6b0fa8ab92b793b60e1661e46b8431", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190630, "uuid": "a64542dc-fd38-4163-9899-0dc57db9ba31", "comment": "Malware payload (AgentTesla)", "value": "b14e3af3fbdb150886cbb6f010cc1dd738d361ca0c0d3aa66c58a19b53bc88b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190630, "uuid": "193377b5-4715-401e-a319-2fa510988f78", "comment": "Malware payload (AgentTesla)", "value": "3e6bb7a1f16122f60209a386b59775a886ec1f8f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190630, "uuid": "fa6b9d2e-11c2-4499-a234-ca5acf9911c9", "comment": "Malware payload (AgentTesla)", "value": "2f8ef37581800b7e261ba5dc86001ef53feb4b4e18cd0c8587f6a72ebeb1d6927a16d88fec216c1dffb802622fc59f55", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190630, "uuid": "8860a646-a5d3-4ae9-b791-0c50ef048d80", "value": "T152E5D4BD138AA17273265B8D02B5D9709A8A70137AD5CF7230ECF609371DD07735AAE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190630, "uuid": "b5a24d18-84c9-4ed0-a27c-121be7113087", "value": "98304:QyVYsVf6hs5ifo7iTwgTutSbSzM/Itzm7E5hRVWT177SCj1/yrR/7tHtfjqOn:QyVYsVf6hWifo7iTatSbSUItKQZVoiBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190630, "uuid": "6c106807-7f71-47df-ae77-0259193b862b", "value": 3239722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190630, "uuid": "931c11ed-d72c-4bc2-bb78-1112726779e2", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190630, "uuid": "4438ee62-ec8e-49b0-ba8f-d04c8e18fdb6", "value": "2610051C6FTM.pdf .JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9413a4-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185900, "uuid": "9a1dcf65-24e9-4552-9fda-f5bea1e3cb0c", "comment": "Malware payload", "value": "92d1a4f672dd5ea27f2c85b119a15c77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185900, "uuid": "e3204a2c-0c88-415f-8e52-1469d4d4fb00", "comment": "Malware payload", "value": "b1547dc0bac4e7c4cdbcf14b49fd518ccd6a03d92feb9cbb1fc26bed92626669", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185900, "uuid": "0813fd14-51ff-4fee-82ed-38ef98e67249", "comment": "Malware payload", "value": "b13efe893ed966be0baee401a99597dba30563d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185900, "uuid": "a38eb8af-17c3-4a30-b869-73099fef2473", "comment": "Malware payload", "value": "122c3128b6296d74d45fef1d6022ab1cd79e64fe3b3cb30eb6398ffeca2fd158b5fa2e1d1d3f9c0e9e0b0a60d512c598", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185900, "uuid": "0c43fb0d-d0c5-45fc-adec-3e65b1423e18", "value": "T1D1C59E02FD919F27D92A177245A222D82739FC082F8BA7175A24FA7CBCBB3805D453D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185900, "uuid": "b1163a95-4477-400c-b268-37a30e922d56", "value": "49152:NKsPxS8ANeY56NTJeJCOeOeOUzLHqvqufrpLvb5B:wXpFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185900, "uuid": "5171da62-8b0f-4d98-8713-8f2a8029c877", "value": 2687102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185900, "uuid": "2e27a8b8-482f-47c7-9278-152faa79aa11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185900, "uuid": "21e34855-6dd3-4d19-a443-c8d8ee2be78b", "value": "bot.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e78963-c112-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791242174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242174, "uuid": "bc1c3556-512e-4813-9553-d24a5d5517a8", "comment": "Malware payload", "value": "22475b4143c3dff2c6ce7c2e5d0261a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242174, "uuid": "470cf5e4-0f58-40d4-9e59-d323ae5c2c4f", "comment": "Malware payload", "value": "b1ccbd09a9fd9f5bd46b40a330978f0b189a0a27e5e30844582afecccc5ab452", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242174, "uuid": "2c700968-2d10-48ca-905c-9907bf78abaa", "comment": "Malware payload", "value": "65ccd85ce8df56e49ca28e829a5f8a876f119878", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242174, "uuid": "f90a0511-e5da-4910-aa62-90c6fc3fd39d", "comment": "Malware payload", "value": "386ff9bb353122bf9f44b88be67f8df3a0700e7bf1b5d6594ca2d5b63abdb27bce5ae095b3c92ab06b3e853cbb2ca282", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242174, "uuid": "2bcb4718-31f4-4823-8c8c-18947395d258", "value": "T1D1561797B9D24942C4E43A77A9BE80C533630EBA9B86525B5D04FE3C3EBE1D90E34354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242174, "uuid": "4314ee74-c91a-444e-a238-025d3e50f912", "value": "49152:nyi1FMvMlQyXdVWBs5Zu0lcfZ7URYCu2MNjk5EO:3MvMlQAdVWBs5Nk9URYiMNSEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791242174, "uuid": "31c30429-f9eb-49b2-8512-25d757cdd48e", "value": 6095010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791242174, "uuid": "3e840846-abb1-4798-9eb1-4d8f4a8d2719", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242174, "uuid": "405d5bb5-731c-4239-b10f-ab739699d1bb", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dbcb4bc-c052-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791159434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159434, "uuid": "dce64092-3f59-4581-90db-1e7523fed4e1", "comment": "Malware payload (Mirai)", "value": "115643ae0bf449b1883c0f4ac2e27366", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159434, "uuid": "d102e39a-3728-47b9-a5f4-dc7f1bcaa130", "comment": "Malware payload (Mirai)", "value": "b2caaa4db2b844eaaed289705e5efe889c05f45a212bfcc44d41bb39726cf0c0", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159434, "uuid": "5f0faa56-73e7-4672-a39a-bdf4db71c645", "comment": "Malware payload (Mirai)", "value": "555a39c155edbdc3687f7975bacb3be639eedc60", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159434, "uuid": "652b3e25-9b8c-471b-a198-3f92ab441cbb", "comment": "Malware payload (Mirai)", "value": "c09b5673a33e79c8d376d41bf84aecc8f6d9796728d03bfa3e37b67e6d9e79783345b43613b32b8a59e4759313492841", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791159434, "uuid": "1d090971-2a2e-4c66-a9b1-b55bae73f7e7", "value": "T13BE3199FFC81AE6546C127BBFE2E418A331317B4D2EB71029D141F2876CA94F0E7A552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791159434, "uuid": "ee979b7a-c5a7-4ab1-944b-d14851a1235c", "value": "3072:T2s/ITo7WCkybotgsJ913DhrbW4UYSx7QpUiB5IQggEuaJhnR1rmaabED:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791159434, "uuid": "89854929-16f8-435a-89c7-d298aa7658b1", "value": 153268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791159434, "uuid": "10f97706-7f1c-4c48-8727-1f37c4d0ce56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791159434, "uuid": "53acf7ee-910b-4ac8-86f2-e82730e38b60", "value": "b2caaa4db2b844eaaed289705e5efe889c05f45a212bfcc44d41bb39726cf0c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706ea8a2-c09b-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791190926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190926, "uuid": "2f622b02-671c-42a3-9455-0e2a93b5032a", "comment": "Malware payload (Formbook)", "value": "d6168e1a2824f2cfb161b85fb84da986", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190926, "uuid": "c219ff77-641b-47e6-9b5f-91eff401c460", "comment": "Malware payload (Formbook)", "value": "b304734df2c865e4f5b71482197195938e4a42c078975f2ee895067ce19f6af0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190926, "uuid": "fbc8f08e-93af-4c29-84f9-01f81d80221e", "comment": "Malware payload (Formbook)", "value": "7785fe41e24b89b8dc078e2c90a364fd90df817d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190926, "uuid": "5a8a46c4-e9e6-4a86-94d5-ae76e471ab08", "comment": "Malware payload (Formbook)", "value": "ef58269e1f31e4f154adfbac8ec91de1e3262be10fd5fa87007a5ca21155d4c4471a4d827898486b182bf85387b7c8d8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190926, "uuid": "5fc2360b-4446-4787-bc2d-c31b1ccaa35d", "value": "T11705C0516F983E75DFA81A0ED0BE2E0E03F0534A980574DEEA256F4F5EBFE44440B1A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190926, "uuid": "714b6f66-7593-4197-a0ca-321b3b34b600", "value": "12288:RrbsQpP/98VLhVCP/gPV1Jqc7g9K13/T+33M5PNS3rPHeGyBF:dTPVGooWKxanWarPHez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190926, "uuid": "6a2e0ad5-9e98-4248-bc2a-d225e136eae1", "value": 855383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190926, "uuid": "2a4d8e96-3f0b-458b-9f54-1aad1c65b17a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190926, "uuid": "d11f7372-814c-4d90-88f3-6079634f19b3", "value": "ORDER-07896-10526AP.DOCX.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c5f762-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218939, "uuid": "8b05ee11-730c-4681-980e-4450b78c6cae", "comment": "Malware payload (Mirai)", "value": "4ac8e7d3b669cd62a806a5700b9ff79a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218939, "uuid": "b48a4620-9d16-468c-a791-bb2c208b59d3", "comment": "Malware payload (Mirai)", "value": "b305b151207a0e25a818ab215342e5d713beebd1be7244e39d8ed60b5333e869", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218939, "uuid": "852ca2fd-e099-43d6-98da-8758983d411b", "comment": "Malware payload (Mirai)", "value": "fec83749a302dcd9ccb861ed660bc94245b10abf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218939, "uuid": "6c99d416-1652-4161-b630-b65d15a1c59c", "comment": "Malware payload (Mirai)", "value": "790a026d61fa6ab2b63e8264b5c1b4e09acb2cda19d0659d2995200f252d79ffa2b9b01a10c2c5ccdbe97b76867fc394", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218939, "uuid": "a4df1943-a7f0-4da3-a88c-85f105c97844", "value": "T1DB540A4E6E329F7DF6A8873547F74A24975923D623E1D645E1ACC2101E3038E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218939, "uuid": "8eaa81c9-e7a6-4bf6-ab1f-32690db59a3f", "value": "6144:CFNpmEUszAJVaAdyOgrR/Pi0gwjiwgYTq85ucLP/Hg:s5UuA+1/aCiGu8ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218939, "uuid": "4ac2e682-1f38-4218-9b32-812011ee30e5", "value": 292908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218939, "uuid": "152ab000-063d-4d15-bf55-73aba03d98e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218939, "uuid": "95b5d8c2-6ad8-4ed6-a948-a118b9ba8288", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf496c92-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181636, "uuid": "c574b9b1-34d5-4f25-bc1b-e408caa129a5", "comment": "Malware payload (Mirai)", "value": "1b3fb830f6665090aaa74c2afce16df6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181636, "uuid": "432ece3b-fddb-4d18-a051-51a9c6ed296a", "comment": "Malware payload (Mirai)", "value": "b32990d328df651ef70737c5525d2cabb880078e74640ef5af55521ee70a7c27", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181636, "uuid": "fd8dd8ce-154c-4355-a50e-a5668014e7b6", "comment": "Malware payload (Mirai)", "value": "7ce634a27fdaca329489347bbf679c8932030d1d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181636, "uuid": "94616045-61a2-4b4f-b4ec-0c0e04107098", "comment": "Malware payload (Mirai)", "value": "853febd47ebaa6d3933bc624fd080dbff2c45581b41525de68fde699388c193a5e0c92e125db3746aaa38a59a625218e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181636, "uuid": "c9800da3-09ea-46c8-a974-42bb794b8a70", "value": "T1D4F082F452555BE574728427A66B5C09252C003B1EF23C91C5CE3D63B04FE2A91A1BBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181636, "uuid": "9274122f-b0ce-4105-9187-3d7b18cd75f2", "value": "12:dndZIKwvXDuyP5+tbyKFGtbbftbbgPbG4n:dI/vGGe4PFP+GK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181636, "uuid": "ef8f7983-19c1-458b-b499-73243feb5d3d", "value": 481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181636, "uuid": "bee863bb-f7ec-4fcc-8dfb-71e95684d3e3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181636, "uuid": "1ce002e3-fb15-4416-99c4-59953556b1ee", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d03ec89-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181981, "uuid": "fcb48050-b783-4d0c-833d-17dd62807944", "comment": "Malware payload (Mirai)", "value": "304e9712c899e5022edfb3ce0f81513b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181981, "uuid": "22053fed-966c-4887-81d3-e05c6f625a64", "comment": "Malware payload (Mirai)", "value": "b34470ea536b77ae4915412a450f4e133c85314121d276b35b582c614a7551c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181981, "uuid": "e7999ced-ddb0-4322-84ea-7fce90bb8fbe", "comment": "Malware payload (Mirai)", "value": "7554b10e28718f6ad5027faf30437954aeecc810", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181981, "uuid": "fea9bdcd-707a-4fa6-a725-8e2bd9bd7300", "comment": "Malware payload (Mirai)", "value": "9a8b3b555626c0aa28d34f05e823a53695102f4605cdca1dae007eb3a4d6aaf79f12dba76796a3c0000cceea172a4180", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181981, "uuid": "472a0efa-fc6e-4206-866e-ffa023045b00", "value": "T1D6A2DF1921CDEE72D170903AE23CC357AEDB87B652FE313A1E0807A9A09581AD6BD945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181981, "uuid": "90730205-ebf4-4f69-9ff4-66f73ca99e53", "value": "384:Yzmog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbESnhymdGUop5hXY:YKoh/DxCvhdR4IjWVFbSASns3UozJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181981, "uuid": "9c8774a0-a3b3-46af-814e-cc4767d5bc04", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181981, "uuid": "83a9f52d-8c72-478d-b22d-39acbf5bf444", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181981, "uuid": "97e043d1-3eee-4865-86a3-e0a6005859eb", "value": "87sbhas6as.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7d3559-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181979, "uuid": "f61f11e8-0f8e-497a-9786-ef9db88d0f13", "comment": "Malware payload (Mirai)", "value": "ebaed30792d3821b4b379777aeb02227", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181979, "uuid": "f8037198-3502-485c-8c40-3302a5991adb", "comment": "Malware payload (Mirai)", "value": "b4099e31701366916df64aa8c6ef1f1e7abe99e081e8a1b0ad71f0ccb4d04e3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181979, "uuid": "537b817f-b77e-4c34-92ef-60ea1d0cf000", "comment": "Malware payload (Mirai)", "value": "14038bd1a9740b0a007542031ac34e62b5dc0f1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181979, "uuid": "f9c75912-ef9f-40e2-9dcc-d6fa0d6b5e04", "comment": "Malware payload (Mirai)", "value": "8a22bf319dde45c57fbd90ff63e606e85dfb0079f7094d1f9795f30e29fa32c8e0770058dd2b1e926b984443f6e62c69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181979, "uuid": "c73a60d0-1908-48bf-925c-3124b6a383c9", "value": "T184338CB5C579EDE8D1144A78BE248E749723E000C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181979, "uuid": "9ccc440e-994d-4ed8-b415-4cefa12dcc54", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvr:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181979, "uuid": "6af83450-f25c-41cb-836d-ee5e36179ff6", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181979, "uuid": "e644cd15-74e9-4c5c-8424-ac3c88b344f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181979, "uuid": "42377fff-7e15-482f-b641-08234b894ffc", "value": "87sbhas6as.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a172d49-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791190566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190566, "uuid": "5ffbce4f-109c-487f-b577-0a708ab34f66", "comment": "Malware payload (AgentTesla)", "value": "79be00660f09bc6fa45108de98631abe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190566, "uuid": "f9d97451-69d2-42a1-9787-0fba044d63bb", "comment": "Malware payload (AgentTesla)", "value": "b40e280b2cae0fbc5fbe7f84380aee32f0a34c2927749d3f2f53ce6e55c78c23", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190566, "uuid": "b8fbb87f-19ca-4f3e-aef8-0643851ee5e3", "comment": "Malware payload (AgentTesla)", "value": "0ec98c7717f2bfa795b6dda425c7431c147e2c14", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190566, "uuid": "490cfbb2-b47f-4f46-9229-09344ea99402", "comment": "Malware payload (AgentTesla)", "value": "fdcde85600dc4e035ec7fbda9d7324f687fe683c5e045cbfc1438e22ce3873703a007db26b01d285935c054cdc841390", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190566, "uuid": "97df1c8b-68a5-4ac8-adee-7f0070e68364", "value": "T148E4E01A8201D4A0C46E9A57C75F7E0959F042F5D62DFA8C417CE2832FDAE62C7EBC85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190566, "uuid": "a62e4a1d-30a1-41c3-a4eb-04fdc82c2844", "value": "12288:u96bMi0svLi7WHmyYWCZ9cpptIuH7WJRqH6kP8znecUctYWFxaGW4PH8EJmE:ai00Li7WGyYUtIuCzxiGnnPH8E7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190566, "uuid": "48f012d5-dbfe-4aa3-8d97-33790f9d216a", "value": 704531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190566, "uuid": "9197bed0-a337-4e23-b3ab-eee1df6c670a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190566, "uuid": "e2df3e58-d333-4bdf-bf3c-37f3c07a8dd2", "value": "MAN250115028.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1aff085-c0e9-11f1-927a-4201ac107004", "comment": "Malware payload (CoinMiner)", "timestamp": 1791224617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224617, "uuid": "80aec039-664b-480b-bf89-c6c738d18081", "comment": "Malware payload (CoinMiner)", "value": "cd1fd8e06c31dc642b038cec1e234442", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224617, "uuid": "97e73e1e-9401-468e-97ad-1090e2cabd11", "comment": "Malware payload (CoinMiner)", "value": "b4359324e3cffb3dc521a808dfa0b5d7bd92dc6e08eb7527da41e1e1312d3265", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224617, "uuid": "88dd1a76-0880-443d-abe9-dfd6cb68d7ad", "comment": "Malware payload (CoinMiner)", "value": "37eb569f7ec3502a1013e8c554864024a25489a1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224617, "uuid": "fd6bdf46-0e4c-44e6-960d-18a3ec0c750c", "comment": "Malware payload (CoinMiner)", "value": "1dcf6b7df7314b6441e5faad972df717188cea38b89ae7256034ef6d0e0607fa45d645c2a76d45e7d8c4152637e287a5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224617, "uuid": "b23b9e0c-d9fb-44a5-8b19-3120fa5b1248", "value": "T12F767C67A2A550E8C83BC178C6565233E7B2B8155330A7DF16A4E7361F33AE05E3E724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224617, "uuid": "9424c241-ba2b-44f8-9bab-e26dadff0c71", "value": "509429e631c22bd2439bc6f1f1151362", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224617, "uuid": "33a76bf7-a0b1-4a4c-9888-5701e20ecced", "value": "98304:rMiLthclVlWzGzC6Ob2cUl/6pRedsp/KepIKJaz3eHp+ee6Mjr:ZazCt6cUIp+spiep70qHpNcjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791224617, "uuid": "356a7028-ae74-43f1-9ea8-5c1cc2d842a6", "value": 7735296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791224617, "uuid": "9af18f10-ccd0-4e3a-b156-6c567ad72503", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224617, "uuid": "c5d5a253-fb77-46fc-87e7-aba1e084f6a0", "value": "AntiMalwareServiceExecutable.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd0449b1-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1791190652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190652, "uuid": "d2effb14-6592-4316-a03c-9d8e67a66844", "comment": "Malware payload (LxBaseRAT)", "value": "7f9d22fae9b2b8c98241ec2b0c380d37", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190652, "uuid": "fd8c44f8-a5c1-48b8-9f10-ee5c14ea0fd2", "comment": "Malware payload (LxBaseRAT)", "value": "b45f4ff5c241d8953c6635d4c63f0ae559a731e040c97eb0c528a3ebb1954213", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190652, "uuid": "221c8c77-230c-4b72-a7ab-4a9261ba03d7", "comment": "Malware payload (LxBaseRAT)", "value": "4bae4f07ec79c788d65a3a577bc81d0f78bc15b9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190652, "uuid": "830543e7-e40e-45c8-8960-decf559455e6", "comment": "Malware payload (LxBaseRAT)", "value": "1526cad33cd1fcf5ce738e64777dd523c27d1644228940a5e7a9a35fac4d6346936c14138135caea629f9105c05f46e7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190652, "uuid": "4bdf6deb-e2d5-4041-97d3-efa3caae95b7", "value": "T1ABF48D31527C905D2D67942B6377B6637A0EFB2DD2072B0005FE43C671E61BA92378AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190652, "uuid": "7d4bdc34-16fe-4fdd-9c84-7bef51ca5785", "value": "12288:v6QYV5Y+Pe/i0i/ipMAo0EWRg9QxfeFsCIOVy0pypQjlYCgqcZ1QzHnS2Ogav8wu:CQYVeAkMIEpexfeFsCI4yk6RDSzy2OgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190652, "uuid": "ec93f681-67f6-4009-924b-763ac4b803a2", "value": 725317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190652, "uuid": "d1464258-4bb1-42be-9fc3-004793f331f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190652, "uuid": "df9d8912-b8a1-442d-8394-f655434ac17d", "value": "B\u00c1O GI\u00c1 P1456 1331 _.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e622049c-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185969, "uuid": "27cb2fdd-4d3a-41b4-b37c-6d65e88a54ec", "comment": "Malware payload", "value": "3d626a4752638411a9906e7b80f980c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185969, "uuid": "52aa8593-7f2e-4cc8-8ce8-6768d56842d7", "comment": "Malware payload", "value": "b47086da62cf4ff48bbbb4050245b1f6bad4f390377959a793fe7c03b6c28bb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185969, "uuid": "e6fa602e-4bbc-4a66-b281-b3a78c73ac2e", "comment": "Malware payload", "value": "c023efc69a4a15dca29bf1a983e7f4536f4082a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185969, "uuid": "9b75829c-37a0-4749-a9cf-fb45e86dea1e", "comment": "Malware payload", "value": "f1db3f223866ad38cb0764e3d51e5698b9b2fff51cee85edce4dc9b2efa4d8592efbbf46bce7ab275ae82a60a109b210", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185969, "uuid": "0d288f8f-6fba-4a6b-9060-16c6e3b2ba84", "value": "T11B953829BC5D2C12D4CAB7752A7A11C43339BC485F82E3276904F77CAAF67948F53262", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185969, "uuid": "db6bf481-b16a-430c-9732-c32dba53ae13", "value": "24576:heSj8HVISY5gt8zDuiSXIWy0RkxWuvCrbFk3Dr:2VcK8zyDzlbFkTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185969, "uuid": "4b1f1f30-bdeb-47ca-a663-6b0af224db64", "value": 2031740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185969, "uuid": "712c4c0e-af9f-4364-b0b9-46fc33f59117", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185969, "uuid": "6a4d709f-2313-4e0f-86fd-1f509ad70ccc", "value": "mb.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52f45a1-c0e6-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791223280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223280, "uuid": "0118ddf2-07f6-42cc-b177-40ca64ab0597", "comment": "Malware payload (Mirai)", "value": "2c60c3fb601d4b4cf6fb498e9a62076d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223280, "uuid": "b3d3ad5b-0b80-4055-9dec-300940db7270", "comment": "Malware payload (Mirai)", "value": "b56d498e7e385890d705e46aa381a14bb118f89398e1aac47e7c0d3ae873d01e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223280, "uuid": "d10ea9fb-7892-43ea-9f9e-9bec56037a88", "comment": "Malware payload (Mirai)", "value": "d239e95f08225363d4093bb1c1df69596b6401ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791223280, "uuid": "d39066de-836f-4e61-ba35-8c3023d1ffca", "comment": "Malware payload (Mirai)", "value": "17f69040ea50ca89a9f15e7fd3638a8e78b98993477ad0e06bc1d0d6a1697b92e05a9ef82e248a8d5f1b4d1910d7c884", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223280, "uuid": "c35ff49f-e696-418b-bf5c-93761c5b1581", "value": "T101D44A03272D0F83D3A75DF0777717F487EAA88621F9E588EA0B69C69271870614D6CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223280, "uuid": "288435ca-9c5c-4bfc-9bee-7d22eb031735", "value": "6144:Aekc0rRw+A0rqQtwJmxusgd1Ro2U4gSIlo/eTHs1nord6w5ODJHE7GvxzoCXhWb2:Qc02+A0mKw8YsHRjG6shW9/SuQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791223280, "uuid": "cba79e48-85eb-4d38-8bba-4b13a4ba9e02", "value": 641296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791223280, "uuid": "928820e8-341f-4d8f-8106-675d77fbac0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791223280, "uuid": "b46c8c72-b0b0-4d43-ac92-8a863f54c90b", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be8ef77-c095-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791188234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791188234, "uuid": "8a4b4c4c-0282-471f-a880-754bf419e484", "comment": "Malware payload (Mirai)", "value": "f3d3170e08820a2c02138fd699ab84d7", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791188234, "uuid": "944ad462-2b60-4cb8-85c9-ce2bdf6128fb", "comment": "Malware payload (Mirai)", "value": "b5ce0522da50bab0d1b71e0631492b48c9dd2d21e33e97b7f1ad7d4c5623ec10", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791188234, "uuid": "fabc9c51-3b03-4921-b268-fcb8f234a332", "comment": "Malware payload (Mirai)", "value": "0b795473a3347fce98ad54889de0175b39d1df14", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791188234, "uuid": "33500245-514a-46d7-a44a-71a04f5cedc6", "comment": "Malware payload (Mirai)", "value": "ec56cb1482ed5d6ecdda03273b30243e4853bff18abb8bfd96c98652060f08842585620da91dde0d8980323c1cfcbc6a", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791188234, "uuid": "28f1840a-e96f-4ce9-b1d8-fdc1c54d6f3d", "value": "T126B3089BBC91EE694AC0137BFE2E418E330727B4D1DF71139D141F58B68A94F0E6A642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791188234, "uuid": "c27b5e9f-f6d6-4621-a764-d178c68fbf14", "value": "3072:T2s/ITo7WCkybotgsJ913DhrbW4UYSx7QpUiB5IQggx:T2s/gAWuboqsJ9xcJxspJBqQgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791188234, "uuid": "1a0b1b23-5c87-480a-944a-441f2672019b", "value": 114524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791188234, "uuid": "da1cfb14-8b23-4924-9db5-158f336d649a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791188234, "uuid": "314f5cd0-a23b-4648-bdc7-3845d6c2770c", "value": "b5ce0522da50bab0d1b71e0631492b48c9dd2d21e33e97b7f1ad7d4c5623ec10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c45a2e1-c055-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791160935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791160935, "uuid": "548fc06a-6b1a-4413-a621-758c28771805", "comment": "Malware payload", "value": "46de0c763fbbfa3ef1da8d76ca7357fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791160935, "uuid": "645e36e0-14b4-46e0-b669-1f7c80d2a92c", "comment": "Malware payload", "value": "b7689b12e1b94e628c8398ec86a6ad5ba564f107c5085464f3d03f408959545b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791160935, "uuid": "fe0b5b15-1a47-47cd-9beb-1b131ae2f41a", "comment": "Malware payload", "value": "cde1ff889d699ef852ea94052c69fcd20946df45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791160935, "uuid": "51d2ac63-2c20-4650-9441-3f7feaa7b2be", "comment": "Malware payload", "value": "62722b135448bafa583ca18a08bad5326b6105971bd774d17da6c8190f603f18f6f6a72ecc26f028028922e8788dc637", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791160935, "uuid": "c3693823-185b-48f6-8d02-949b255bffb1", "value": "T198B20A84E547E0F1F41B46B880A6E73EDB30E52A6554D91BFF70977EEA13E11830B20A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791160935, "uuid": "4bfe5954-9503-49c2-a857-412404acf4c8", "value": "384:fCaiJsgpQn9ITTIDvqx2aeOkUYs883SlGlw0HyUhpeLza0pqq7ukzAU:CY9Iyvw2HwYsHvG0SUhpQa0pqqKOAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791160935, "uuid": "07e539c5-7ebf-4982-9afd-24995b4d065e", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791160935, "uuid": "b8135ea3-19c7-4727-8c7d-3dbaefe56c8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791160935, "uuid": "0b8c58a4-3d84-493e-941c-83d3337a1c82", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c437a792-c0bd-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791205669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205669, "uuid": "eedf142d-b11e-4ba9-a8cd-f2b58d1abc40", "comment": "Malware payload", "value": "92fc023607a8f96149387d98356fccfb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205669, "uuid": "a0a76974-cfd3-4980-9aed-62ae7cdbd586", "comment": "Malware payload", "value": "b7ebb627e3531f074fb85553046dd93d522fd1b3c8d996ee91b71084cc79d051", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205669, "uuid": "d85219af-25c8-4666-ba68-e2f20e967be3", "comment": "Malware payload", "value": "5ecd304b0b1cb25545e5b63fe91fca03c925addc", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205669, "uuid": "0f63f4ab-c60a-4183-8ca5-93debc06ed3e", "comment": "Malware payload", "value": "c0f862fc71a09b660507c46b1687dd9c1f367cbe46baacb245d949b87bba51c4d68361e7706424219410e5b1a189d9f3", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205669, "uuid": "db6056bb-8e41-4ba3-ab8b-cdbf995009e0", "value": "T1ACA57C9BFBC48969C8F383B14839536569079C348B5396879D14367C68BBAD03F89ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205669, "uuid": "6e3a87ae-9512-4178-9e35-29aeb2b7e3c3", "value": "24576:56rVzgdFQpgnZWt+fak2hBlGUl+K2NVZHoe32Xy2/Psu8yR2ge9h25JuHBql2PcS:ldFQpgQtPHhzBUZmXBEqR2ge97c0Kf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791205669, "uuid": "9131a2f4-6816-4262-8289-5de9c1cbbe56", "value": 2193833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791205669, "uuid": "0c2bd8a5-2e00-4e7c-a32e-5089fb0d91bf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205669, "uuid": "4f117a64-c069-45af-8bde-eea85f72de9a", "value": "base.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac55c7c2-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218944, "uuid": "af344887-28f2-4262-bfaa-4d7d06252c03", "comment": "Malware payload (Mirai)", "value": "3573da7a541ece1e069c4bba5fd0c654", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218944, "uuid": "036e721a-efda-4b68-90c8-5a3f1ae60ad2", "comment": "Malware payload (Mirai)", "value": "b87c08f716af89da168b020bc052d182d9245701735999317e34b98611e34317", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218944, "uuid": "9c5ad16e-91e0-4821-91ae-40d7211c74a7", "comment": "Malware payload (Mirai)", "value": "72acba60e329b20a1f230af2e8bc41918727cdbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218944, "uuid": "f98fa8d5-e2f3-4f81-a625-3a17a13d2f1c", "comment": "Malware payload (Mirai)", "value": "162d39268309cdf39b90252c2ec6e55cb329a4d2d22c64c9ddfed4cdc9f12577a892575b28eae972e3a35c4c36e4999a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218944, "uuid": "c1fe77a1-bc00-42af-b62b-1c5b517fc5fb", "value": "T16554190AAF910FBBC8AFCE3302ED064525DC540762653B7A7634D524BA4E64F59E3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218944, "uuid": "7d866b85-3a7f-4e42-8a2e-cc2eccdc719c", "value": "3072:T0L7r7L7auIKIUpUNrMVH+1ywbf9tJiJFzg8fJDqXjYM3KhZUxwq/Shmbv:TNuIKPpUNrCsbf9j6fujYguZGKhmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218944, "uuid": "a067ecad-84f9-4ae3-ac32-666adf039abc", "value": 296780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218944, "uuid": "ece0f5a4-0f4b-4c7f-807e-a42d2b67636c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218944, "uuid": "6658ad68-2e4f-4ca2-a99f-8c96e77525bd", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1171eaa-c112-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791242171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242171, "uuid": "8c465379-031d-4909-a06d-4fa654ccc506", "comment": "Malware payload (Mirai)", "value": "e7e4dabee491c607b0ff7cba56a98a79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242171, "uuid": "dd436f7c-b510-4292-8c9f-6f2509e0aadf", "comment": "Malware payload (Mirai)", "value": "b94bab89a61fabae9b1cd58eb6495990b915e03d19e28dd618780123f2c10446", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242171, "uuid": "9ff46c6e-f39c-4a21-9b46-d14f55b7f531", "comment": "Malware payload (Mirai)", "value": "146b70f1ae256d6aab35d397441df6c5ea19f0f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242171, "uuid": "8e1067e4-673b-4c02-aae5-ed763a8ce8c0", "comment": "Malware payload (Mirai)", "value": "c4b55634468a0a5663c9e22910cb0b378a9bdc58db6cfc112c067687643c16a3d865c62adf609f6089c87550a5c82f9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242171, "uuid": "4b7c034e-c415-48e3-bdff-6b630e77a643", "value": "T156B47C42FBA2DDB2F45200B11617A7615632DC351537D5D3E3E62DB8DA306D08B2A3BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242171, "uuid": "f5a7339c-8e41-4966-886a-12033111986a", "value": "6144:h3jRW4oDJCXLCQ3F2+562xmvxUada6q9Q5qGPR5eLR37EA6z5FTgWDol6aWsrCAd:P13FN1mvKoWToWX4B66aWsm60E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791242171, "uuid": "29ccbda4-664b-4ef2-82b9-f9a1cb2a46b4", "value": 504656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791242171, "uuid": "b399cb99-5a43-4f89-af50-550a41dc0bcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242171, "uuid": "8c4bb5ef-b2e0-4a3c-b41d-2ed09c9ff613", "value": "eclipse.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a4ece1-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181667, "uuid": "f6666d0e-18a6-468e-8a7d-be5cd5458740", "comment": "Malware payload (Mirai)", "value": "d772eeb715391d9b3024c884063cb49e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181667, "uuid": "6fad2e12-3347-4e38-80fe-3aff4bcb3168", "comment": "Malware payload (Mirai)", "value": "ba018fd984765c34bbfa2223a391b5373911c5711f6473b314695943a38eaa1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181667, "uuid": "b15f16e5-1ea6-4080-b984-c1d13e065d43", "comment": "Malware payload (Mirai)", "value": "d288b6ff8b5aa4a5acb8aa09f1c01e734808a90c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181667, "uuid": "851d88d6-1866-4e3d-b7f0-56f176990734", "comment": "Malware payload (Mirai)", "value": "0a4b83a0c232ea5c5122952dfbb7eb4bbf9594976de0597946735cd38c6e77f329b09fae6af904bce495296a07cf074e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181667, "uuid": "a25ad5b9-02c8-455e-a15a-ec529aa51316", "value": "T19CB2D0717025B8B687E500B7A9E9CA83FB800EF8D0E873295469099DE6D5942BBF1147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181667, "uuid": "7dc18fea-a835-4570-ad67-26172c324d6c", "value": "384:cZ0X9nxn8o9ir/nSdoijsN2e4JQkCD2EjKb3pjhymdGUop5hq:5X9nxn8o9wnBoWzEQf2EjKb3pjs3Uoz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181667, "uuid": "2c72b217-5cb2-47e2-a1e9-28b574c7452c", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181667, "uuid": "1a5348cc-0ee7-47ba-96bd-cd14b167052e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181667, "uuid": "93196569-a88e-41c0-8e71-a7b4aad6194c", "value": "87sbhas6as.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25c44ef-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181614, "uuid": "0ca9176f-5568-4c75-8430-7dcbf9a365bb", "comment": "Malware payload (Mirai)", "value": "f44ef7d4b1cc8fd8239db78764fd39a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181614, "uuid": "f37932c5-8e50-4b7d-9c9d-8628cb7de833", "comment": "Malware payload (Mirai)", "value": "bae39f8a68e0541ebcf652ab0d674192b0b1f257fc1c335bd246142707ab86bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181614, "uuid": "5751c378-605c-494d-b741-d05fa910ac05", "comment": "Malware payload (Mirai)", "value": "b5079b0c7bd4d6cc28822469f507144535e7e92a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181614, "uuid": "223a79ae-567a-4819-a6f6-463552573a60", "comment": "Malware payload (Mirai)", "value": "267f8930e0f9d358c65c546cf103c770a0efb07ea84a55b76135fdb64317e7b941a3b24c237955dbd1471781cdb7c911", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181614, "uuid": "4a160726-23e9-4813-88c5-f0ed94d9a9fe", "value": "T116B2D009C0AA6E74FEE7BD395941E2817F619ADF7B628DC026C15B110622D281F8CAD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181614, "uuid": "141e1514-bb63-412e-afaa-c4fba1eabf81", "value": "384:2A0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIoGxQM4uVcqgw05Vxg:oApCdvwJr69VJoA8FZtxCo8FP4uVcqgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181614, "uuid": "c0c2199a-c090-497f-b283-ab5b7e3fa14a", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181614, "uuid": "00fca6ed-d808-47ef-b382-a6c0d5cea06c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181614, "uuid": "3cbfb517-88ba-4750-93d6-4697bc5b8da3", "value": "87sbhas6as.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ed78f9-c0bd-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791205719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205719, "uuid": "fa069910-d935-4103-8a28-21a3aa64411b", "comment": "Malware payload", "value": "f6c979198809e13859196b135d21e79b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205719, "uuid": "e4d68459-81e8-493b-bab9-f4623a38ac9d", "comment": "Malware payload", "value": "bb9c6a6c84f26f5d98332089f90a4bfa735cbcc984a3f49e2ca8124db9d1600f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205719, "uuid": "1a522d7e-922a-401c-bc3e-96226c12efa4", "comment": "Malware payload", "value": "84c05f590e9a5fe65ed34986900cf59334c7fbf5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205719, "uuid": "5f316152-3439-4138-b997-39ca3025d21e", "comment": "Malware payload", "value": "43a14ebdbfb0946884d17e187a2cc184c9ef55f8375816b4edeb89c85bf5215fc438d1bde8e189e98e5879214822256a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205719, "uuid": "851b8f93-0a7c-4b0f-b64d-3a176e62e42d", "value": "T12C9633B1D026CF7FD42B5BB97823E544BEA326F48AF93DB958140210E45258AC371EE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205719, "uuid": "b5571b84-b1ce-476c-89f2-78d8dd7e53a8", "value": "196608:Byt/k+ZDXp97NQtVMgC3101tlokzgO94DThLow1xKeD2smkWo8Fj6FpDDP:It/k+ZDXpvuMgC31wg3DtLZKeCKO6Lj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791205719, "uuid": "acf5d67d-01fb-4144-ae52-49f35be4a6b5", "value": 9470945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791205719, "uuid": "a0b35876-d042-4779-89b8-a72607e061e5", "value": "application/vnd.android.package-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205719, "uuid": "686e4248-959a-4554-96f6-016750e227dd", "value": "INSS_Reembolso_v5.0.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8edd35d2-c0c3-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791208157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208157, "uuid": "07845668-382d-4115-940e-9fa43b2ad314", "comment": "Malware payload (Mirai)", "value": "6ee948e2f6827305c908a0d511d9eedc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208157, "uuid": "a77f718a-6333-4abe-9302-71d57abb03ab", "comment": "Malware payload (Mirai)", "value": "bbfb4f9426852713f0bdf5b7b80d68548093277712059bf812f35ef9f327d0a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208157, "uuid": "ff26b4f1-eec6-4451-add8-0625aa0fcd01", "comment": "Malware payload (Mirai)", "value": "4860408a73230a69b9763193d11d8d3e02865c27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208157, "uuid": "1a28326b-3103-4d9a-b13f-ef6b4ba3d562", "comment": "Malware payload (Mirai)", "value": "f286a10552828ebc7fcda272397568e50047a649d850a87010a6cb3dca0a6a580f875f90e92bd986b963d5924edaba04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208157, "uuid": "a2b6b4db-01fb-40ca-849e-dc4609b1e185", "value": "T1910463BEBA11BB7EE668873187F26FB6C39521B22291D341E1EED6185E7014C085F7D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208157, "uuid": "02084502-76e4-4ba4-9af4-b4eaba7ce88c", "value": "3072:+dhJKUcLfU2V+vpO4PX3x92ZqxvzyaD6pSceS8a8tC5:4hJ/OOB3xzVD6pSceS8a8tC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791208157, "uuid": "64bd931c-d1a4-45fa-9e8e-32a0dd18809a", "value": 190091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791208157, "uuid": "39989ccc-818f-458d-97c7-fc700b0601b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208157, "uuid": "0bd4d548-08f5-4198-b804-5e6bc2b1a5d8", "value": "bbfb4f9426852713f0bdf5b7b80d68548093277712059bf812f35ef9f327d0a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd39af1-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181634, "uuid": "f31491c8-2d30-4b0a-b4f4-94857c0ff4d0", "comment": "Malware payload (Mirai)", "value": "9da1f0347e8e7479234ff73d547ea78a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181634, "uuid": "63c2b0fa-781b-47fe-b733-8535df003a30", "comment": "Malware payload (Mirai)", "value": "bc074063e6c06709e5d927d0a6b7d7563fed8365fc11c10aabf2afa582df6a13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181634, "uuid": "e4f85197-6165-4f40-8807-85c7a046c500", "comment": "Malware payload (Mirai)", "value": "9c0104bd27a17d20309675492abe21bcc72277ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181634, "uuid": "a1b61082-b7d2-4b3a-8df8-f10679ea6922", "comment": "Malware payload (Mirai)", "value": "b947b8b561092ba1ff1092bd868662b1e5d5dd647c42edaf0dc7ece22a4ded61ce9e156183854e9da538774578597810", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181634, "uuid": "b06f7e79-d40f-4666-868c-72d1b9494f87", "value": "T11353F1AB017FD67CD1A012F206D9DEB47AE7F4221E6D5E6A08F1237EC854128FD006E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181634, "uuid": "1444c946-2b07-4f59-99d8-4c4217fa6df1", "value": "1536:KtGTpI/Ywh1qqXTGYQYb7FffJ1kfP/ni2Oy:fTpkYU1qqXCoF51c/ity", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181634, "uuid": "52fcfed9-8563-4cbc-97db-ba8ae5c88e0d", "value": 64396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181634, "uuid": "e445cf09-55e4-4420-aa26-c190aef11663", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181634, "uuid": "02bf98ca-bb8d-4601-9006-c4a1bf9d6ea3", "value": "wife.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e494ab-c0c6-11f1-927a-4201ac107004", "comment": "Malware payload (OverlordRAT)", "timestamp": 1791209346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791209346, "uuid": "959e22aa-6471-4bdc-a4f9-83fd9da881f0", "comment": "Malware payload (OverlordRAT)", "value": "f44b817cc0264f3b4d971e1b8359422d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791209346, "uuid": "38ac98fa-e9ef-4680-bd13-e328d2c89dce", "comment": "Malware payload (OverlordRAT)", "value": "bc1f4aced516d10f5cfcd5663fa9b94c34f81d9a19cb391034f920de09617a8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791209346, "uuid": "7d1e261c-5d41-4546-966b-4150cae785e9", "comment": "Malware payload (OverlordRAT)", "value": "193a752427c3d7270b677b7be3248030d10a9006", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791209346, "uuid": "1832df5a-f648-45d8-8c59-2c987b729bad", "comment": "Malware payload (OverlordRAT)", "value": "5c406b8976debfea8adbf8f646d725accb29986fcf15c4e5612d13ba7de9090a2a77895e8a3c88b158c571693bab9f65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791209346, "uuid": "4d02f18a-ec6c-4125-84a2-25553f0e5b7c", "value": "T1C247332F7623FE53CDA4F1348A2C00F6E60790FEA91FF305186077224E52ABA66557D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791209346, "uuid": "e5d5a78f-450f-41e3-bba5-7fe78d59073c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791209346, "uuid": "e9c603a2-3572-4724-a4ee-cafb38996220", "value": "393216:b2VWKeebAxWGcL2KXOLSBSAbiWL+guvMQ5HjWQdNcmrk/q3lqNIT2IH7rjfQcAKP:b2Voev2K64BOU+giMQ5t/cbS4Nc2In2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791209346, "uuid": "e0888452-2e2f-4b0e-9dd4-b2ff75d6973f", "value": 24940323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791209346, "uuid": "b1f3c715-7c7a-4222-a7c1-f61d256ba305", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791209346, "uuid": "5e4b2e42-698a-4a61-833d-3587cb31c023", "value": "BTMOB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c33d11-c0da-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791218092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218092, "uuid": "e88e2326-5d16-44d6-b546-271b19f04d1f", "comment": "Malware payload", "value": "6e458298a1de0b53a7596d000dee5cd8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218092, "uuid": "7b231cef-ea86-42e0-9445-e46837a7d66d", "comment": "Malware payload", "value": "bcc4310318fc723f94cea80aaf2e4acdadea223670d1ef420494aad46e051dcc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218092, "uuid": "c3e59234-47bc-4271-ba40-83ffb08a0ae1", "comment": "Malware payload", "value": "ab444742a2e884d4f6617a07daef36952e6dc5ac", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218092, "uuid": "aabca01a-3b7f-4f7e-af97-3d73a1ef33f8", "comment": "Malware payload", "value": "7f596abc56a73fdd5e565f7e57a2e4fad60d9900399ed171af7e697c4c07a906fee2681fcdc31da00c18796169567b43", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218092, "uuid": "c85a2bbb-97e6-4efe-9c0a-1920ef1b37e8", "value": "T11021ADE5FA708C63F1CF502CAC5614018BCF4D2B47181E56748F6818777CE1AB456731", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218092, "uuid": "07ee91f5-e1ee-4c1b-ab6d-85b7ac285199", "value": "24:MD4O2Hsn9NIEZ8s6iSecy9fRVsSe7r3mK6N7gJCkK6+j:MD4/a3IESlyCS8zmrN7Nkrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218092, "uuid": "5dc0aa47-a25c-4e0c-b531-1662f2f6a6b1", "value": 1359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218092, "uuid": "8b5e7377-e78a-4ff5-8648-33fd5bf6ad83", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218092, "uuid": "769735fb-bf04-4041-84d9-f0da0b17c36a", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f702a860-c0da-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791218210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218210, "uuid": "af21d908-d283-4378-9480-fa59d35ed64b", "comment": "Malware payload", "value": "92dcf1a2a2905303a2c5dcc3830ef77c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218210, "uuid": "4e40c869-ff14-47b9-bf07-c0a3e7b0ce4f", "comment": "Malware payload", "value": "bd09f16c5eeda48e137bff6ac384ac0776b70c627aac15c13055064cbf53de84", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218210, "uuid": "3234c909-2d3f-4ce3-8283-797300cd6a72", "comment": "Malware payload", "value": "8fe1ba407d14d82edc1ceee5b08a0499f09a6117", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218210, "uuid": "7e3cd40b-7a12-439a-8eba-13a30bcd8f24", "comment": "Malware payload", "value": "3b868932f9d2174c63897cd47bb8c4f50d24f2c5dded054af2c5b792ff10f27af6f757d390085cacec58a6ab03b9b990", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218210, "uuid": "3931253e-f04a-47ab-8630-51a8c1d686ac", "value": "T194513CC60284AA33E759E60D77F0B1B4911B60C397DFDA08FF80692D9FC5A4C71A6B90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218210, "uuid": "ce4f6e42-2e25-4c4f-93ca-be8047e8f3f4", "value": "48:qRDono6oMl2UnanT8109jMnqPjzDnDuZUlnzz5O5hM3IQO:CpMl2jDuZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218210, "uuid": "07770ab7-7c21-4ff8-930f-05b5f25a8e93", "value": 2892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218210, "uuid": "b380f239-69fd-45f6-a143-a0c143469adf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218210, "uuid": "4eb5f5ed-841f-4d15-88d5-ef4f537938fe", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4978c8c-c0e8-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791224111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224111, "uuid": "1b4b03ca-29ca-439c-84e3-73cd4b782c22", "comment": "Malware payload (Mirai)", "value": "f1e592d83b8443cace3e8ab85fd6f74b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224111, "uuid": "b6ce9184-82b4-4c99-a4fc-d6c30e6ed296", "comment": "Malware payload (Mirai)", "value": "bd94de73b98fdd78c24a6fe2ea5df890e78283279bc1fa6ca4c2a3862deccf61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224111, "uuid": "7507e56f-b624-485a-a5c2-e87610e6ab97", "comment": "Malware payload (Mirai)", "value": "8e83ac457fffa4cb951673182dc19bbd707d2a70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224111, "uuid": "ab2ca696-791c-4b20-ae04-30c49b5dcf6e", "comment": "Malware payload (Mirai)", "value": "b5b0fa886435efc21204a76b0179413b0b52c85a9a642f88162ab30edd44e888166833ade8916ec50c1a5ff1146abb56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224111, "uuid": "7149de64-e160-4042-94c0-661c3455f6ef", "value": "T16C6312A7EA50D649DE4643F6D101D2503EA7DF03F29BE825E861E9D8F80131EDB71078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224111, "uuid": "c38cad7a-72a8-4f89-b3eb-7f008b078677", "value": "1536:TiIKPyL4OeS25E10BtanUe7LScT5+6ldDKdlLSQr1KOP16Ubx:eBPGcS20it8LfXyFTr4E6ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791224111, "uuid": "15921841-b0ac-4b70-b8d7-2b78d25c4bc7", "value": 72392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791224111, "uuid": "cf2cc025-1d21-4688-9d6d-cc737c107af8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224111, "uuid": "4253a1f6-fc99-4744-813d-1ba17f35123c", "value": "xnxnxnxnxnxnxnxnarmv4lxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "145383d3-c0c7-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791209669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791209669, "uuid": "110cc696-987a-4d35-8c60-fa2e6841bedf", "comment": "Malware payload", "value": "87fb7faaf553fc1fab8d2488c95bf264", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791209669, "uuid": "5dd02fa0-a9c7-4188-bb2c-8e8e7797d509", "comment": "Malware payload", "value": "bdf4c5d3540ec4021d3dbe3c7f9e06963002c23a048418402b03b55c0b07170e", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791209669, "uuid": "45f2ac9a-bac6-4fb2-9c66-9ccce3b93a1b", "comment": "Malware payload", "value": "f68aecff9ee25d96d112fb9a5544fdb9a4c09b70", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791209669, "uuid": "1465f64b-15bd-42db-b96f-d28383899dbb", "comment": "Malware payload", "value": "8a465e20b48cd0301306c73ce52b6780819ced4bc4758c1d61e73dfd8a72cd750bb32410dfaf2cd03a422898a9019b3a", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791209669, "uuid": "013bdc07-9cf0-4951-87d5-3b0158e406e5", "value": "T113463352D17B0C1BFE208534A3C6B7972E10B7E38DA907AC5A4D64CB76A771A407DE32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791209669, "uuid": "f922ee46-68be-43a0-afd0-cd0031259431", "value": "facdcb0705b82de99085799bcc9232ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791209669, "uuid": "9b8d9d3c-33da-4077-9658-e118feefcbc0", "value": "98304:/nOGfOaMeew+Whyp72/N1p0HD4ROo6zEVAXKA90or7odQiSqj22yMTAXfK:Zf1Mw+WhyQX4o6oV3o13JiwKTqfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791209669, "uuid": "46bf6a65-4079-4c8f-90bb-15730e21aae6", "value": 5731376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791209669, "uuid": "113a37c4-013c-43ad-bbf3-418eb1dfaeac", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791209669, "uuid": "20c19def-c1ba-47a5-8c03-7344d64bf555", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b318c470-c0e8-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791224109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224109, "uuid": "fe9eb133-89d6-4852-a56b-f5823acf0e6b", "comment": "Malware payload (Mirai)", "value": "134bdfe00b3522a719218578d25e9009", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224109, "uuid": "b448e79e-a2fa-4eac-8234-50a3d1ecb7c4", "comment": "Malware payload (Mirai)", "value": "beb8fc23642d33a906014cd7cf01d1f24de32b0e4939df4d8ed0be93250f4cde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224109, "uuid": "73dbf48e-a3a4-4899-b0ad-b9bf62cc5ac7", "comment": "Malware payload (Mirai)", "value": "e9b6816353779ea8fd86121c368a0936d8e55438", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224109, "uuid": "f61c5b2c-99ff-4844-9655-b304c8f6fc40", "comment": "Malware payload (Mirai)", "value": "561f6947fc09fa4db12d503bc054bd3de1aeec2b98e1f5ebfb19e7dff2c35dba8264161928e7a64505bed45c874cac6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224109, "uuid": "a97843d4-c35a-4180-98bf-67d2c715771f", "value": "T1706312177D688655BD2986B7B5377B789158F0A04BDF54A11213826860C20CABFFFF2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224109, "uuid": "f5b25bb5-ded8-4930-b7d4-6c4a06976bae", "value": "1536:ugnW5NG+vLspULQheJQ61dh3gzx7IFLTqa9fKA+T+b9MgSLUEnrPI:jn2NXvbLQkJFLIynmJLYMrPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791224109, "uuid": "c935ee74-8313-4fe2-91cc-e3f03deeb5d5", "value": 71892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791224109, "uuid": "d1764294-bdbf-411f-a912-bb7cdce0aa36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224109, "uuid": "b8112f8e-c855-465a-a94e-c878ee6f670f", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d94f27-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181617, "uuid": "db0c1845-e7a4-487e-9f91-670c1bf793cb", "comment": "Malware payload (Mirai)", "value": "98e2ce80c899b9b5ce9ad2b9c64432eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181617, "uuid": "18ea6c62-8528-4c1c-a752-2bed36a635d9", "comment": "Malware payload (Mirai)", "value": "bfad4afa81607551b61bc69a8d5c87ccb9e26488bc55e9c867eb7faccaedc880", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181617, "uuid": "5aa97a99-2e63-4d22-b4f0-546c8b1ad06c", "comment": "Malware payload (Mirai)", "value": "fb55891012d3e00511c84fb083f9676623177d97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181617, "uuid": "443f606b-4b67-4519-83e0-fbf5221fe26b", "comment": "Malware payload (Mirai)", "value": "a7576c43d8223f45c0a29cc3f765722b02b937e1373014a5df92a758d0e4055e8569875d9e85e404d8ad9cd839c9f474", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181617, "uuid": "bfbd50e9-0add-4a6e-ac4b-fce473ed2a5f", "value": "T140330A734A7DD607D0C2A63602CB8313B1BE6BD21318894F7C554F5E2AA07D4266BBED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181617, "uuid": "37a4a064-5a3c-4dca-a4f4-d56237da3b10", "value": "768:sW5oUphip/tQBbvjnvktftQsFglrcnaiaN6dAskby1PEPmxEHL:sW5NphipQpsFglrwC321SHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181617, "uuid": "2a0089ff-7c39-4714-b7ba-be7a56e3da49", "value": 54136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181617, "uuid": "d6cc54e2-aeba-4cf2-9549-5cc76a829087", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181617, "uuid": "f2de45d3-d91f-4dce-b75e-b0f9149019e2", "value": "wife.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0e4ab8-c116-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791243960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243960, "uuid": "1c9d1223-47d8-4384-901e-74bb5159072a", "comment": "Malware payload (Mirai)", "value": "842982bc403abcd1d83db15155d52cb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243960, "uuid": "b5e115ea-aac3-4101-a997-779d157fa51b", "comment": "Malware payload (Mirai)", "value": "bfb3437a4f982cccb3af62ba7b6a0a6139cebdd5d278fa64dba0650e57c10b43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243960, "uuid": "19fb00e2-763b-4790-860d-2dd998f0284a", "comment": "Malware payload (Mirai)", "value": "70d6f53a4a27493f15ce91ea070406147ab3568e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243960, "uuid": "5a213382-15e6-44cf-af93-1ec73edcb260", "comment": "Malware payload (Mirai)", "value": "43fd99a2cea55f9d2195ab968ca4e3e5bd46dff35c23b202c50597fcf1f5abe404bff005192d9a8007fe7c9363a131cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791243960, "uuid": "25bab533-b24a-40be-a115-e517301314ac", "value": "T134C47C02AAF7D8B6F4A340B1215517754963D97B247BD94BDBA62CA0DE301C0E32D3BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791243960, "uuid": "a4e4490e-6ce9-465f-9d47-8e9707a22c75", "value": "6144:3W53ZZwoBfKfvxW3/vvGqwUqvE9yh6nn3wudhbjOlQsFJP+:GHZwoFKfI3uM9yh6vQQWP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791243960, "uuid": "82e37aad-4dcd-45d5-bbbe-96c186c771a8", "value": 579032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791243960, "uuid": "4ce9b5d0-d191-4480-8cf5-5e4c25319aaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791243960, "uuid": "1ea67c21-d680-408f-9c22-b31ad94cb986", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5df716-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791190729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190729, "uuid": "125be4ed-465a-4c76-9b8a-928a4894c809", "comment": "Malware payload (Formbook)", "value": "88db17a6d407071cab4cb654133c116d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190729, "uuid": "025d34db-47df-4f91-9e6f-766a58bbc029", "comment": "Malware payload (Formbook)", "value": "c035b3bfcd8c50272a2e48d7f9aecedcc4b4699e96970b769235e01084edae95", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190729, "uuid": "79341b13-384c-4463-9d78-ef364801cb60", "comment": "Malware payload (Formbook)", "value": "6373e6562880a70dae7a6c4c59a9e21edad5dc3b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190729, "uuid": "f9a49ad7-dd9e-4034-b0fa-278047c6b2ba", "comment": "Malware payload (Formbook)", "value": "7889f184e6e2f6aa973aa763af6f4d9a9c6c2d54cedf23ae0105ae507ca5d48bd957e2f0ca621a368def2bf8f6f74a0c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190729, "uuid": "bbea6f36-b063-4445-a537-cba8d44a1c50", "value": "T12BA5F11049C03FE8EB7A561841BD552DE3B20A9B482D698ABB3FFD45AFF7504C3071A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190729, "uuid": "592821e1-d94b-4dec-b795-b696e2d6f156", "value": "24576:cO3hIopJlNyBBqYS+YYcg2c+4tXuSyPYdAGxNoq+yrc3qPlgO5jCz40I5W4d:cORSIYtl2Y5u5PYOiXonyjCGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190729, "uuid": "dd50bbc5-4800-4e1f-a6d4-8143e8d1f884", "value": 2096044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190729, "uuid": "688d9f60-9049-4be1-b9a0-f2ccbed23831", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190729, "uuid": "9d9aa057-03a9-4fbb-b3a8-4439a5d6f8e5", "value": "SWIFT SKM850i26073017605.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99daeafc-c090-11f1-927a-4201ac107004", "comment": "Malware payload (GORAT)", "timestamp": 1791186271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791186271, "uuid": "9583121a-5afc-4d76-acd7-afd5ccc28e64", "comment": "Malware payload (GORAT)", "value": "891b4554e82840c4fd606d944f87c8cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791186271, "uuid": "415bad27-0e39-48da-9b27-31e02f3ce9a4", "comment": "Malware payload (GORAT)", "value": "c05a49f1183b96574f47cf0cc5b88f81e2d7fb2e66a11e921782a18f78214a34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791186271, "uuid": "eb077934-6351-40b7-bca6-db74d61d0b5e", "comment": "Malware payload (GORAT)", "value": "3a602d1bad61ffce88b6b3b5aff8ec1028e8c21a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791186271, "uuid": "989e178f-79f4-44e3-ad59-398374e1477d", "comment": "Malware payload (GORAT)", "value": "b0557ce346c8c29e1ee1c5170ca1dd594a1a3ba7d5c787b9aace814e7690b3868b4163e1b798d893a736d80d6d4bf9db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791186271, "uuid": "0897db4f-7ccc-4947-bf8f-c9fd2d0714c2", "value": "T105363B17ECA155A9C0AEE534C97292937E717C485B3123D32BA0FB382F76BD06A79344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791186271, "uuid": "353efa68-a4e2-446e-a028-546db72d029b", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791186271, "uuid": "06ac5661-47e2-4c3c-be60-449d5c1286a0", "value": "49152:6OXB/UM0+b+VuJkTSaRxiCWZiQUitf5Edc2Ebv0QCGErXNMHx9iW3J:dVytuJkTGCWR5EaKrTNMx9X3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791186271, "uuid": "a7c341e2-5724-4f9e-9c58-bcfd430d8f88", "value": 5010432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791186271, "uuid": "d87d7063-09e2-49b9-8bfc-87ea7abf9acc", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791186271, "uuid": "1573471c-20d5-492d-b1dd-487154357b45", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c95fd17-c05f-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791165203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791165203, "uuid": "624d6808-7045-4f25-b914-4aef17f224b6", "comment": "Malware payload (Mirai)", "value": "364d26917fc6d649c1caf7bb173a5848", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791165203, "uuid": "e911c2f2-1044-46f3-95b1-5254850d26fe", "comment": "Malware payload (Mirai)", "value": "c072653018239d92e9cd55e62813d712dec27ebb0a4bf17cf0398fc5d5a905cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791165203, "uuid": "d7896d88-9ea2-4b0b-9bb9-ea24a7d2a242", "comment": "Malware payload (Mirai)", "value": "4ca86404462492edb02cf155c20fb5cff64fc91d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791165203, "uuid": "6d9621d4-6dad-4de0-9d21-e13ea90ef1ab", "comment": "Malware payload (Mirai)", "value": "6d1f0572eab5d72c8a2c81f88f6239805d229f1a3b909b5645d9782a3a701ead4602e1c9c3394655f1aeb3c1eab2a4c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791165203, "uuid": "ba93220d-ede4-41f2-9ef1-de8797148930", "value": "T18AD39349ED68A73DC3E372FEE75902CE333A1B9877E671219E314A953BC8B916435120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791165203, "uuid": "9fe8bbd6-0f26-475c-bb74-94d85acbe881", "value": "3072:Z1hcuJ3i9qQiNn1bx3qVqyD7SD/v+Kd+GiF6jh0JdPM12:XvDDQF4AdPM12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791165203, "uuid": "0d2b0757-887b-4197-bbcd-2ae047b5e39a", "value": 131344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791165203, "uuid": "fa1b36ac-f067-450d-a194-118d8978478a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791165203, "uuid": "e3f19713-258f-4d0c-a52f-e3d54203d298", "value": "winki.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a9300d-c0fa-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791231846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231846, "uuid": "6575b18f-9da6-4fde-a0f1-87c84689c861", "comment": "Malware payload", "value": "861983acad9bcb13edb53f0a4057b553", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231846, "uuid": "4b38ef3f-a63e-402c-9c6c-413ef561513c", "comment": "Malware payload", "value": "c0b4d383c4225e4142c1d738044dc1c1f42854727bb89dbaf32aff0cedcd488a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231846, "uuid": "2a2ec900-c93a-48b8-bbb7-ed5be48bd4c8", "comment": "Malware payload", "value": "b179bd01b26cfa284a24c7696cd5361078d62871", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231846, "uuid": "73288239-edcc-4bda-a252-d5e5817faf87", "comment": "Malware payload", "value": "2c503cc90898e5fa41d049ff36adeba5a48dee8e5774468542a32f7532d70d5e17382676e76a6d1b22bc1ca0adb4ff1d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231846, "uuid": "5ab7e2f3-ddde-42fb-bea8-44936037aa19", "value": "T118753302AD68A413FCB342748B9D63EACACE70160D849A6B5D755321CD5FFD80E3C5BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231846, "uuid": "59122f56-bbe0-4337-9b4c-e47aa4480567", "value": "24576:7t6bHKuDE64v0SFpMEAIBoESHxtphC+D0cVTNA4RUr1m0dJ4103zfPTl3/FkaWs6:7Gquo64v0kp7GJhLD02+4+rxdemjp36Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791231846, "uuid": "0a4940ad-08ac-4ba2-b067-6ee0b8197a62", "value": 1584470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791231846, "uuid": "4345c8c2-41cc-4750-ba4d-1eb1b320744e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231846, "uuid": "fe459a16-bd89-47ed-b5f4-a43e7cffbb31", "value": "c0b4d383c4225e41.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2303404e-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218713, "uuid": "f7a2b1a9-475b-423d-b3af-a5e74355d6e5", "comment": "Malware payload (Mirai)", "value": "3cdb806f4870a653ab7a5142202a54bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218713, "uuid": "27d31971-76b8-441b-8831-753443dd7107", "comment": "Malware payload (Mirai)", "value": "c154fb0fe96b72ca99c0b7034a4590cac89bb7f80314a57a2e14f95e427bcf90", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218713, "uuid": "8884f246-ef8f-425f-b430-bd11b71ad13b", "comment": "Malware payload (Mirai)", "value": "968faa3f4aefdb20acad0ef4acc80538a30dc26a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218713, "uuid": "9d5d551d-d1eb-47f5-9322-7da351012b22", "comment": "Malware payload (Mirai)", "value": "394132239bb1ea93c23bd3d333fc4903bdaf4c1b642789257b592114f5177a7fc57e87dbb53ed8a36131b0393943e9b5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218713, "uuid": "7177cc5c-d434-424f-8405-5a6b5be3c7ec", "value": "T13CE3E7D7FD00DEB7F40AE3B644A308157130FFA60D525A73722379AAE93A0D41467E9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218713, "uuid": "0e94ea3f-2ed4-446c-ba0d-704b262581fc", "value": "3072:2qgAGUNSuz4n3rGso7AYDte5mVNjbi1L6yT7yesBmu:2NPn36saxe5JLDvyeVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218713, "uuid": "e42b502a-65e5-43ab-8e26-7776ad5eeaad", "value": 149104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218713, "uuid": "03229b9a-9ac5-4c4b-9f86-2a0d6ceb5ed7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218713, "uuid": "98c0309e-3764-4807-9a6d-f5449b7c13a3", "value": "eclipse.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6576223-c10b-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791239227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791239227, "uuid": "72e091e7-a60a-407f-bb10-16335e9d4811", "comment": "Malware payload (Mirai)", "value": "003a4b0950ad88249031c7144cff5fee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791239227, "uuid": "249a6b22-274c-4d9a-932f-848a2aaa5ae6", "comment": "Malware payload (Mirai)", "value": "c161490884a5c76b473b9aa75896b2f13291001234011264f47ea76bc7d95c24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791239227, "uuid": "411a89aa-1509-43a8-bc6f-a72efa435296", "comment": "Malware payload (Mirai)", "value": "a86a0332f2e9b1dbdab1b884254f5f21fa2bd673", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791239227, "uuid": "37c0c6c6-172c-4564-859a-d2805a0f0b2e", "comment": "Malware payload (Mirai)", "value": "8008b1b7f666b617acd768b5855e64d2235c981cc12dc809ab5013168283f9e7ad7ec2300992ee1470d51afb41fdcfc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791239227, "uuid": "4007ff74-16af-48ce-9e0f-857815ea570c", "value": "T1F9C3E946BD118F13C5C321FBFBDE42987B166F6DD6FA31029925BFA0374A4D6093A212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791239227, "uuid": "9738352a-df21-4032-a501-c7a15075e6f7", "value": "1536:sC5U03kIOypr5AYpVE4VWtxs7ZpkuRAl/G4QPztNPlngwywhUoSxPxKbjUh3Ormm:sCdFpr5o4ySlpk1GpDaXo5EC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791239227, "uuid": "88285557-4087-4abc-b7eb-afa9459dfecd", "value": 125076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791239227, "uuid": "82905e59-3c98-4ce5-a762-9102d3256428", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791239227, "uuid": "88c993d4-77ff-4f05-9636-d815b14aba9b", "value": "SecuriteInfo.com.ELF.Flooder-AEG.68463728", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924e465d-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181963, "uuid": "a3a4d45e-6dca-4bef-a56f-f12092852360", "comment": "Malware payload (Mirai)", "value": "712aa4452cebdd2ff967f3df79312f30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181963, "uuid": "bf7a7965-4e5d-4e95-8db6-b262bf81f7fd", "comment": "Malware payload (Mirai)", "value": "c25148243f4909b2fc1e93f00646b9d1cd0264ccd17d86493237fd2ac36f8d07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181963, "uuid": "8f057382-597e-4e51-a6cf-8889bb25db13", "comment": "Malware payload (Mirai)", "value": "0e424c876e03aacc5bad1825c8f4ad335e244a27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181963, "uuid": "54f9780d-1d21-4429-b943-c920ac68386a", "comment": "Malware payload (Mirai)", "value": "195538d0ee66c8403f19b448e08255bee515b8b9e183e00a68572b6d8437fd40f6c6dff89e01af919db4eb6318deb4b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181963, "uuid": "04ada11b-c2b5-43b0-8fc7-3f8e34298865", "value": "T105533922A9792E17C0E9F57B21F78324B2F5670E24A8C66E7D320F8EFF1454065076B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181963, "uuid": "51a68d68-cd36-4dbc-999b-ea32766fdd75", "value": "768:47qtsAOUAoMq9reCYJr4ukj8J4JGCgY+dVU5mp5Ci0KrSGO+h9spF40:wqtsGAZSreC84Bj8J4JXgY+dVhIEhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181963, "uuid": "0210bc02-f8b4-4150-a26b-173be9662c73", "value": 62484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181963, "uuid": "08b9b961-3ae7-4ee6-88b1-56c21ecda06b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181963, "uuid": "63f78da4-dd7b-4560-a350-4b3959cd9b3b", "value": "mirai.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3453adc3-c116-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791243653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243653, "uuid": "30f0bcf7-1a04-4388-87f9-7c508c06637f", "comment": "Malware payload (Mirai)", "value": "3ba751d7848923731bc4b5bf9b368fa1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243653, "uuid": "12416272-27d1-4fb8-9da2-c7bd4b8f9dd7", "comment": "Malware payload (Mirai)", "value": "c3d15fc99d9197a3c363b48fb0245d63a5d6380abb48581529733b5ca5ea477c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243653, "uuid": "e17735f9-cf9e-4a2c-9138-b49819d67f92", "comment": "Malware payload (Mirai)", "value": "a0ca0033996e97c8d2a144d7fa902a364a0a1bf0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243653, "uuid": "32436439-fed7-4f5b-acc6-15a0174a68cb", "comment": "Malware payload (Mirai)", "value": "fdc5299c0d1d0dec1b8c3e1729083cbc5cada44cd8f8f78d8ddbcd1f1d5961c6f8aabb52c2a17e034a330e1466e3fc25", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791243653, "uuid": "32e33b3a-5f2b-4d90-be67-5a4bef99462f", "value": "T16562697B20F04B33A7D014C9B2771B654FB29A1B456714B8F4BE1A255F5DA0370EBB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791243653, "uuid": "f6cf41f1-471d-4859-b3c9-de4490d5a2e0", "value": "192:cCuG6p4hvZ5m5FG4j4HKNphvF88ifkJDaKMDaKYfF:Cp4hvZ5m5FGGoKNphvF88ifMaK2aKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791243653, "uuid": "9098579d-8f81-45d4-a335-0c2f75c8e86d", "value": 15330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791243653, "uuid": "e604eb69-1acd-4136-8eae-367162950fd1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791243653, "uuid": "71b7cb41-bce5-4b05-a1c3-aa7e3b46463c", "value": "c3d15fc99d9197a3c363b48fb0245d63a5d6380abb48581529733b5ca5ea477c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953ef3e0-c07b-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791177244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177244, "uuid": "f102e550-595e-4e7e-b8d9-0619a64934e2", "comment": "Malware payload (Formbook)", "value": "6725eb27534cde40431bb5438dfcf0c9", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177244, "uuid": "90372972-e260-4172-a45b-47e0cbfc01d8", "comment": "Malware payload (Formbook)", "value": "c3d3575f71a08110a2131bd27ddbf07fd86fec364d91895460b02c19c12db83b", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177244, "uuid": "c2c14a40-a7d6-4805-ab9b-994d84c8f72c", "comment": "Malware payload (Formbook)", "value": "a0fa73b54093167149d125a3c9ef58d85c812ca7", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177244, "uuid": "7523c58e-4939-4bea-a717-a4b5eae730e2", "comment": "Malware payload (Formbook)", "value": "110aa07867e92516ea92a0a49b4c1633ecdae0ec5de852c3f36a5656817b4949fd3c1843a9844056350758629eb2babc", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791177244, "uuid": "ac90f84d-ceba-4f6c-b1bc-15eeba4bf63d", "value": "T1BFA5F15488D03FE8DB76561880FD962DE3B10A9B4C2E694AB73FBD45EFB7500C2061DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791177244, "uuid": "ec1201bf-b32b-4425-9779-15187d1b3288", "value": "24576:SXwfIFVl195nHw9XFHXt6di+q2FLfUkSibjNudH4tmt+n43Y6ipC1ACuQhmj+mNf:HUVfsFgk+lNUdi3QH4tq4VxG5dhTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791177244, "uuid": "a9d687cc-bba7-4085-bbc7-be8d6cc6da70", "value": 2107396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791177244, "uuid": "c8fd53de-760d-4f4d-8e0c-251e4d670e29", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791177244, "uuid": "31fea493-f8d3-4ec8-92bc-540cd842d011", "value": "\u043f\u043b\u0430\u0442\u0435\u0436 \u2116 0086.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0bf9c22-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181639, "uuid": "78b9dc8c-4a15-4867-97fd-bb84861ea44d", "comment": "Malware payload (Mirai)", "value": "a0fc0e52dfa1ac83727ca5a7a4f52515", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181639, "uuid": "f9a2b3bf-c4de-46c5-8567-363fbe7608d7", "comment": "Malware payload (Mirai)", "value": "c3e039d3aabb0a6ff71501b02963ea617d2be189e0b9a3c7c41040f2cef44e5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181639, "uuid": "31211c8b-f9b4-4109-984c-886409c7aae3", "comment": "Malware payload (Mirai)", "value": "aa51963414492ee8a2b46a0d519f70ed3c4ea735", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181639, "uuid": "540ac7d4-a560-467a-b3c7-8e87272a7e41", "comment": "Malware payload (Mirai)", "value": "29fa230d9256b764e44b39ca5814da9294044922e91fdf822c92e020342868aeb61ae6621349867b9e1bf80d9d9f0c17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181639, "uuid": "fc8c0d84-9733-4baf-a4d9-20902c0542e2", "value": "T110C2E0981B4929D9D2F9C13C43A81B6C19B40F6AF809DC857CF8F7619D8E4B53027EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181639, "uuid": "dce87165-1085-47ec-853b-3330eb32ff4b", "value": "768:I2G214DFyosXqgvV9o1ndB08+JgGlzDpbuR1JR:I2GdDgosaaO1ndQVJuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181639, "uuid": "a79b79df-9c7b-4505-a061-ddae8d1e5a36", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181639, "uuid": "089fc9df-5027-4888-bad8-5ecd95c1a3de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181639, "uuid": "2e08b336-ef32-4fa9-86b7-288d19cd31fd", "value": "87sbhas6as.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc99023-c0df-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791220288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220288, "uuid": "00878e0e-6692-43d0-9acc-4ddd72144d1e", "comment": "Malware payload", "value": "cae0c4f70bfc0a5aa0a61885d22181eb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220288, "uuid": "b65e3a79-f3ba-4a2c-8673-377b828e9af3", "comment": "Malware payload", "value": "c43ce2aae65465c590e112d69a513c717e2a7b1c1ed9dcbf02451032464546d9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220288, "uuid": "2f249c55-0e63-48b8-98ff-e2b8c2488a30", "comment": "Malware payload", "value": "6fc3a7ac08b05af7778890554d69e69128b00d14", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220288, "uuid": "22083579-a66c-480c-8d38-87296877dd6b", "comment": "Malware payload", "value": "3ae26bf6c3797547e703e58763b6f1e82adccddbed019a6ff11fe48bb61af35bbf18356f94f1869a1a01ecd48c7cf754", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220288, "uuid": "688af8a9-76d0-46e1-9cb0-d6d503375df7", "value": "T13C564A13FCA555E5C0AEE23089729253BA717C485B3123D72FA0F7282F76BD06AB9750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220288, "uuid": "7588d91f-423a-45c9-8077-07a0bb42b8d2", "value": "49152:L1ll0teCH74l5zCyviPPZYt4vS7jM1RQ7qLnmjTFTgTHnuvxB8AVQZkpAewiZ2HJ:LfWEjAuuv5RtLnAeyrP+zM2k3LEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220288, "uuid": "bd7c8e1a-064a-4e7b-becc-07490ab0aa15", "value": 5976248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220288, "uuid": "84bfff88-83f1-4e09-9792-dda22e4a93c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220288, "uuid": "aa50c5de-747c-45f4-ad68-123b2847cf28", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa4ab1d-c097-11f1-927a-4201ac107004", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1791189252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189252, "uuid": "34f964ed-3af1-4886-aae2-1dc558585f2b", "comment": "Malware payload (PureLogsStealer)", "value": "dde46c09c8a6c57710e651572d5eb3a3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189252, "uuid": "c4c10a11-a8dc-4154-a2c5-d6ab04f64d84", "comment": "Malware payload (PureLogsStealer)", "value": "c45d6a65b9a0c4299199ff0767bc586657af2408a75a6eb2135682945c7d226d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189252, "uuid": "b77e9f84-7d63-4455-8026-7cc1c09acec0", "comment": "Malware payload (PureLogsStealer)", "value": "9667eae116722e5f2d044d1132516ddc069c3b8e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189252, "uuid": "56000c70-199e-449d-ab45-6bf88388542f", "comment": "Malware payload (PureLogsStealer)", "value": "2584e99e8703d65b3cd23b022ca73ff41d488019156e6fc8174a68a3709799e4e8b8a3972be4ae244f5515b70042c68f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189252, "uuid": "29dcb299-a47f-46ca-94dc-af67791be4a5", "value": "T15D6512141A4076A9586C8308DB1F4B0F61B09ED4310DD9CCD659ABE273EBE86F1F7E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189252, "uuid": "5c161bab-164e-4f01-b1f4-7316a2bc3d12", "value": "24576:HOXni6EvM1bHOeTQZaMdfQNMTXWxA1X3++RvphU9oVrBIS2A9WDrn8y3ZNG5mAa:kJ1bHOeTUaMdsAQqRhaSwDrhZNSva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791189252, "uuid": "7feeb9c0-b25a-4dca-b1ca-371c7dfb94ba", "value": 1504444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791189252, "uuid": "fb345aa6-3388-4696-8ca3-9ad6902745c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189252, "uuid": "d3402898-22ef-4eab-ac9e-6f9cf81e4ffc", "value": "Purchase_Orders 62310102700267992_for_Approval Globus Incorporated FZE_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5011e994-c111-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791241552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791241552, "uuid": "ef7a415d-29ba-4042-84eb-330e0016e810", "comment": "Malware payload", "value": "8bb052bef4cd27d7c80db6a6ea20f772", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791241552, "uuid": "01f0ce1f-10eb-456c-96d5-85c49b181c8d", "comment": "Malware payload", "value": "c5087d58b4463510026db9956207185e13e4669f848e35f6b754f72eb3d1a88e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791241552, "uuid": "87b129b5-e808-4d76-b5cc-04ccbd8a961a", "comment": "Malware payload", "value": "a2f7d61e73cbce8fa2f6c723d2a9bb4e7b351c08", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791241552, "uuid": "2f0f17a9-3bf4-465a-8a4d-479711258044", "comment": "Malware payload", "value": "91b76b96dcba9fb728159d2dab92d521a31a05037e06e29c1aa3975ebc236c146be5ea29cbca03e27168f8d04047a4aa", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791241552, "uuid": "92202f0e-c52d-4f8b-af7a-270b91f93a80", "value": "T126C012C5B0D06F3EA47A485D3596040190CA18B127727B140CA420D32C4B810B716F0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791241552, "uuid": "5ced5f25-28e3-4a7a-9d53-c029284ceccc", "value": "3:QnQzanhVZ7KS/j+BzOdgjzxLHawCwVZ7KS/j1BzOdgj4xLHX9:lOh70/5Pt73/O79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791241552, "uuid": "97bcef57-bc73-42de-b2b4-1120ecf91e95", "value": 185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791241552, "uuid": "43a92ca3-7d97-4bbf-bef2-8e51ad785ba2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791241552, "uuid": "e098d20c-fda1-4920-a285-ae68091a78ff", "value": "dvr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d56ff3a-c0e5-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791222757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791222757, "uuid": "25dcf803-897e-4bad-b076-f75146d792d1", "comment": "Malware payload", "value": "889e53380f2d440634f51f6c026d0d08", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791222757, "uuid": "89fe4ed0-2964-4bff-b8a2-1a258e228994", "comment": "Malware payload", "value": "c60a8b74c2f1cab1c4848310d98ea7e2d56cbb816790908b775c554bc500a679", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791222757, "uuid": "20483e3e-4f6a-481e-8ae1-b08dac333743", "comment": "Malware payload", "value": "d755cac1b775f3d03ed82b2eb74d9959d7284dc8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791222757, "uuid": "572e01bf-1ba9-4c23-9d82-f0e27b4f2547", "comment": "Malware payload", "value": "0b9998282f3049441d8d85d8e3a49bd3d1c120287f9cdeb9e66005144143e88f285dce636a4d9d5bdfeeb1d1db8e2bb0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791222757, "uuid": "5031339d-57c2-4fdd-93ef-ce8b13101941", "value": "T1CE254B96A3C54FBFF82B1A31C1197B062315F5FB9EC662AFC14C25950CAA8D012FBD94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791222757, "uuid": "e41405a1-d806-4ac1-9f8d-23f2f1623f87", "value": "14cc66136f821c09bd35c03487da05d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791222757, "uuid": "3040ed1e-17b2-4739-8561-192931d3aaeb", "value": "24576:Lsr6wh6JfMto6q47T7vy3aT3q9tgcgQgvWzkAk:LsBhMfMtoTqT3QC76k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791222757, "uuid": "9da5ca9c-e3b8-41d7-891d-a5af96bd3507", "value": 1036288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791222757, "uuid": "af501f7f-f0c4-43e8-8f49-40507698be88", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791222757, "uuid": "7c0c1191-0c1c-4e2b-8941-e42685f1b170", "value": "newisbest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb337e17-c071-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791173093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791173093, "uuid": "6055cae4-5078-4daf-86f1-30636fd931f5", "comment": "Malware payload (Mirai)", "value": "0928a69daa25639b899378db05356515", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791173093, "uuid": "a3bab0b6-9afb-4a75-b54e-1ec20963a049", "comment": "Malware payload (Mirai)", "value": "c63226d1962d07fcb5303ca2b8e0d82aa6468aed86050197db502525654cf095", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791173093, "uuid": "59492f81-c8e6-4822-a2e1-9cbc3f6f872e", "comment": "Malware payload (Mirai)", "value": "fd2cc3e15045a422e5ac1d64a9e5b4c3e257770f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791173093, "uuid": "4b40187e-5bac-46ad-9267-97422ecad0ac", "comment": "Malware payload (Mirai)", "value": "26aa8b28900e519f05ee31dacee620edbe92a8ec07a41aad4b8b5fed66846c1b4caf6807097081815f234254f014b73d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791173093, "uuid": "eacf5ef4-ec6d-437e-acb6-896b8a24ee7d", "value": "T14D4160CA2092A5B6ACAADD77B26DC94471C4B0C351CE7E0DECDC39E9C5DEE40B144B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791173093, "uuid": "2d0e01ac-303b-49e9-9a02-2b8aa7aee7b1", "value": "48:HKppwipGRGQpnjNp+s6pBNnBb7pddpuyupHRHCQpJ+o+p8KEpLIOpbFpI2:HKoiYQQNNZ6LjvB8VdNHn+dEDLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791173093, "uuid": "54361763-150b-48c6-bf3d-00cb6910aca1", "value": 2325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791173093, "uuid": "a57ce97c-d487-469c-b567-cd4d2fe9487e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791173093, "uuid": "2eb67c7b-6486-490e-af1a-c53d09a6d7d0", "value": "jack5tr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52c4364-c0d2-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791214637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791214637, "uuid": "f777deab-45ae-42fc-81c1-3d1774b403dd", "comment": "Malware payload (Mirai)", "value": "d2fa0ca8611d7c582c0b3be3a9f08685", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791214637, "uuid": "a78d6e82-8b40-46c1-b0bf-2a36ffe45f1d", "comment": "Malware payload (Mirai)", "value": "c67dd770b5ea04a32c0de7c7f9d2bbee5dba6e437bc8e0dca59c3f434f1466be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791214637, "uuid": "07d6a13f-9b8f-46ce-b4c3-d05829ccd130", "comment": "Malware payload (Mirai)", "value": "8b446037b1c279938e411dc4d6470026d688d7db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791214637, "uuid": "80ad74bd-d1ef-46c7-b548-6c126e0f7acf", "comment": "Malware payload (Mirai)", "value": "15b5899008ffeae2f5604434bfe6432a1c089f5268763216350aaf49457091641fb6ddbec4505ae6f8333d0f66aa2297", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791214637, "uuid": "31b72e87-e2f1-4d30-930a-6b935dd1fc37", "value": "T135C47C02AAF7D8B6F4A340B1215527754963D97B257BD84BDBA62C90DE301C0E32D3BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791214637, "uuid": "6992f6bf-544c-4796-b71e-a8b23bddaf7c", "value": "6144:3myQXJZwohfKfvxW3/vvGqwU6vE9yRKnn3wudhbjOlQsFJP+:2ysZwolKfI3+M9yRqvQQWP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791214637, "uuid": "90ac09c8-9185-4caf-84a3-e2807ae1be0c", "value": 579032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791214637, "uuid": "a8602cf9-4782-4ba7-aae8-fc19131ba2d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791214637, "uuid": "e3bcc28a-a2ac-4f49-b44b-52420766a7c9", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fdcf294-c097-11f1-927a-4201ac107004", "comment": "Malware payload (QuasarRAT)", "timestamp": 1791189261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189261, "uuid": "8c93ea42-56f4-4ef1-a394-7ef8c78d6f77", "comment": "Malware payload (QuasarRAT)", "value": "82a4bd3e8d17ab61c6fb376bdaa08edd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189261, "uuid": "df242425-a02f-414c-ab94-40fa3d34fb78", "comment": "Malware payload (QuasarRAT)", "value": "c734e31036a2ef2d09b93028828ab08c79afb47c06d125f16af87706e58f2609", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189261, "uuid": "3ba10043-09d6-4a2c-8d6c-95d43e44187b", "comment": "Malware payload (QuasarRAT)", "value": "5b95bcc4f60d8653f0374f607d7ce67b1b5a2817", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189261, "uuid": "cc0bebda-40a4-4216-94dc-254fbbe62d9c", "comment": "Malware payload (QuasarRAT)", "value": "1207a325e01de8d8f2e95edc824a1bc53dcab8256842d63f7f090a20ec5192e5d42be2767d53fd9b391733f5e01a55c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189261, "uuid": "cd5dc417-3a1b-4dea-9a25-bb48eb0f00e4", "value": "T13C64F2007BE48D98C3BD637A1BD6DBFC8B7795431203839E2E854342B9A9F811E196F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189261, "uuid": "1aea012a-4f5b-4e5d-bdd0-854a57f361ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189261, "uuid": "724032c9-9601-4f8e-a632-c0220be0de2a", "value": "6144:MZO7mcLU0a/Y5hDVyh3yeiCgM9XwK4/uic5EH/zipsCQ+37:MMmc4cDVyhiBM9AKkHvHrEsC/37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791189261, "uuid": "a78615d6-2730-4691-8cdf-27b7a67805cd", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791189261, "uuid": "5754b40b-9bd8-4d6a-a5f3-d1433663308d", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189261, "uuid": "6658bbe0-4a82-44cc-ac5e-08f37b8796d2", "value": "82a4bd3e8d17ab61c6fb376bdaa08edd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b1b588-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181644, "uuid": "2ef98e3e-132d-4f76-a1df-23f1024d04ef", "comment": "Malware payload (Mirai)", "value": "79e60d5f4630514a830f57695d9761c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181644, "uuid": "4bece383-7241-4b36-8bfe-313f6441f586", "comment": "Malware payload (Mirai)", "value": "c77b072ae4dfd1cfa3ea4456251e1fd66c514f57998d54fa3a39c7a60e0f7094", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181644, "uuid": "337360b4-7106-4771-8e62-29fd60b36190", "comment": "Malware payload (Mirai)", "value": "8f9497f76aef18aae7404070029077100e3894ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181644, "uuid": "1e745926-c181-4ed3-8ce2-62539af9e9e3", "comment": "Malware payload (Mirai)", "value": "cab1119f279a882e86456022b5459692d58c282d22624116aa731bfbef27bc9eae5d679a7986d00d5b04d2ccdb42d1d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181644, "uuid": "0cac5f95-fe33-46cb-a90c-329c8ee2753e", "value": "T11E933A56FD818B21D9C152BAFA1E124D3313077CE2EE73229D246F24778B96B0E7B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181644, "uuid": "1fb33a76-dc9a-4dc3-8566-bd42031dc7a9", "value": "1536:8en7lBooaW3tQ3Dbkb9FQAaWBejenCO+nDmi5HnHv0zR7MC5gYnhgA:DuoXdeDIZFQAaWk1HnHv0zRQCehA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181644, "uuid": "6e190d10-c630-462a-8621-157396d1f40b", "value": 96120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181644, "uuid": "cb93bdee-9b88-41cc-8deb-2c3fad688e3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181644, "uuid": "da7830ee-cd99-4463-a04c-27f1ebb52b53", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47dc2db-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181672, "uuid": "19a056cc-151f-45d3-80a5-4882b0f60509", "comment": "Malware payload (Mirai)", "value": "782486439d45ac7215d8e715f7d586dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181672, "uuid": "f0fbe80d-eb29-4306-acb0-18d76d02f82b", "comment": "Malware payload (Mirai)", "value": "c83e73fb8fed8c3af10cdbf2440c07669308d85b911c246070816612cffd689c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181672, "uuid": "59662e0a-8327-49a8-bcc4-f9b1889b5f2b", "comment": "Malware payload (Mirai)", "value": "13cbdc9b2a050c1f8483dc445ba7b7ac26863064", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181672, "uuid": "15626aa6-c68c-4eb5-bdc7-5c5f1a8d6059", "comment": "Malware payload (Mirai)", "value": "b1f2d99ba3c61d01eaae1e2ff6be431efbcddc1b6abf605deb54f189619d757094e0f77394e7e74060436c7a30734734", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181672, "uuid": "2b6b014b-84fc-4623-b601-b0fa88e7d1f2", "value": "T1C463029476AC9653DBDE7AB5F400D391C20DB3F8F7E7B4301E0186BCD73295115A8A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181672, "uuid": "027b3a69-df6c-4b00-b953-ab27c6345c66", "value": "1536:6gzlBgjWmI8eqdGY8nHxqK6AruhKGrCdQVgnhMQgY+XFoOL//:LLaWmS+8R+guZmFP+FoOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181672, "uuid": "84de2819-9d80-47f6-814b-c57cdc2d3cf2", "value": 69064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181672, "uuid": "f4308c8b-43fb-400c-8207-db35f2681590", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181672, "uuid": "ff7f37b6-4d59-4410-aba3-1c4fefc60f50", "value": "wife.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640f845c-c09b-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791190905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190905, "uuid": "06a4c0c5-622d-493c-a225-d56c6ba91379", "comment": "Malware payload (AgentTesla)", "value": "51daba7c136688e613b59ee908873a43", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190905, "uuid": "8f158347-f5df-4719-afbb-cbe73bce6775", "comment": "Malware payload (AgentTesla)", "value": "c91fb41b11d29f24f7fc5b21b791bfaafbc37afce2525be9835679e8334a18da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190905, "uuid": "991024da-9a4b-4cff-8077-64c63109d3e9", "comment": "Malware payload (AgentTesla)", "value": "5e244d487bdf6f92e806b5c7736a21c7380ee96b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190905, "uuid": "6303eebc-8350-41e3-a44c-20354c4d7cb1", "comment": "Malware payload (AgentTesla)", "value": "00432783753046b25899ffd34b44b507e77c1df6dc31ef4c45dbd541eb91512b589c0ead1dd018e6196761dc2abe1764", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190905, "uuid": "5c24443b-36e9-4171-9c5b-75d2128709c6", "value": "T1B892A9404681789497776B79AB2BA8D4F37B49AB0194490BB82CB440AFF5E1CDFE4DF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190905, "uuid": "17851832-2f6b-4eae-86cf-7775561a957f", "value": "384:d/HpXuRuhYmU+5gZJilbBOZZzFsrXFFnnBi9DVCLFJXPOQDxfH3qcLVgtVnkq:d/HZuRuhYmU+yZElbBOZZzFsrXF9nBiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190905, "uuid": "ad3df186-1f45-437a-bbd0-dbc939b06294", "value": 20677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190905, "uuid": "825aceeb-3cfa-47c9-88d1-2285a8326c7f", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190905, "uuid": "d261c6fc-a910-415d-97e1-c0956e9efa8e", "value": "September_Overpayment_Adjustment_Details.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08420918-c0a1-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791193328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791193328, "uuid": "a4908807-2ede-45ae-a19c-99a38950b712", "comment": "Malware payload (AgentTesla)", "value": "98460edd4ac06b461c616f2f532f23a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791193328, "uuid": "1e729ec7-99f6-49f9-a417-d960f427e89f", "comment": "Malware payload (AgentTesla)", "value": "ca3cf9d7dec92801b6b63e40871ae3ec4f971b1ca689dd6bdc1a214e3d7b8ce2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791193328, "uuid": "64ddd5ca-5e25-46f3-b94f-8e6dd6aed8a5", "comment": "Malware payload (AgentTesla)", "value": "8a3ecf3fbc1f5d9c814f421754f053de40489eda", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791193328, "uuid": "1fff8fab-1972-4c67-b83b-292413c54051", "comment": "Malware payload (AgentTesla)", "value": "a9afdf1d9e33ecaa9b897049594772d4f2948ca8e4d1618874b8d930dfb53e64de63b288a9842cf03669de877ab62a0a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791193328, "uuid": "c7c622cf-d34d-420f-ac3c-69f6e8fa95a1", "value": "T1A7E4F1CA2DA40951167D1711D77B8F6E06632EE01248C26CA115A3D262DFBB8F1F7F8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791193328, "uuid": "6bb7a2a7-75f5-47d7-b2e0-4a3d88c8f724", "value": "12288:EXiMqeAN5TOY9M0a+stMy6mt8p+bpknRPB2tb2Jgaq8ylwrn7:EXiMRw5/9M0AOy6mt8+6B2IJZr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791193328, "uuid": "7fb9a9fd-3063-4dd8-a216-1f21c467b49c", "value": 704936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791193328, "uuid": "4fe4a9a9-bbd6-4ea7-aef3-3c146354a791", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791193328, "uuid": "037c0522-e446-415b-b30b-1213f7340e37", "value": "PRE-ALERT NS260234.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25f24b0-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (XWorm)", "timestamp": 1791190580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190580, "uuid": "40ca49a4-9c0c-4950-8d39-8611612f8dbd", "comment": "Malware payload (XWorm)", "value": "66dfcfc215341b5f0a9f7462b6ad99b6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190580, "uuid": "3d1d3eeb-3186-4547-816b-30e3759f6417", "comment": "Malware payload (XWorm)", "value": "caba3990182c0b5c55ce36f9500085fc0a0464b85c7f24628c133783e396c5af", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190580, "uuid": "80119f81-9fc2-4038-96b3-1db0a3dd3c50", "comment": "Malware payload (XWorm)", "value": "ac43f473e5721c807f8c15ea54584d2f351daa43", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190580, "uuid": "49ad9b86-30d5-494e-8aa7-7979b4504224", "comment": "Malware payload (XWorm)", "value": "34c42907c8c5eaf0ccff7c53d3116b80a730785fb64bc7c5e1c5b36fadaf0dc1776b7a3ffbaf36fc55af2b3c335e38f5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190580, "uuid": "8d9b7c47-41a2-4f9a-a895-e4b0c8616354", "value": "T17E65B53761B28216E697046E6F9FF7BC4C6BAE05C2522EE5B5E8D154B2019ACCCFC134", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190580, "uuid": "68e6eda9-113a-47f4-b027-1cf6a3931b08", "value": "24576:0lY3xJ4RjbHDJ/gGgB2YMjOsNPfonX98EE0p4qbjDKvsS8cyxsn5pKSRk0cFKAWM:0y3xJ4RnHDJ/gGg4YMjOsNPf0XWEE0p9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190580, "uuid": "cf3fb08b-25a3-4fab-b284-7a5b8ccfdd59", "value": 1538125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190580, "uuid": "90c8ec5a-ef4e-4abf-98de-aacdedd97526", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190580, "uuid": "22eecf38-4a13-417a-bc3f-4eebbf9f0662", "value": "Yb135-DOC-8756592220750,pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4fc379c-c073-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791173834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791173834, "uuid": "459fc471-5c12-41df-8633-8360979400b5", "comment": "Malware payload (Mirai)", "value": "ecb217c6549b5fdd8d411abe5b1d685f", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791173834, "uuid": "f9c47ed9-f853-498c-b06c-52ca752b964e", "comment": "Malware payload (Mirai)", "value": "cb06b7dc4bcdf7ce1ac83fdd17bb2638bf3cefcae956ee053899b30a31a97d8d", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791173834, "uuid": "324ad869-17f5-41e3-b961-2adeab5410b9", "comment": "Malware payload (Mirai)", "value": "d9f4d3905c250c72ec2f644050412f17beb70f01", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791173834, "uuid": "6310266a-5146-41d6-aa61-b6b5cb19537a", "comment": "Malware payload (Mirai)", "value": "867d19cb4be1a97aecaa8024c271ae9c9b605354720af314b281f15610285e6dc0590cb829cae09174374595055f2c4e", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791173834, "uuid": "16da8cf1-a236-42fd-87fd-ca380a2f53bf", "value": "T187F3199EFD81EE6546C127BBFE2E418A331317B4D2EB71129D141F2876CA94F0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791173834, "uuid": "9b4ee412-7a5e-4f42-96d5-6a73cb9dddd7", "value": "3072:T2s/ITo7WCkybotgsJ913DhrbW4UYSx7QpUiB5IQggEuaJhnR1rmaabEtnw3:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791173834, "uuid": "2ee2a8ae-a5a9-4da3-97fc-b3e561a76dfe", "value": 158624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791173834, "uuid": "2c9987ab-b3af-449b-a499-346761aeaa98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791173834, "uuid": "d0557c31-9eb5-495e-8ca5-cec8454726a0", "value": "cb06b7dc4bcdf7ce1ac83fdd17bb2638bf3cefcae956ee053899b30a31a97d8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899da415-c0c3-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791208148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208148, "uuid": "2148cc39-3e56-4b05-81ec-9fb539f738ea", "comment": "Malware payload (Mirai)", "value": "ab4d9b710ad42ab4667ea7305e4b278d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208148, "uuid": "746b20bf-a6c7-4fb3-ace1-7717a85aebf0", "comment": "Malware payload (Mirai)", "value": "cbda4b4825cb1b5c7b72150e7a8a8315e2fcde8ed4d97d79724de152b1d84438", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208148, "uuid": "b86ecc05-5997-4628-9f39-744cd5bd4a15", "comment": "Malware payload (Mirai)", "value": "25c91bb8e411478c7e72855afe96783103e196d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208148, "uuid": "c94a1757-0ced-4b44-82b5-b8d61e89b5c8", "comment": "Malware payload (Mirai)", "value": "b6b1f6dcc9bb8c21da2766f86b136727548f26669a26e905bd3f14d09f3214971d8703272bb29bb8ada390cc601ef6e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208148, "uuid": "8a3c24e7-e5fc-42fb-8e4d-4af7721d0ae3", "value": "T136B328CEE780C572D58315B2E69747230171FA36160ADA45F3DBFCB4AB25184B221BEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208148, "uuid": "2d004d31-6a58-4c13-9d21-ff067244a0e8", "value": "3072:ke6KtfI6uKQMHBdfEPwVsmHQFxEDlDDyo5XE8hGEn:bfIngbj3HkxEBDDyo5XE8hGEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791208148, "uuid": "a8537c59-f2e5-44f4-bf8b-4512abff2f2c", "value": 116748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791208148, "uuid": "cc973cfb-53b0-4ee8-9347-3dab1457b080", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208148, "uuid": "6d820111-7c53-4a4b-9746-f16afc78eafc", "value": "cbda4b4825cb1b5c7b72150e7a8a8315e2fcde8ed4d97d79724de152b1d84438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839b3f03-c054-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791160464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791160464, "uuid": "3dbc4b07-3264-4808-bce3-638e8114e743", "comment": "Malware payload", "value": "104d50ebd1b3a42d1b2d41967e2414c2", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Foxveil", "colour": "#C2943C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791160464, "uuid": "fbcfdfe0-639d-4f16-9773-40089074925b", "comment": "Malware payload", "value": "cc16c460ded51ac533139917d16ef09eea894fd4058618c97d511de7722c460f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Foxveil", "colour": "#C2943C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791160464, "uuid": "dec04ec3-4716-4182-89fe-0f14ba6bff19", "comment": "Malware payload", "value": "36c020c073eafeaf041ed11649576457911c5b7c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Foxveil", "colour": "#C2943C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791160464, "uuid": "8a9c84b1-f36b-41f1-b6d7-515c758ca881", "comment": "Malware payload", "value": "58ef57fbe943010b1439868feb1a3eb2fe37ddc29d66df4adae7cb980bfbad2d271ec78a93c1d2680f0b9aba8226365b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Foxveil", "colour": "#C2943C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791160464, "uuid": "6b83ea41-3b15-4042-8b27-d6c73993c40d", "value": "T1DF55F200CF67549BF48CE7352E2B0A339E216194CA8561DE52622F88DE363E3F65F25D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791160464, "uuid": "0fd6f753-3c75-46fa-b3d0-af78864701f8", "value": "24576:1D15eJqwal17aKyG0hYPZsX4rtWZkB1Nno3Gz/3LameGE1YP5QHO9TmFGB5:1CqwXKyGKYBlz1Nn+VmeG+Yhtv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791160464, "uuid": "1961c786-c1ab-4cdb-9f5a-cbb4a1161726", "value": 1282064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791160464, "uuid": "6266fa39-72ec-4ef6-93a1-0d1025bc501a", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791160464, "uuid": "8fa0ad35-1d24-4c75-b3d8-e87281f42dbe", "value": "macho_cc16c460ded5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88bf1a58-c05f-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791165197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791165197, "uuid": "411d3518-6652-484b-81f4-813ba268ee04", "comment": "Malware payload (Mirai)", "value": "4d51406f7713e296f873fd45bb0ef1d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791165197, "uuid": "668fb7ff-e0fe-474d-a227-e981a393de56", "comment": "Malware payload (Mirai)", "value": "cc4638f75f5d55aca03e3d3d3b9c571c0899def48cb95887a2dbb11574e02e1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791165197, "uuid": "884057f4-1735-4add-93ef-b317fc1be635", "comment": "Malware payload (Mirai)", "value": "82f3c52e21219fb6dd633a1a17babb21e57c1530", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791165197, "uuid": "baa250f7-c34f-449f-bf66-b3a65293abc0", "comment": "Malware payload (Mirai)", "value": "1c076d98718e083896a4a7baa4f4791d5f8948f8516c91e3b40c31ae22b5528e7ce554ce160a80f2504b7af37501d608", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791165197, "uuid": "a5f08409-4a1d-41b6-9fcb-4f78d707e9d9", "value": "T112630982622C0947C5E21EB0397B17E0D7AAEF9221F4F349260FB719D1B1D376846E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791165197, "uuid": "5342219f-ade0-45c7-8c13-747783f24478", "value": "1536:/CLhQHzmB3JLdvp3as2yJsJnv6V90gKigM:/CLh+zmVTv5JsJnv2K5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791165197, "uuid": "d48c9240-5309-49b8-92bb-3d650725b8cb", "value": 66988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791165197, "uuid": "adafacd9-f7a8-424c-ac76-0d929a2df22f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791165197, "uuid": "7e1ec345-8caf-40e7-83e8-c88b41e76b43", "value": "winki.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74d0f75-c0a0-11f1-927a-4201ac107004", "comment": "Malware payload (Xw)", "timestamp": 1791193273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791193273, "uuid": "d2015212-b746-4aa8-b656-214730489410", "comment": "Malware payload (Xw)", "value": "e9bd8602ee6455e0ca6a6fd8738d2460", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xw", "colour": "#43DCAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791193273, "uuid": "0ff4a367-4cd8-4531-a9b5-450b90614939", "comment": "Malware payload (Xw)", "value": "cc46e3be61a09d84be8c07fa13172c858cf435962a00aae5dce12480e5590403", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xw", "colour": "#43DCAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791193273, "uuid": "f6e5b113-b0bf-4d14-bf09-75d6dd535bcf", "comment": "Malware payload (Xw)", "value": "350e6d5dcfcf81b95df6fa7de3565fbfe288fc4b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xw", "colour": "#43DCAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791193273, "uuid": "7945290d-9b03-4ef9-a73d-2135b7174bd0", "comment": "Malware payload (Xw)", "value": "fa33363a02abd49ea80360ba29f203e3123a6f5eba8f23267aaba7b81d54d01b82d346e4764e718aebdb622298b24fef", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xw", "colour": "#43DCAD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791193273, "uuid": "6c63d81c-ff74-46f9-b565-9a8609d7ddf3", "value": "T12A240052038917BDF68E0ED88A5B240720F1D4177D289248BFBF6AE7BF3B9845434A75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791193273, "uuid": "308e658d-df5a-42be-b71b-4cdaf8ca512d", "value": "1536:tozvfYHHVLdFPtiNPFoTSlPHVCVt7jxmceygO8PE14P/1wIMfCk14Mg3bkpq/ZXC:XIVpvmY6lB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791193273, "uuid": "44f89020-be94-4636-9f5c-3c8e7be506dc", "value": 211837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791193273, "uuid": "83fd288d-97ee-4f4d-8abb-61656b1c0bb6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791193273, "uuid": "57cbfa08-5eab-4c5d-82c2-06176f1c03fd", "value": "PAGO F-7059.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed6c215-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181743, "uuid": "e348c3bb-165b-4fc7-b15f-ae3dea25d0eb", "comment": "Malware payload (Mirai)", "value": "2aa2cd453378793a5e854254043b0876", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181743, "uuid": "22b16050-a9b7-48ad-9743-27586faf2317", "comment": "Malware payload (Mirai)", "value": "cd0329559ff42d9a21ba3faf69b0e994019b4af7c723574c7b11dde7fada5f37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181743, "uuid": "6f977ced-c36a-40cc-934f-4e5d46308f64", "comment": "Malware payload (Mirai)", "value": "6d45be06071bdb7e369924c5670214d4636f164a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181743, "uuid": "b949201e-c2e6-45d9-855a-95fb2839d46b", "comment": "Malware payload (Mirai)", "value": "3a8a2913ce84a43d3a0abb486feca11710a72e2ee25bacd478089d6abd3b959b85b69536351103eff4c2199d5dc0d9c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181743, "uuid": "f6cbd93b-9c3e-498c-891d-845c2d3875e4", "value": "T1294308817881A626C7D05377FA5F018D33199798E0EE33578C296FA07B8AD1F0D6B74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181743, "uuid": "d54021db-3ec7-4d2b-8ac8-c7f5f5a6b7e6", "value": "768:30ESWRYSaG0wBXAy9abThYrB2dPsnjVB5uEBwLRzqmPrqlhH8qkJSULwCVy/rCxE:dSaP0waejVMqYIcJ8fhWfM5tMd7oHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181743, "uuid": "5e0dd7c7-6c60-450d-ac0d-6e6b25f363fa", "value": 56880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181743, "uuid": "d86819c7-7ad9-4ab7-936f-b730082f1514", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181743, "uuid": "545dd49d-91d8-44ea-be93-ce4a28a4cfc6", "value": "87sbhas6as.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d867c5c-c0fc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791232448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232448, "uuid": "f55eb886-47fe-4489-a109-3d639f445863", "comment": "Malware payload (Mirai)", "value": "6542723c6faa3fb5abc349c802551a03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232448, "uuid": "093a4b5b-9f41-4c96-871a-2f0ca07caf7e", "comment": "Malware payload (Mirai)", "value": "cdbc40a601733301a0cdd0e4728c8fe23f00dc42ac0b7587f3d69aba8fd8c7e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232448, "uuid": "6f17a7fd-6333-4a58-864d-146181f3e38b", "comment": "Malware payload (Mirai)", "value": "7bf3ad8c8748f4c046f8c22a85b32410f817ba9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232448, "uuid": "36a1bc93-39ce-4879-85c3-f4a1c5b490bf", "comment": "Malware payload (Mirai)", "value": "1586d0aed1572a8254b639adff4d1c80c933ed8684a3f75a278c193a6714460cbd790bf461f0dc9851d1995e7509d1b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232448, "uuid": "771230e4-860b-4ae7-8f9a-373a72d75ab6", "value": "T12DC2D1A285FACE17C863437E1928157361681C65E70DDE3D1B2BAADC53C84E32A7BC53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232448, "uuid": "4814c082-3e1b-40e8-ac95-a4ac9f7e5a3c", "value": "384:Ms79WXUx5+bkbRaliVErjrL9VD9jPwrSaf5bwIB5/8x2BYFydHY0sNDZvzbSNHcp:X5+Kcrb9VDJef5Q2PdHuzb8HoEPbMI1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791232448, "uuid": "e58082da-4ac0-48d8-9d83-ceecf2f619b6", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791232448, "uuid": "34f4038c-9d02-4403-8eb6-cf5198ba0917", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232448, "uuid": "6141aad6-6a10-452d-a8f0-3d2b389c8494", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af7fb6b-c0df-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791220042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220042, "uuid": "19d85297-5183-4411-8595-67408cd68b46", "comment": "Malware payload (Mirai)", "value": "f1417cec5cdbd3235255f70261e1d127", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220042, "uuid": "2db1ff74-5eaa-4fe8-9053-14baa293cf48", "comment": "Malware payload (Mirai)", "value": "ce61e0ca3ab45a208d25be45629241517f2049b02155f0435bd04e1b409c892c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220042, "uuid": "55b86e7a-25b2-4c19-b953-a8e4dc60eac1", "comment": "Malware payload (Mirai)", "value": "c96665bd096875ecd8e2db0cede01add6c328990", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220042, "uuid": "88abf07f-4b20-415a-933d-c459ed07b41b", "comment": "Malware payload (Mirai)", "value": "4049cafef207a7e4fd1f8ec72c6969952154d60ef5c8303d868a7685b2f228ab1ea0295e1dddec34fd5d2a1a7c93c026", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220042, "uuid": "d5f1e42a-75d6-49bd-b499-e8892da41448", "value": "T102E43A56F8809F62C5D1257AF65F82A8331347B8C3DB720699189B383BD786F4F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220042, "uuid": "2fe43480-1c39-43e4-a18e-17f11022620d", "value": "12288:pOPNA6o6vqOllLbXPDFtgO7Wgpw+y9XkI5Nu9kMflrNp4k:poNA6o5uXrFttYl8flBp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220042, "uuid": "cf0964b7-7c1b-48a7-a83a-e02f89b2bd5c", "value": 683688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220042, "uuid": "c64fc880-6d77-45dc-8fe6-804c7175b115", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220042, "uuid": "9efcfc6e-b2d0-4395-8abd-df77a76acd5f", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b07aa594-c07d-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791178148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791178148, "uuid": "5275e408-7ba5-4110-ace1-1f9c85ec4505", "comment": "Malware payload", "value": "59f3b09d40835ec805a7fcab8188bbde", "object_relation": "md5", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791178148, "uuid": "0def07e7-992b-4fe5-b353-f652e5e71ed8", "comment": "Malware payload", "value": "cf024ccc3be3c078e5d34d4e5543068b8d3faac8f3ea3e3e7db614193397d886", "object_relation": "sha256", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791178148, "uuid": "98128094-bb29-4e6c-a833-c0cddeebdd9a", "comment": "Malware payload", "value": "1433de63c5e00d2077b30380f5a3195ad3f8521f", "object_relation": "sha1", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791178148, "uuid": "ef8503dc-6875-4f93-9784-f840ff4cc4f2", "comment": "Malware payload", "value": "25f9259d42154843130169c0093680e2eeab56d8854d86a8243bff7d9a5ac4f4d6dba23007f971659b96384c0735d419", "object_relation": "sha3-384", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791178148, "uuid": "f425704f-4777-47b3-9eb3-ed36ebc97c61", "value": "T10B56123FE28BA13EE06A1A3939B29210593BBA6165174C4696FCF44CCF654B01D3E7C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791178148, "uuid": "531cc08b-5a7b-425a-8476-2b546b35b288", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791178148, "uuid": "93eb83a2-095f-4982-b86d-52f8865265d1", "value": "98304:65O2WR3uMooQbPrURINHAa2JiCdJ9YKzoFOqQtAwKLoa2rexaycQwK1G5J/DujUG:2lwKoyURXNYKzogqQtAwKLD2KxaQF1uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791178148, "uuid": "ad08ff56-be53-4a01-be02-f0ff73ac9aa7", "value": 6148272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791178148, "uuid": "f9f8496e-d970-407d-9baa-9b1a7bd4f81d", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791178148, "uuid": "a0703d89-b485-4b57-8dc8-206ddc7418e8", "value": "tux-typing_QRi-mp3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9775b8-c0fe-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791233685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791233685, "uuid": "d3ab5b2e-aa4c-4cfe-986e-dc6b6b37b2ac", "comment": "Malware payload", "value": "a97352140ef29fb25d98841a7c25188c", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791233685, "uuid": "53bb4d2c-78c0-424f-a257-59bb209c1238", "comment": "Malware payload", "value": "cf6dd15baf5ef66432a95b5a2ec64ba5c6de565b3fb9e10ae01b1a91612a1c2c", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791233685, "uuid": "43124029-2a1a-48b1-a45a-4483fedc112b", "comment": "Malware payload", "value": "6e31e4a857ae272d55070a8d034b85c299cc347a", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791233685, "uuid": "d021200a-8c28-47dd-8dc4-3c85c3dee24a", "comment": "Malware payload", "value": "db27a2b5f17074738b4323e89ab3c5e9f61dddf0a482b949e09924bf0de8bdefd3e658f538dad4dbbe251dc2c90569d9", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791233685, "uuid": "4948f0d2-f63b-4484-93d4-235859aa7227", "value": "T189D58D07A7A681F4D9BBC138C5A5C507F672740517389BDF01A0C66A2FB3EE18A7A335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791233685, "uuid": "f1c4c385-ba96-4176-9bab-d2d8115c372e", "value": "eaa6039d7eb6e6c5df830272879946da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791233685, "uuid": "8a9dc705-5009-4f56-af49-2f79fae23c68", "value": "49152:3pjT3/c6ijFgJ0XylGSVQji16Ok237n5G5Jf:5jT3/cHgxQODLs5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791233685, "uuid": "96e1bf14-778b-49d4-abc6-0dd7ecd5d673", "value": 2823000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791233685, "uuid": "45e13c94-6815-4c9b-9d52-89010f9cc1c9", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791233685, "uuid": "7ec967ce-ec73-4bc7-a1bb-1fe8c50e1b34", "value": "PulseSecure.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a8e95e-c055-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791160682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791160682, "uuid": "8df4fa9c-f245-4116-a6e9-8521e2e8102d", "comment": "Malware payload (Mirai)", "value": "1486e8975525823638df003964223af4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791160682, "uuid": "0f433da7-806c-450c-b449-4f9c767c6f96", "comment": "Malware payload (Mirai)", "value": "d07b4210db5c2610daedc2831915af6c4e9f7966739ff789a0af2a18bb5dca66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791160682, "uuid": "9b745610-ff92-471c-8ea9-733ca596f18a", "comment": "Malware payload (Mirai)", "value": "fa670927e94469831ebbae86cc5fc89550eec70e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791160682, "uuid": "11831346-442c-48d7-a69f-8565a2f4a1b9", "comment": "Malware payload (Mirai)", "value": "24617e7e7c5eb92a0337f5aae89c8d44485785279f2c38a0b38bc019a47048784d18f91fbdff830a613770ade3685084", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791160682, "uuid": "a5c035e8-8d05-4bcc-9560-0e0e454af0bc", "value": "T1FF256D2AB2B3B17CD007C03047DFCAA25531B4B526217D7F26C5DA353EA6DE12369B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791160682, "uuid": "e5490c99-8e1a-4fa5-8c75-fb0ea33890ae", "value": "12288:MueV7IM+3Ng0MWvO6qs1BHndHHvIHb69sF+Rq1/KxoXWaK6PGGH3s89eaycHqt5y:MueVUM+3NgqvVqsTy62F+SOodDH3s8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791160682, "uuid": "95ef6da2-9a0f-49c3-87ff-7caa9efa14fe", "value": 1038656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791160682, "uuid": "3c233628-d421-46f7-9668-8a0587cac9bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791160682, "uuid": "6128905f-fbff-4a1d-9d46-34de88aded6d", "value": "kushnet.x64-test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218113c5-c0fc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791232455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232455, "uuid": "592f7725-fcca-46c4-9f3f-47edf3a8827c", "comment": "Malware payload (Mirai)", "value": "4ea7d80d0c2504aed28e4c15c00c4a16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232455, "uuid": "10ed1017-9de7-48dc-838f-5aee46faefbe", "comment": "Malware payload (Mirai)", "value": "d19103ae4cb4bb9822a5a9343e36af5534ca04f66c86879c9df2c1bd2f77ca1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232455, "uuid": "852d24fb-d159-4fa2-8d52-2f6f9f3188e2", "comment": "Malware payload (Mirai)", "value": "e424dcbc61bad935948d2af5b11778dab965d7b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232455, "uuid": "8962f4db-d82f-4538-9719-ade3c34d25e4", "comment": "Malware payload (Mirai)", "value": "7013e923fd5fe4c68382dbfdfb301b5d9769931e63a35698a5aa5f96a6ff6cd27d6d740b360b88718d415ea39cc87697", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232455, "uuid": "cf344e0e-9081-488e-9b0b-f148f48f6dff", "value": "T1ABD2D0AEE5B441C5FD4D1C3E808C3FA10E19E581631BDB9263128C8D5B36C5BF26A4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232455, "uuid": "afec2c4c-98ee-4a1a-8488-addd23d51603", "value": "384:Q8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjZOa1RWGVCz0NvM:FMYHb62x4ahQ3CfdwLjOWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791232455, "uuid": "b0af60e7-8310-4c78-acad-a0cde577aac8", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791232455, "uuid": "609e0f43-33f1-4b33-b1c5-c38adf109354", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232455, "uuid": "190c630d-478f-42e2-a946-b145835f1ecb", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e028cb0b-c0ac-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791198415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791198415, "uuid": "3c30bc8c-7cda-412f-a45e-d247241e382c", "comment": "Malware payload", "value": "9e75ae2ee8a55cf468f929700557d4e8", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791198415, "uuid": "cd03c71b-f8da-480b-ba16-6f8f3c02c8bd", "comment": "Malware payload", "value": "d2121812a565e285f227b983a6f7f17efb067ca214b12bdbfcea1feabc6736ff", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791198415, "uuid": "32523391-d186-4903-a554-28f2b771c551", "comment": "Malware payload", "value": "5d11c3a817e5a076d4d0bd8ebdf3c8f2745abb3e", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791198415, "uuid": "ab008044-b428-44e6-afe2-76ad2ab8527b", "comment": "Malware payload", "value": "7adb5e284f36538a91d3bd829d055fff923ae381d6fdd6d2bb011c08f8579a65567748c6435a39dadea8ad9137a43e35", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791198415, "uuid": "5b854f3f-0135-42e4-b5ed-a734310c59e3", "value": "T16F321B9CAE94B1B0E21753CE37EF2419122491C3140AC684FE4C6EE9BF466CD6A93F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791198415, "uuid": "7270f7f3-f8da-4116-8a25-7cf9d229f54f", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzM36cnsEJTYh1LT8Ok/eu:sXX+/DV7k/3M37sEJTY/LIf/eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791198415, "uuid": "771b49a1-0525-41bf-9c91-53892a6780e9", "value": 11797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791198415, "uuid": "195315e2-82e2-4d57-a47d-25ab4817ce28", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791198415, "uuid": "553645b5-b50e-41ba-a837-91101f1e59a6", "value": "Captcha.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c03ea0-c07c-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791177436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177436, "uuid": "f098f27a-d4a2-4446-9003-e134e4e2dcd1", "comment": "Malware payload (Mirai)", "value": "6486f00a7e4b6be37fc28a77d4ec2269", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#AFD6C3", "exportable": true, "hide_tag": false }, { "name": "torii", "colour": "#C73077", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177436, "uuid": "ae2c652c-67ad-4701-a97d-b512e31a989d", "comment": "Malware payload (Mirai)", "value": "d25a9db2c0a77a8ab9ff136ace0bb8c840e85f36e68ff38a018014cfb1338754", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#AFD6C3", "exportable": true, "hide_tag": false }, { "name": "torii", "colour": "#C73077", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177436, "uuid": "4d1b322b-37c8-485c-a994-013ce34f0d48", "comment": "Malware payload (Mirai)", "value": "c2773d1766680b714b78200590fb11946a2cadee", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#AFD6C3", "exportable": true, "hide_tag": false }, { "name": "torii", "colour": "#C73077", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177436, "uuid": "121aea0c-48ea-4db3-a94d-e31364303d77", "comment": "Malware payload (Mirai)", "value": "b7dc57910dacd969b0f6dae865679f12946a44ca72aec654d4bdbc312419910c350b41d45db4c1c1bbaf6c0867a15e0e", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#AFD6C3", "exportable": true, "hide_tag": false }, { "name": "torii", "colour": "#C73077", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791177436, "uuid": "bd37af80-e2c8-499e-9858-be7c641e7356", "value": "T1E5543A8AFD81AE25D5C122BBFE2F428A331317B8D2EB71129D145F2476CA94F0F7A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791177436, "uuid": "6c391744-3d2e-4f05-9ae0-a9584413e6e6", "value": "6144:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRhVabE5wKSDP99zBa77oNsKqqfPqOJ:T2s/bW+UmJqBxAuaPRhVabEDSDP99zBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791177436, "uuid": "29a3242d-1ef0-44c1-93ce-c7e4741ea088", "value": 303124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791177436, "uuid": "3963635e-b6d1-4e7a-b822-a49238547954", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791177436, "uuid": "8f605a88-99a6-49aa-b05a-88270f600270", "value": "d25a9db2c0a77a8ab9ff136ace0bb8c840e85f36e68ff38a018014cfb1338754", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7188a2bf-c0df-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791220134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220134, "uuid": "d38c13b7-8d80-4fbd-b13c-e6ba524b8dae", "comment": "Malware payload", "value": "984b91acf400e8cecbcf71c1eb27392f", "object_relation": "md5", "Tag": [ { "name": "BypassUAC", "colour": "#E8D0B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Uacbypass", "colour": "#0960B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220134, "uuid": "26dcd6ea-497c-4c46-a560-d8a2c33232ab", "comment": "Malware payload", "value": "d27b052445f0b14a3a8063948544268a634ec4487ae9d9c7d9532d03bd3d343c", "object_relation": "sha256", "Tag": [ { "name": "BypassUAC", "colour": "#E8D0B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Uacbypass", "colour": "#0960B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220134, "uuid": "47dfb524-8463-4721-b09a-42d97cbf24ed", "comment": "Malware payload", "value": "13cc3ffdf4cd42d742749c1e5d6cf31a4d513a33", "object_relation": "sha1", "Tag": [ { "name": "BypassUAC", "colour": "#E8D0B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Uacbypass", "colour": "#0960B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220134, "uuid": "025f91e9-48fe-48ec-90b9-8993d578ec4c", "comment": "Malware payload", "value": "7ba4fa15cf53e5214c3d03dbc4ab6a5d68d492dfa337ff8956eb7fa2fae1d3b474bea0a3f20fe841524aaeedd383f61e", "object_relation": "sha3-384", "Tag": [ { "name": "BypassUAC", "colour": "#E8D0B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Uacbypass", "colour": "#0960B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220134, "uuid": "bcc8c8e7-11f6-4f5c-912b-7bf39435f7e5", "value": "T135F4A39DB35678C1ED938934AC4F02CA9EBE3B42A112E573691D5A243D742E7489F30F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220134, "uuid": "5782e3af-97c5-4808-b416-527d6fa5a31b", "value": "694a10f92efdb5ba9c32ad08fff67a41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220134, "uuid": "a15595e3-dad0-4245-8de5-e896c606f88c", "value": "12288:maKgDf2fWoOyA04lD+8igrf+xoz0tWoXivaLBM:ZDf2ekApwWoXLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220134, "uuid": "47c08d20-5b54-4b43-b7b2-4a2f97a660c2", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220134, "uuid": "8f7ee65b-1277-4017-904f-c2831e0339bc", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220134, "uuid": "3182989c-6633-46bd-ac7e-4b1d070e9d25", "value": "d27b052445f0b14a3a8063948544268a634ec4487ae9d9c7d9532d03bd3d343c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba024a6c-c0fe-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791233570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791233570, "uuid": "e66067ae-28f1-454e-9b49-9c55a4a614b5", "comment": "Malware payload", "value": "67a5fe0dd43cb25c539341c0bf31d2b0", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791233570, "uuid": "7091f82d-2daf-41f5-a96c-47c8a1fa3553", "comment": "Malware payload", "value": "d2e55213a02fd16a077298c986130522eb63196bdf8a8c1aec0eed6ef318b222", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791233570, "uuid": "820eb65a-01b8-427b-a501-1207ca58136e", "comment": "Malware payload", "value": "561485ba4f3954414b7ad1c4d58a6a9748116d30", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791233570, "uuid": "bc2022f7-bc92-4196-a087-3bbf5fd34978", "comment": "Malware payload", "value": "8d070c13391d96797fe126130f26dc6651c0dcbb2a851c4565315f588466bf55f1911c7741f17faa95ede481610a7a54", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791233570, "uuid": "6af82452-2d88-4755-91f5-7c5c9819afd2", "value": "T142065B03E19510D9C059D079CF4A8632AB617C4E4BF266EF3690B7D12A76EE47B3EB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791233570, "uuid": "4dec609d-596c-418d-ada8-3613b7c33e49", "value": "e7f21f2a92e04a3104ff14e21cc4ccd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791233570, "uuid": "8c383530-7cd6-47ae-8695-16fe898f0b52", "value": "49152:cuOS5A8m0MixbJBIe8hxQ4Dtrp905PCrcle3QESjwg1d47lxzt3AqcGTvA/Pw/e2:JOQEFMKNgESjB4JcGUHG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791233570, "uuid": "d1e8666e-a7d1-4a65-a033-bd07ed8f571f", "value": 3868240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791233570, "uuid": "df4ae0e2-79c7-471f-85c8-7a28d08639c6", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791233570, "uuid": "e0a0aab8-12c1-45e1-9068-eef37363af05", "value": "mscopilot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be88700-c09b-11f1-927a-4201ac107004", "comment": "Malware payload (GuLoader)", "timestamp": 1791190891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190891, "uuid": "f1060eda-b493-4ed1-b0e8-071d140869e5", "comment": "Malware payload (GuLoader)", "value": "86b7d3bc5b1a5a50677db5809c5dd677", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190891, "uuid": "b87e1b66-13a3-49f1-8c87-c36421d84705", "comment": "Malware payload (GuLoader)", "value": "d3cad8e219ba04895ea2e43b60b1b28e6bfb73b6348b550632fae27b3a0eb985", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190891, "uuid": "071fbcb7-9329-466d-a653-2eb5691924a0", "comment": "Malware payload (GuLoader)", "value": "a86bb101a99a3ba4e4798ae4932ddec741bc2553", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190891, "uuid": "1e114aab-a0e5-4418-a959-e9b430827bd0", "comment": "Malware payload (GuLoader)", "value": "aa7720eb0b81b15463495ff8adc5567a9fa08467004ba76412c9a35534da99332fef50383fad1a33802b09fb91c08df5", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190891, "uuid": "f40c7426-06df-44a5-b11c-ff90f33c806b", "value": "T145A46C20ED34067A4F471B9DFCA50B62CABD8619462640F5F6DE070E61069FCE3FE269", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190891, "uuid": "78ac8098-c84f-46df-ab69-5a93e9698aa9", "value": "6144:R/ndl9/0sbkhfYdGtzI0CmDSS6oLnMiKKnXLAmNMcry0XuZO/CWkQtXHeUDM:R/ndqQGt5C+jMiHX0Rc5eZctQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190891, "uuid": "bf6d7100-172e-4c09-91ec-aa38fe295285", "value": 452353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190891, "uuid": "4c491768-365f-4733-9eff-03ec6a52227c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190891, "uuid": "ae7d74f1-332e-4e47-beba-6dea426a8c69", "value": "VERTRAG-pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35cc59d7-c116-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791243656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243656, "uuid": "ca653ba9-4fbf-4301-be7b-1f14c484fc0d", "comment": "Malware payload (Mirai)", "value": "4aa1070ea038573b2b38053370a00316", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243656, "uuid": "d2e32c78-4c45-4159-8059-dfbc1d2aa2c7", "comment": "Malware payload (Mirai)", "value": "d449589b8e5f1382130ac77e59958adde2fc4ded3db16653f3fef97895312bf9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243656, "uuid": "8c3cdec0-0012-4b47-af84-b99182cf96af", "comment": "Malware payload (Mirai)", "value": "2f3b52d00d902da8ff776b05e248017b8445f19f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243656, "uuid": "f931da07-60fd-4a6c-898d-21c9078d9998", "comment": "Malware payload (Mirai)", "value": "2dcdc1c42820d5c86f6e83d7bcae85e15035f5c9b016c45ec2760ad5c008831205f22ffaf5f827b33af6b13ae9db936e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791243656, "uuid": "ecc31ca9-921b-450d-8f95-4425464dbe9d", "value": "T12605E60B6E329F7EF579C73087F34B74969972D726E1C588E19CD20C1E2028A651F7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791243656, "uuid": "81dfaa0a-c2af-4a34-b4f4-024c94f8f862", "value": "6144:Yh7iCBOf5fed3T6VwMCHuhbA3TcMNgimsAGo3Jcv71PxY+MbklxYOMAZ1DCKeRHq:tAwRK3Zuhk1m2L394R9tTteYyuOzSc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791243656, "uuid": "499e33d0-52b4-495c-ad2e-4bd7cb7b4482", "value": 856372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791243656, "uuid": "f1c0fdf6-a82b-4ed4-899a-acefd0e7f9c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791243656, "uuid": "4facca83-cc1a-461f-a001-275af7fa885c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679e9e98-c09b-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791190911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190911, "uuid": "7a1eaf48-30c1-4dd1-98f6-cfef0f73e4f1", "comment": "Malware payload (RemcosRAT)", "value": "ac2afeaa1e9f10ca7c88848d992fd8bb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190911, "uuid": "99b387e7-09fb-4213-8e3f-ac5698b0c93a", "comment": "Malware payload (RemcosRAT)", "value": "d55173b950686fb77d7c6bfcc51864abe25b5508dbc6ab3387dbe7765af3a9b6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190911, "uuid": "b5788047-8926-4336-8781-9ee5e141f718", "comment": "Malware payload (RemcosRAT)", "value": "1d890cdc6f37bb3ad0c0957021f54a550a93fb1c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190911, "uuid": "23c60c2d-8b0d-4c15-913f-51da07b15275", "comment": "Malware payload (RemcosRAT)", "value": "7e23888cfe427b32190ddafc25f55ff839db380d91370e4c67142068ec5b55183ab125e1a21b1145acbf212a2080889c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190911, "uuid": "4606473c-fc39-4f68-b49a-c0ab5ed83a41", "value": "T12F06205DA6769BB90B9CF287493CA86C3E4DBEA0C13010B5BC3EB25BB15CD18D15B52C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190911, "uuid": "ef8eb6cd-ff6c-4c61-b485-69b97ed73441", "value": "24576:nA2yvkW/miW2aTdn5DE/rRkha55aFS546NWP7euFkFTiDH9qPckvHmLBCIQHPhyO:n+vP1Gha2gWibv8LG/k/LnXSbTOPmXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190911, "uuid": "f425b34b-6369-40af-956e-8e1951cea1c0", "value": 3816538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190911, "uuid": "a66f2534-b254-4b17-a744-80c798dace86", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190911, "uuid": "db27f8bc-ee5f-409e-9a9b-2e1cac984077", "value": "Request for Quote(RFQ).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a830e5-c08f-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791185856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185856, "uuid": "41b909dc-58ea-4753-8c4a-bfe1e2c5665a", "comment": "Malware payload (Gafgyt)", "value": "d0c74d3fb63410da34b7ac2eb16bff86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185856, "uuid": "bf98dbd6-6632-4a5e-b5fb-ae6d608b10b1", "comment": "Malware payload (Gafgyt)", "value": "d552b203de56c02d511d189f794e2da9a1b0aba7952b98614103392fca27a639", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185856, "uuid": "d155effe-7d22-4478-87d2-90f3bb61a9c6", "comment": "Malware payload (Gafgyt)", "value": "8b97e9c680d84a759dfcf0d9f4f3a7b95e5d3e14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185856, "uuid": "686905b8-0f7c-4b0c-8ea9-554564a00c86", "comment": "Malware payload (Gafgyt)", "value": "6854c8d438ae9cdba9aaf1480b57896592878984de0989410c5e291bcf3efb8518d0edfe84f04c82e221419bf1ecb0e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185856, "uuid": "13cf7522-1427-460d-8e66-7bdc4ac0f6f7", "value": "T17DF26D34F64ED941D2D2E37EE8560BA272233D9142A183737900B78DC8BBFD88D65667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185856, "uuid": "6f6b6881-fc8b-409a-90fb-20d37c5aa750", "value": "768:BqMJT+IRnbs5vdGLpzWglRofYKacYSlTEr:BqK+wno5FGkgzofYKaulIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185856, "uuid": "cd6fe7df-1a6a-48e2-87ef-ec40046c51a4", "value": 34328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185856, "uuid": "2e1bf4d7-e91e-40c9-8fae-519f2ed68204", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185856, "uuid": "78da77ba-840f-4650-a5b6-7ce00f504eab", "value": "dldr.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72bb4af2-c0b7-11f1-927a-4201ac107004", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1791202956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791202956, "uuid": "d152ee32-3c4e-44f0-899e-7873288922b2", "comment": "Malware payload (PureLogsStealer)", "value": "e24588949d69cf5a7b74187a9231c676", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791202956, "uuid": "99e93ace-9b6d-4e22-bb37-7224d5224ae4", "comment": "Malware payload (PureLogsStealer)", "value": "d5752f7a97721282da65b8cc9fa3522aa39b0d90df1b95b40468f1c13a0accad", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791202956, "uuid": "998768f5-3bf2-42b0-aafa-e0188cf07576", "comment": "Malware payload (PureLogsStealer)", "value": "2b2f3fcf9a9e0635f896d12e8c3f200a5e5b0a58", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791202956, "uuid": "393b1fe7-25e4-415a-bcc1-a28949235f4b", "comment": "Malware payload (PureLogsStealer)", "value": "cf5666806dd648e8986e946f03fa913887f608a5f5da7b776e55bdf813a555cf97fea1110da0578d9cf9fb6520feba99", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791202956, "uuid": "febd8562-f350-41f6-92ad-7067a20b7a00", "value": "T1D265127931A94AE44BDC63893ACB7E0C2EF18780564DD1709EDDE7F5225A6C08CA6DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791202956, "uuid": "112c17d3-095d-4595-a1be-bfd7d7f84b3a", "value": "24576:lpY4ZvbzGeZVmcZvICcxOE19C2fxcLRWAlZmEr5/8+bWvGOldHhHVwPml6VX5JLl:9tZwc9yxh9vgR5aRdHv+2WvIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791202956, "uuid": "7ecdb50a-6dc6-41a2-9563-d2e0024850ce", "value": 1511280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791202956, "uuid": "9b4b2b4e-ac6f-4870-94a3-6de8afb7d3b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791202956, "uuid": "b5bb835a-34c2-46a0-80da-5d1f889a2168", "value": "PO_4700252644_R0_Supply_260787_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f348aa-c05f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791165355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791165355, "uuid": "43480b13-4420-44c3-8757-46659b95273f", "comment": "Malware payload", "value": "db899c6a07fffdec0413a99d0e2e1480", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "hijack", "colour": "#D7C062", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791165355, "uuid": "e003961b-2c61-4175-8569-839055cb7681", "comment": "Malware payload", "value": "d5aa43a733cb278791a8f543bc5bac8d47bdee7e4a449c5d26297bcdb686ba4e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "hijack", "colour": "#D7C062", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791165355, "uuid": "e9bcd417-5066-4732-8745-efa1c3fef976", "comment": "Malware payload", "value": "39aff81e8e5fa8f2ddc7e6e845b8c622f243c3c3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "hijack", "colour": "#D7C062", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791165355, "uuid": "4ba12e0a-9b4e-4cc0-bdb0-91fa61574368", "comment": "Malware payload", "value": "52683c7d6a5c060af8b91552f13ea9747a96cbbd11b4f904c123f0b757fe8bff030cab3957f9e0bc6b191091802305c7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "hijack", "colour": "#D7C062", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791165355, "uuid": "b41d2813-d50a-4470-9168-23bb7ba5b1e4", "value": "T111263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791165355, "uuid": "6e7b44a5-7c00-46cf-9ab6-89cfc76ca25d", "value": "0392aa966668f99fe783c0ba6bdd509a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791165355, "uuid": "588d1b80-9f6b-4770-9afd-3596f18ace9e", "value": "98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyz:BMWKfU+BcUTHCCCfqCiUffnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791165355, "uuid": "3e07b57a-61c6-4f26-abb5-dd14932b2523", "value": 4812816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791165355, "uuid": "83ac93c1-886d-4ac9-97d9-b60166a64c69", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791165355, "uuid": "336207df-1266-423c-8eab-ec39bac3072e", "value": "d5aa43a733cb278791a8f543bc5bac8d47bdee7e4a449c5d26297bcdb686ba4e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16fa84c5-c0d7-11f1-927a-4201ac107004", "comment": "Malware payload (njrat)", "timestamp": 1791216546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216546, "uuid": "a1fdecb5-3bfc-4490-ad07-f06a17f191b9", "comment": "Malware payload (njrat)", "value": "1742ad51f743c9e518abec7fc6f9451b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216546, "uuid": "a8eda457-f980-4cde-a1ca-606e75b10c49", "comment": "Malware payload (njrat)", "value": "d5c4983535d57d69fc6f8c09ff4a3838d6a61ac6b149de67b89c0c062968d9cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216546, "uuid": "0c9082a1-4562-4458-89fa-6089abb8c7e5", "comment": "Malware payload (njrat)", "value": "19dc42491a499830d7638933b5f457740ffce395", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216546, "uuid": "b2a5e3c8-698f-41c5-8655-70d7122613ec", "comment": "Malware payload (njrat)", "value": "cd6249793e11b165d4586e65f13b92b92c4b38dab6a75b5c8e9595d665fe370b0c2924af2a100b67c027bac81eb080ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216546, "uuid": "53e64e58-8f02-43dc-a044-e2d0096cd590", "value": "T152D4F1402368DB03C9752BF55931F2781BBAAEDAA921E31A9FD56DEF3932F014D04643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216546, "uuid": "fb0a27f2-b58c-40a3-9990-f5cf2cd28ab4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216546, "uuid": "a1c9d940-d508-4fcf-95e7-8523d5ada35f", "value": "12288:4qhm0KQRJ88pMhEl1/eROkqCx28tVw99KBQPMIrIR+NS/:4d2xM2lJaOkB28ti99KGXY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216546, "uuid": "cc667b80-c764-4ed7-9a1e-6e77b6ec1f45", "value": 609280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216546, "uuid": "69e028ad-8c16-4888-a696-067b6fb57011", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216546, "uuid": "44b84f84-1fa4-4534-ba52-67383b6eabd3", "value": "xaYf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49cf5d88-c06c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791170675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170675, "uuid": "f6c11c34-2786-4444-acd4-1bf5a427b0aa", "comment": "Malware payload", "value": "4cade129458e5fc51ce1abbefd6fe388", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170675, "uuid": "7b8229f2-f209-4311-8639-47057661387f", "comment": "Malware payload", "value": "d624722887c94f66e81a1f12bbb881baa2a95d31c346f3fae2f6dbb6b0fccaa9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170675, "uuid": "937a3a84-fd76-4511-a6c2-99e50bcc8f3c", "comment": "Malware payload", "value": "4f82458c6cb8201ae1d9ee00e70cd0758cf195d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170675, "uuid": "3ea32a77-f267-4d25-89b8-741228ba7c78", "comment": "Malware payload", "value": "8e7744f7a113c26ea7bbc26c12d562feff65263ed643de9fff37f48b1d2c16eb2f29137432b2d182ea256d384bb1de63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170675, "uuid": "eff9dfbf-0e61-4efa-8f55-f406ae5342e6", "value": "T1F8243A0775E0C9FBC4C69BB56BDB95228933F4392B32620A73D8BDA52F0DAD46D1D210", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170675, "uuid": "76d4d59e-b122-419e-b3f7-03bd095727f0", "value": "6144:NueuOLIuFR8aLJn9v2dZreLjL/+n2ckJpO:Nueu2R8I9v2dZreLjL/+n2ckJpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791170675, "uuid": "476cb9b5-117e-46f6-84d8-43ee864cbe87", "value": 230203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791170675, "uuid": "d4c0ca07-443a-4a42-92ca-358921981470", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170675, "uuid": "416cfd36-10d6-4e90-978c-77b7112afcab", "value": "d624722887c94f66.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d7bb2c-c0fa-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791231873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231873, "uuid": "dcffa86d-1245-4c25-a586-a3f7dd703157", "comment": "Malware payload", "value": "a0c8079940b53f535f0e8ad8b5f85666", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231873, "uuid": "84f75149-f78a-4364-ab79-2adbcfc72fb0", "comment": "Malware payload", "value": "d6ff260584d3c58d0794769ac5b38a7db6620fef6abb9a9b5612445143987c1c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231873, "uuid": "12bdeca1-17fb-44d3-8557-7194109f36e1", "comment": "Malware payload", "value": "8b75f3ce99aee26fcd86dbdce019e27c8a04798d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231873, "uuid": "1d9f89c1-21dc-4c66-ad7f-00120d4257db", "comment": "Malware payload", "value": "2c0b6da032cbe490426a67b160402dfd07b66ac489d6e21e20551971a97ffeb1690ad0c67cef306770a87a9aba077223", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231873, "uuid": "8aea379d-d426-4d9a-bc32-48fbd5bba1d6", "value": "T1A2753343957C6413FCF242754B8D63E99AC9B01B0E859A6B5E7D4231CC1FFC84A2CDAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231873, "uuid": "279c18ef-d02e-4013-ab93-49349c524d65", "value": "24576:dZNOAH3e4DWUO7SEF/aEe61K+ePLlrd0AR0czX18YdW1JeKd56fcrzfP/N3f/4Is:dZpu46UO7SS/tCtdTR0YSYM1PdgkHF3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791231873, "uuid": "3e843a33-4024-4941-8931-87f032e2b613", "value": 1566736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791231873, "uuid": "dab4513f-95cb-483b-b2ff-315d9cd36b92", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231873, "uuid": "fa16f9f4-f0b8-40e1-a6cd-d65f12b4e3a1", "value": "d6ff260584d3c58d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d209656-c094-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791187833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791187833, "uuid": "68699b50-427f-4828-853d-164bc5e5a588", "comment": "Malware payload (Gafgyt)", "value": "0b44064960203691d0c267030f240257", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791187833, "uuid": "86640a03-0173-4a85-b2e1-45d6edb5d809", "comment": "Malware payload (Gafgyt)", "value": "d711dc9ed0e174d33bb84e0aaca9ac9299db40078730f1edb08cf0a6a0f9921d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791187833, "uuid": "07070529-f84e-44f0-8ba0-04f84d72c9f3", "comment": "Malware payload (Gafgyt)", "value": "20563f30a23b6f218126c03a350d923d96774671", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791187833, "uuid": "517eee66-c85d-4742-b887-21d090479574", "comment": "Malware payload (Gafgyt)", "value": "9d9c9673531530f26e7d277031018bbc5c55f34506706ea0f34c04b643cb679761b0dc9bdd90045fb4c9b838741fcd5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791187833, "uuid": "ff7563ae-3ca4-41ab-8bd9-0761281061b0", "value": "T1A4344A07B5E0C8FBC4C69BB52BDB95629833F8391B32620A73D4BDA52F1DAD46D1D210", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791187833, "uuid": "dd55a0d7-d512-4054-a010-ae0ede4bcd06", "value": "6144:dJl/AcDz1qcEKAT3DHv2KZreLjL3+n2ckJpO:vlYcDIKAfHv2KZreLjL3+n2ckJpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791187833, "uuid": "55b68239-608a-4052-ae75-f6ea5e1d3daf", "value": 236477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791187833, "uuid": "e1359ce5-351f-42f8-b6ff-27439e956dea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791187833, "uuid": "a75d7747-42c9-4e44-bb49-15b975d79af4", "value": "dissx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d482a996-c093-11f1-927a-4201ac107004", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1791187658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791187658, "uuid": "3ff487be-0fc4-44aa-8036-a892bc4b0fec", "comment": "Malware payload (PureLogsStealer)", "value": "212ade52c43b8723510a89a58a349f84", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791187658, "uuid": "6fd6bc79-8562-458f-9cc4-4fdc9a6973fd", "comment": "Malware payload (PureLogsStealer)", "value": "d72e0f84e5528481db5dea90a8dcaf4e5f0489de9d623228e7853eee29fe8895", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791187658, "uuid": "632ea3b9-c888-481d-ab85-a0e69fcf2b59", "comment": "Malware payload (PureLogsStealer)", "value": "4b0d04748121dfb2a440d0d6d1f5dbb645d06277", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791187658, "uuid": "bce58c68-a46f-421a-a150-76429883d5dd", "comment": "Malware payload (PureLogsStealer)", "value": "87a4ca783d6171e7950ad2d6b0dd72f20ce7c590ddfd95afb88ce15c65e764fe329ba723b0ebfe0284c68a78cdc1013d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791187658, "uuid": "1790973c-fe81-4720-b718-55d32cf10ac1", "value": "T1BC65128D41419B68077D53993F2F162A05B4AEB13F88D388F61FA7B062E8466C4F1E7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791187658, "uuid": "6b028720-7e5d-4c64-a5b5-0b80d6932aac", "value": "24576:nRIx+xDOBpahW6vW6LPz7qz2QOaCyiIJx7VEv4r5mkJ+ydf4DysW:n6B16LPz7eCqxqgrIRysW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791187658, "uuid": "2e90fa27-31bc-4d02-9632-c4c238720242", "value": 1513792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791187658, "uuid": "a3260ecb-66f4-4c84-83ab-79de0df3708c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791187658, "uuid": "f2786e1b-2ddf-4ea8-8dc6-28f59b44d667", "value": "New orderRequest for catalogue.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1beb6d84-c0fb-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791232016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232016, "uuid": "dbf005e5-5949-4de2-b1e6-2a87d52ffffb", "comment": "Malware payload", "value": "07d421f571027adabae15b5d7d2644b4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232016, "uuid": "eafe7930-9e96-4f38-83a7-6c75497f6e54", "comment": "Malware payload", "value": "d79a04df3971fc9519d5c9e28c224ae429ea9c57ef05cf4908d7ebd9eed3f048", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232016, "uuid": "1100e60a-396e-4395-83ff-859ed6bf58eb", "comment": "Malware payload", "value": "81b015aa198601e3fc805c69f9fa679dbe22171c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232016, "uuid": "b2845341-3862-4406-805c-f1557a4fd75b", "comment": "Malware payload", "value": "064d0ba741998b4b410177ea05937c383aaff76ebf5b4d4689a2a832e3f479eb7649b023b9d99e6b70e8169c8e49b570", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232016, "uuid": "a8175f2e-7b2b-4ef1-8fd1-e902c0076557", "value": "T1A0F5CF0BBCA108F5D0AE9272896665557B31BC480F3113DB2E64B2BD2FB27E09E7C754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232016, "uuid": "2857131e-3b71-4474-a88e-66c46a77383d", "value": "9b763104e1c7e7b7334a1e9ed4235cd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232016, "uuid": "9f16d4e5-84ed-4736-9cb8-83c37456b7ec", "value": "49152:iFbIOODGtj+pdteql1tjshuH6dOV7gVUe2QAxmLv:ihLR1ANHMOWVUuAxmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791232016, "uuid": "67b473db-c960-466f-9401-9b59963e3200", "value": 3424322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791232016, "uuid": "2d4a586f-4312-4812-bf1f-69863597bfc2", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232016, "uuid": "c0cbf3e8-0767-45c5-960c-1e9d95ba0fe0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a24a7c-c0d6-11f1-927a-4201ac107004", "comment": "Malware payload (njrat)", "timestamp": 1791216302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216302, "uuid": "0f5b321c-b079-468a-8545-6a22e92d60e7", "comment": "Malware payload (njrat)", "value": "1cf8cce965f8f2089ce67ef811b29d13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216302, "uuid": "2993afcd-f7b7-4d05-9c00-6ef9a4e6c8e5", "comment": "Malware payload (njrat)", "value": "d7fea5f6217db6e04f75333a65a46cdfcc523c7f3ddc29cfaecb18cd8876ea98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216302, "uuid": "351008de-d832-49bc-a96e-df0950c06aa0", "comment": "Malware payload (njrat)", "value": "ca868ac1e4f42282fb74865fc2f9edf38b052e4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791216302, "uuid": "0829964f-3d74-49d4-b414-8ea2ac3852f7", "comment": "Malware payload (njrat)", "value": "25bbb7f99bf0f5a1c4b8298634fbba5956fea840ca764810a7d80d541ebccde0993679b2ce7ee289f46bb31439d56d74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RGBLoader", "colour": "#47F680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216302, "uuid": "2d37ad04-6cf6-4bc9-9e0d-b1bb9d57c2ff", "value": "T18A936B8EF7A05959C5AC0AB7CA63514845EAE0E7F167F7FF28C85DE05C2248C868FD90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216302, "uuid": "86a1b434-0e0d-4cb5-9aa4-dc719e349893", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216302, "uuid": "3b0cc486-7147-4995-82a4-92210136bdf0", "value": "1536:1jxl8EVWM96wd2ZeFEVrQuf6YIqwm3K7PLiFJ7pJhROtYpBtphTIlj6EQrw3zbdx:r0and2kE/f6YIqwEAT47pXRmEBtp50jH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791216302, "uuid": "677d68e5-c834-42a5-9b62-a143481faddf", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791216302, "uuid": "17c58744-5431-4375-922c-9d8d98807a8c", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791216302, "uuid": "8352f9e3-6ef1-453e-8f74-0e932ac08394", "value": "emerald.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde07a81-c0c1-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791207430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207430, "uuid": "a4049d65-80cc-4dfa-933f-3bca22d67b51", "comment": "Malware payload (AgentTesla)", "value": "248f1b6736164feb31c18877f2b8aef9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207430, "uuid": "4bcd1106-c66d-48da-b9f6-b7c3f7f9211f", "comment": "Malware payload (AgentTesla)", "value": "d89c479e0ea9bc04a9532f0842a2b1e3447632ace2552da610db82cb34f3b80e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207430, "uuid": "fc4ad8d8-9cb1-4cc4-a161-222408861a5b", "comment": "Malware payload (AgentTesla)", "value": "1970c74f2f6f8daacb57e206e835f0f9ca3ff5cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207430, "uuid": "542d92f7-775a-439c-a771-b5dc5fd59f42", "comment": "Malware payload (AgentTesla)", "value": "3b62d018264bc65dd7a6c8928620a0d36370ed8eb8f61115d8d8fe85acffe623faaffcd22dc0a3793baa20a9f361656f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791207430, "uuid": "04c1cb4d-3292-43bf-b903-455d4c3dba66", "value": "T1AAE4E066D52246BD1F7916684FCBDA140DB37A5FF68BF191C02BC6C2232128186F6CED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791207430, "uuid": "a015e45e-64af-4d1b-ad85-f2960d833aac", "value": "12288:CNGRkf8fOUtW3i3G2BMktqrlZOzeRGiKc5M9rrL6MugxTVCmGtC2lDyV1+GoWBSk:CYMkqfODvzrGDKTAtO1+SBSqeDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791207430, "uuid": "6ba9a632-569c-4f70-9483-67167eebd496", "value": 708474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791207430, "uuid": "e5caadd3-c9b0-4c68-86b5-b02a99f9fccc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791207430, "uuid": "46774c8a-c942-4421-a94f-ab10fbdf5253", "value": "Request for Outstanding Payment S.O.A 10.01.2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c24a21-c0fc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791232438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232438, "uuid": "ee595090-6a19-4dff-b178-0864cc90a260", "comment": "Malware payload (Mirai)", "value": "1870c8cc58fedc4c63e9a260113aeec5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232438, "uuid": "970460e6-536c-4dcb-9ad0-8a26a7d96e4c", "comment": "Malware payload (Mirai)", "value": "d90906a4d3db84b1102882e2e8b8d04b2478cf76de545adfd101dce670c87217", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232438, "uuid": "924a002d-00b5-433c-9b63-8967a127dc6d", "comment": "Malware payload (Mirai)", "value": "931e59414693ded5a846012c83e83833bb7a02b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791232438, "uuid": "c95ec876-b1ef-43d3-9364-d7fffe81fabb", "comment": "Malware payload (Mirai)", "value": "4225a5dda203f9d91f727d81f5cc0b024bcfabff1b42ca2f155c8c6c389345ebf56f88f61eebe296dc96aea91fb36212", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232438, "uuid": "4543ecea-0ba9-42bd-ab55-b9c9eada7edd", "value": "T18ED2D1786B0245D7CAAEA1B84DE50B362D60CFB2E0436C077598D5C7BB098AD3CA5DC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232438, "uuid": "5ba6eea7-1018-4c54-9513-2b85b40eab21", "value": "768:94ylAtv6pqLJM0RXaxGyUbXtheU/Sw92JgGlzDpbuR1Ju:GMBqTRXa+Zhr/kVJuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791232438, "uuid": "fb89ff09-3dce-407a-ab48-0a02cd983bf9", "value": 28876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791232438, "uuid": "eae13a97-87f9-4c23-b0f0-172aef3d3501", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791232438, "uuid": "346dbecb-9803-4373-8437-7ca34ee0d513", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1201362b-c0be-11f1-927a-4201ac107004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1791205800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205800, "uuid": "3dbd5c3e-c2d4-4655-88b7-d81dda34d482", "comment": "Malware payload (AsyncRAT)", "value": "162299511cd3191928e9123205a33898", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ja", "colour": "#CC3A34", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205800, "uuid": "0d5e5e60-2450-4c58-8562-a89fe3cb26e7", "comment": "Malware payload (AsyncRAT)", "value": "d946d184a1a8153c96638ebd57620a063d745f8ab5d43f4bf42c269f47b57c80", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ja", "colour": "#CC3A34", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205800, "uuid": "6a3a535e-2ac8-4348-a865-6f8c1f0c709f", "comment": "Malware payload (AsyncRAT)", "value": "7de325eedab85d6f7cbb7437ef3cb1629bc3a79d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ja", "colour": "#CC3A34", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205800, "uuid": "79c31da6-5292-4fcd-9f87-5c7b60d4974c", "comment": "Malware payload (AsyncRAT)", "value": "863356e7a350708025e01a7f653d3bc1b02493a017f6876e08b1b2389b0b87ada03c8279a00ca1e525ec7ee084849323", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ja", "colour": "#CC3A34", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205800, "uuid": "e1c0d0ac-f558-41a9-8ee5-74ecfd2693c2", "value": "T13516029852F13AD8260CF208EEBEF3AD5407C8B73CD0DF103995B9E759B5829E9B5094", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205800, "uuid": "fe894a85-00d0-4d4f-985f-c57b106a4546", "value": "49152:CGcKqPubSJk5Lw5UNYhSz5cL3rEuq+r6d2N9YT9:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791205800, "uuid": "fb93d779-fb7d-4295-9efa-7eab58bfd63b", "value": 4098548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791205800, "uuid": "5b02eb02-0238-4496-b46f-21c26fa9f7ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205800, "uuid": "226f6623-0861-4a2f-a607-0cf9bc826330", "value": "d946d184a1a8153c96638ebd57620a063d745f8ab5d43f4bf42c269f47b57c80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5960df6a-c06c-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791170701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170701, "uuid": "bdffb846-5ecb-43f5-8d5e-e1f92f703392", "comment": "Malware payload (Gafgyt)", "value": "f0cb647db850d6d1c3d582ea9ea769fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170701, "uuid": "9c0ee3d3-6480-4910-b839-df77ca10f8dc", "comment": "Malware payload (Gafgyt)", "value": "da6a531b019998fd3e7340998e756ea9cf7ea6974f2df0770b67fed55bddedf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170701, "uuid": "917b3457-e0fa-471a-8a54-6c89a951eb17", "comment": "Malware payload (Gafgyt)", "value": "d4fb2cb94995256d5ffbf1170417703cc0288807", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170701, "uuid": "8d91a3df-4079-411d-b2ad-b3d264701849", "comment": "Malware payload (Gafgyt)", "value": "7c66118d5a2e313fc6fe323df9315020f7e467ce2b62254bcdd282aae314ef2d50433d0125cdc9216e3487996fbd5a00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170701, "uuid": "dfeba117-080d-45c3-ad34-e2493685de0d", "value": "T1A664C72A7A21EF7FE17887310BF78B74839521D62BE19746E16CC31C1E6028D585FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170701, "uuid": "07e5099f-294c-40e6-9b0c-fe9df9b68521", "value": "6144:7VpbM8I3dnwI0NeSd9i/TQboWI1v5lhvYHtWGL5Fh5J/qOAYP:bIN+eSdvIB5lhvYHtWGL5Fh5J/qOAYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791170701, "uuid": "ad858f66-7198-4dd3-8307-f3d5a21acd2a", "value": 323087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791170701, "uuid": "b53364c7-9e03-4015-9565-d4dd73b85c79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170701, "uuid": "747cfa25-94f4-4e5e-90a0-897682dd6975", "value": "da6a531b019998fd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf889ca-c07c-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791177525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177525, "uuid": "c6478432-666f-48a5-a2b8-5e27fa03b516", "comment": "Malware payload", "value": "fa4728f9454b69056d5d110d59666a56", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177525, "uuid": "edb87566-f602-4279-9538-3ba988a3b110", "comment": "Malware payload", "value": "dad6d4446092e2c99d3ad7ffbf39adb1757c282f4ac7bc2407132882311e3c1e", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177525, "uuid": "38c0a7ef-573b-4a06-905b-7dc90f3de7df", "comment": "Malware payload", "value": "ce049d78c4fbb3823563cadcb0fbcc59974454b8", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791177525, "uuid": "39f39034-489d-483c-a541-c0a1239cb190", "comment": "Malware payload", "value": "abcea46b04b6ef3a7cd44bc2f5d771c95b71758231236fca978a98a1f75a9ac5fd81438e07697542c2604776a2fe8183", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791177525, "uuid": "b950c297-2ba1-42d0-b511-4fd86e2d1752", "value": "T18842185CAED1A2B0FA1707DEB3AF24690228A0C7240DC484F94CDDE87F46BDD4A57B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791177525, "uuid": "63595259-5d68-4b9e-8fa6-3c0485e597b7", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzNbqFtCwS1RUM:sXX+/DV7k/3IFtaRUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791177525, "uuid": "6f8f440f-24d8-4149-b9a1-4c296ea4c40f", "value": 12028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791177525, "uuid": "9e42fc1a-25ac-41c9-b6a3-9ead34efdd55", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791177525, "uuid": "de962ba1-9209-4103-9a98-908eabd73f3e", "value": "temp.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862d8f01-c0ab-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791197834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791197834, "uuid": "94aeeab5-df43-47af-a400-0c2fac4b39db", "comment": "Malware payload", "value": "d649230fd9811c8a1216c997a41dc2cb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791197834, "uuid": "cf68f9df-903b-4689-8d0c-7a8baf6edfe2", "comment": "Malware payload", "value": "db3c035fb3a93d837e176e17ad68bc5f703c059cbf3fc4650bb76f42e37e45e2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791197834, "uuid": "a12a96d6-aea0-40c7-82a5-866bb685684d", "comment": "Malware payload", "value": "3ac5fef181ace96c15723f862b628ba475ee3cf3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791197834, "uuid": "e91a02bb-9326-452c-a6a7-077d6d2ae6f3", "comment": "Malware payload", "value": "b01ed78ce54db740ec60440ccb2d0469136090adeefb603d66d02f37c1c0d10009c51177175484f7a4bba82b4732ee39", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791197834, "uuid": "674ff45e-775a-4255-9bd7-136288b97bcd", "value": "T1E3F049E199A14937FDEC882EF2A84440E8751C2F04A13614748E66172B7C4A6AD5073F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791197834, "uuid": "dd2c91b2-2d21-445d-97e3-a4f24e494d7c", "value": "12:IJUmEe0Qg30YLCyEtYd+u/iuviugToNGT9FpeGfQBXpx:IGoc7CjaiuviuiY89feGfQBXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791197834, "uuid": "5902b0a9-81d3-4dfc-876c-d11d9ddc46e6", "value": 633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791197834, "uuid": "ded3cd05-3dd9-45d7-ab77-a401e517f550", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791197834, "uuid": "a5e8302b-7822-4901-a71c-eec3d78c9809", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e10eb429-c062-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791166634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791166634, "uuid": "97c5e888-49ec-4d5f-860d-0e6c3a02c050", "comment": "Malware payload (Mirai)", "value": "281050a949badc4c3cbf1ad5bd4f8f68", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791166634, "uuid": "4b551d1d-267c-44ef-9894-6ae83229b4d3", "comment": "Malware payload (Mirai)", "value": "dbe19861490e9f9bdb39e7c35a2f09c9c67e8fb9c6343bc3937ef321388ba008", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791166634, "uuid": "8007bcf2-8120-4e41-bd58-77363e1f61fa", "comment": "Malware payload (Mirai)", "value": "d13ec3b1c040028d3da9da73d4bf23177db32c90", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791166634, "uuid": "218a7f31-7c5a-4915-810f-c168e77a1f70", "comment": "Malware payload (Mirai)", "value": "05889d00a8e82afd291e820ff21ff16f1917fe37687d70c248e11a4194cae91c8c3c83a64d5d883fdbcf0dcd6b596990", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791166634, "uuid": "4a3df8ff-d248-4cd6-b18b-1fba086873dd", "value": "T17A530886BC828A9659C413BBB97E41CD330337B8D2DF7103DD151F18B6CA94F0E6A952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791166634, "uuid": "805d1e17-8d92-4b75-ae51-0275760a99f1", "value": "1536:CMn12A//SrRftY97WARbIcbboW+zLsYtJ913DhrPDysX+4if3Lh:T2s/ITo7WCkybotgsJ913DhrbW4UF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791166634, "uuid": "8cba0eb4-0fb7-4323-9541-867b8aafd6b1", "value": 65780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791166634, "uuid": "87efcbea-c530-4be0-8831-41a605c8a59e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791166634, "uuid": "64f9b79d-62be-4f57-85b5-6a50c6a3fa11", "value": "dbe19861490e9f9bdb39e7c35a2f09c9c67e8fb9c6343bc3937ef321388ba008", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ae3d49-c05e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791164928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164928, "uuid": "85f5b38c-f7b5-4197-9db2-06dc22f9d7a6", "comment": "Malware payload (Mirai)", "value": "ce30ed2acf633c3d591a840d3c7c8e0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164928, "uuid": "61e90c5d-a290-49a4-aa19-533de47a4b87", "comment": "Malware payload (Mirai)", "value": "dc01fe12438a973d7288c5fa2704df06d92df1c7b60f98e26a13186396b6b6d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164928, "uuid": "022446e1-a2c0-4b7b-ad85-691e83928dc2", "comment": "Malware payload (Mirai)", "value": "6e7df49bb7ba2c280e2a00dcfa84db0e1dbb19fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164928, "uuid": "aed7369f-27b9-4fa2-93e0-29bcb0c2a877", "comment": "Malware payload (Mirai)", "value": "1b890af8922b7dd3992c33349e9253d137462f852c831d68467a03cfa407c7ef55d01e6ab59fc81f7100d1571ede6645", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164928, "uuid": "71f7c088-8185-4c0e-abd3-2c94cf7562e1", "value": "T191A3710EBFA41EF7F86BCD3B05E81B0524CC651A21A93FB5B934D418FA5A10F15E38A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164928, "uuid": "aa2b41e8-62cd-465e-8b7f-1ff89b9dcd20", "value": "1536:xuhAg5M7Ghwk2V0WrLKyZzNUvI71j1zB5cZMqHZyT8uyD7:xql5QGhwkXWrLKyRNUiyjHmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791164928, "uuid": "67a03d05-e880-4f3f-9171-2d555c1446cb", "value": 101804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791164928, "uuid": "6690cec4-0015-4e2c-a0bb-0a32257f2e52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164928, "uuid": "8cc1b4ab-0b68-4c9f-9e00-b5ea67fcb8f1", "value": "winki.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97518072-c092-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791187126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791187126, "uuid": "94f723f3-df01-44f4-803e-a66012bc7c98", "comment": "Malware payload", "value": "2f1afa175c5eb2c9381c2ebcf8d2bd1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791187126, "uuid": "2267a8ab-2c63-4c06-814f-63464e04c04a", "comment": "Malware payload", "value": "dc2450e8cdaf1de56a2ff4ee68fcda754c244a2c90cf4e6cc08fdf9b480b6352", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791187126, "uuid": "74dd3a4a-f0df-4753-87fa-6699e9b39737", "comment": "Malware payload", "value": "f691de0e59d47162d1068d64c1de84d9fee1b913", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791187126, "uuid": "a7ad27f6-1966-48e7-ba25-029e2ea54ed4", "comment": "Malware payload", "value": "2067be20b1004b798636b100930e043cc19dff69e1fd3bc815e2160aa00f9012040e82a61431edf1d1d322b7328a9473", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791187126, "uuid": "49cd79c6-e3d4-417e-8b72-6827f4405522", "value": "T1BC74D51ABB919EFBCC4ECD3305EA4A1110CDE04612996B6BB6B8C61CF74BD4E48E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791187126, "uuid": "ce421ccb-d375-4718-8b32-9223f1fdef47", "value": "6144:fG5nRH+mIntiRgOBnRvTB/t/X3GhvZHtjGL5Fh5V/qOAYP:fG5n1ctEBnRvPv3GhvZHtjGL5Fh5V/qE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791187126, "uuid": "e64a4407-0f24-4501-b404-1fe907df00fb", "value": 341004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791187126, "uuid": "75fc4b21-5203-4ee0-9d6d-ee58c3a84875", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791187126, "uuid": "ab8bb734-78d6-46ee-8233-dbbc88a24a61", "value": "dissmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c6d826-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181759, "uuid": "483c9373-4f3d-4552-8eca-0ec16525604a", "comment": "Malware payload (Mirai)", "value": "fdd24230221def11bb5c412f94619d90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181759, "uuid": "41a37a4a-795b-4596-8ff8-3c4bb3d2906c", "comment": "Malware payload (Mirai)", "value": "dc9a9eedb74f21e656e27955c8cb353ecaa40808c54a493867cc51be330ee94b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181759, "uuid": "eb1ec047-05aa-46fd-9261-9141769dcca7", "comment": "Malware payload (Mirai)", "value": "f5c0b994c1bb03305f1bfcb3814375cb00de1fda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181759, "uuid": "0f5a631f-4ab8-498a-ad85-28af24d42581", "comment": "Malware payload (Mirai)", "value": "0f3d34e798534ca23fd5939cb11722ff861359b49a7ae297555542e8839bd52ce9f8890e323429f094540fe2dc558740", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181759, "uuid": "c4d6ee6a-a16f-4787-9e64-1c8ba28431c2", "value": "T18DF33B51FF83CAF3E40304F080EAAB3F5A30ED1A4436C559EB657EAAD5539D5E20A364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181759, "uuid": "9c8ba12b-d519-4679-944f-7af80a808e24", "value": "3072:qohH0V3JL6BTMTeZRf7tzJVhDTAhstn+x:qI0n6OyTsutn+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181759, "uuid": "6037c5ae-ca25-426a-bfe6-36f673ed0964", "value": 159432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181759, "uuid": "d92c93a4-2747-40e7-927a-c487d05c553a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181759, "uuid": "facabd55-3901-4e11-b0cd-90ecf35dda78", "value": "wife.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1318c76c-c0a0-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791192917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192917, "uuid": "d5082fc5-a3af-486e-b686-df8ee50cea79", "comment": "Malware payload", "value": "32b36aecd09aba71a0e558c20cd40fb1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192917, "uuid": "16792ef1-0e1c-4357-98d0-028045e8364e", "comment": "Malware payload", "value": "dca32c0ed32ad209f42bc4c59ffbdca42f5913f9d2248ee18b4473df9916a525", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192917, "uuid": "5e34fdd9-7372-498e-afdd-57ac7627575a", "comment": "Malware payload", "value": "a6e179ff19c836b7f90fc57e94701082242cea84", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791192917, "uuid": "ac45e8a3-b9d5-4aea-94cc-2f7374471ecc", "comment": "Malware payload", "value": "fe20cd1e8e141ce6821f54b5b1089aee189865b12bd01d84572be557c234809e7b00f113bbf2993d5b3a31c810efb802", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192917, "uuid": "6cffd5c0-888c-49b4-b6b1-68cb2e828085", "value": "T13405187682FD2F7DC42B5619CE7A3C0C98F054A10A4EF47AED3BA4C5D47CADA66A0190", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192917, "uuid": "a58be75a-e11a-4019-bac3-398c5bc36064", "value": "192:eC2tT8tPgIqYxXIDYfvoPyZsa09xSCsIQP8wcsnyP7wCNUJSO2K6ZkOc8Pi8xGwa:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791192917, "uuid": "e4a03b86-db20-460c-901c-9498342a347b", "value": 818054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791192917, "uuid": "15b21ee8-9352-416c-811c-92fb16cf7b2c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791192917, "uuid": "c6f6da2f-6c66-4fd2-b719-b77883e49326", "value": "RFQ-05-10-26-signed_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b83859e-c0c3-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791208124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208124, "uuid": "87a51df6-5163-478d-bfed-1eacd1a82474", "comment": "Malware payload (Mirai)", "value": "21431e551b65c5871409a6684b364dd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208124, "uuid": "c88e40dd-7554-4113-80af-5967e5a5249c", "comment": "Malware payload (Mirai)", "value": "dcac02c71bd67e7ce708e2fad709059b817ebdde9796542ef16855de5c7b9a41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208124, "uuid": "9f0a9335-328b-4757-961e-f085d4630cd0", "comment": "Malware payload (Mirai)", "value": "e34bc098e51d3043b8ae87dc1e32d34922c508f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791208124, "uuid": "edf656fe-7843-4d78-983c-3b6a208d69f6", "comment": "Malware payload (Mirai)", "value": "048d4e2498dc9cf62c89f1875c0edf1007a0bacf9f8f96f332828695c48972d360bee5c0074a369c3fec6521e11d991c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208124, "uuid": "903cef76-b407-4bc3-b579-4f5311cb75bb", "value": "T172E3E5CCEC54972FC2D223BAF78942CF37351A789397F32159A7DAB42B853481D291A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208124, "uuid": "0ff89811-8f72-4726-aa76-f5ec6e58ebd4", "value": "3072:1kARBcCI0gu0gb2kqe6QSsSmaSXNiqSEVAmiL8qka/2agGpOFxqSe3tSbEDzbujw:AopjJj1XnAslnHBZDNAnQHqlR59v5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791208124, "uuid": "a5212f5f-f776-4650-b23e-a698b030cce5", "value": 152163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791208124, "uuid": "7cbe7675-5357-49f7-975d-99e3cf565858", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791208124, "uuid": "3719f32e-0c0c-4307-b0e3-ad89d789e38e", "value": "dcac02c71bd67e7ce708e2fad709059b817ebdde9796542ef16855de5c7b9a41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7252937f-c0f2-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791228295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791228295, "uuid": "6ef422ef-d905-4bce-8e70-7c9a9bd7a228", "comment": "Malware payload", "value": "cf07ea6ce5c724d12e1ddb1f117b1eb1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791228295, "uuid": "9c6a0a66-a1bb-4532-ab09-95a7de15cd6d", "comment": "Malware payload", "value": "dcf399e00f1d728eb64057a7d31b5f4cdd89fad30f8642597741d24b9c184a2f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791228295, "uuid": "93019ee4-584b-4c0e-8046-b6bd41335c94", "comment": "Malware payload", "value": "57490caf1f7aee86039b450411ffff75b67082ac", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791228295, "uuid": "62db6fe5-bc6a-45ca-8231-e672d5c1de6e", "comment": "Malware payload", "value": "b776d33f6577e8bf807223523ad04bfe3a01f7b0dd690981f1700ef8cfc84d74059cd034fd627bf38ac3f27268b3f946", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791228295, "uuid": "f25643c8-5711-4a1d-9780-57797e4544e4", "value": "T1297533036A6CA813FCB34274474DA3EA89C9706B0995CA7B5E7953218D5FFC80F2C979", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791228295, "uuid": "9e6c786a-1269-4802-a163-4ee8b25d6684", "value": "49152:hjOWQ40pWad5EZRbX0Io4ifhds0B93mW/m:haWQwad5EZRbX0IBi/s6Ykm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791228295, "uuid": "e8dbe15e-bd75-4bf6-9074-a73fd0c1ed0e", "value": 1584681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791228295, "uuid": "ddc32025-5d7c-4f82-b947-7c8bf724fecd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791228295, "uuid": "a055bade-d508-47ed-b5bd-5f8db446da7a", "value": "dcf399e00f1d728e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27603388-c0ad-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791198534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791198534, "uuid": "ccc7a069-f82f-4bd0-8e16-dda5f5742068", "comment": "Malware payload (Formbook)", "value": "e664c7356d5830c43d905e21a4c02b04", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791198534, "uuid": "2bd29386-fce6-49b3-9185-7c81c06adecc", "comment": "Malware payload (Formbook)", "value": "dd81171bc6c8137ea1630eddfdb4234116b8293c5e4e33d5ba857686d04b9bfd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791198534, "uuid": "b7cebeb3-f953-4d8b-a8cb-617e6f7390ab", "comment": "Malware payload (Formbook)", "value": "ac9eaa763dd281aa345fb6869d64f1041bdb4269", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791198534, "uuid": "12382e90-858e-4c2d-a9bb-9b6cde5b4a99", "comment": "Malware payload (Formbook)", "value": "f15eff16669feb4d49fd2748b67e55dac4145044c6e16021b4cafccb4f271f0b261bb6f4202a104a32861d7750ed3f4e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791198534, "uuid": "ba5431da-d406-492d-a237-20123777796e", "value": "T1E86523244A4F36DF4901B0BBF1EAE448F299538B4E8A0346836CC5F936B58B1ED63D95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791198534, "uuid": "5494337d-91db-40e2-a8bb-514efe62f44e", "value": "24576:UK99cC0RJXtsgEimODUJ+0kGfWGYDnNBhMq5KaB5GZtTPmm:fOWgVjqbOzoqzBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791198534, "uuid": "813ddad8-938b-40d1-9888-74cec1b3d1d3", "value": 1527431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791198534, "uuid": "fff0508a-9052-4a76-95f0-af1f842bb085", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791198534, "uuid": "db95baec-4895-44a2-afa1-f665aad7b888", "value": "dd81171bc6c8137ea1630eddfdb4234116b8293c5e4e33d5ba857686d04b9bfd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3303d977-c116-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791243651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243651, "uuid": "162bb3f1-0b99-4063-8877-d109450f01e2", "comment": "Malware payload (Mirai)", "value": "6e18a6b16c96a800af80206ac7b115ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243651, "uuid": "ca3b84e7-8a87-4910-aebd-591e9cf1dd96", "comment": "Malware payload (Mirai)", "value": "de0634e952ef5f8a5efc75f674e540e0293bde123945514cdd1d30ab73d9e346", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243651, "uuid": "0020f8c9-e237-4d52-b52d-6646206478b6", "comment": "Malware payload (Mirai)", "value": "a3960a8d88e44d14f7540d7aaee6c4b7a43e31ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243651, "uuid": "4c8167e9-5dcc-408b-95df-e693d35cd13e", "comment": "Malware payload (Mirai)", "value": "e73b738f2b48d4c01cc8b3b6c0ebeb732b09c7774026b1286a877ef90aa204e8f3e23245b1d3493af3327a198e94924a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791243651, "uuid": "0e826dab-7dd9-4bd7-a101-cf440c461065", "value": "T1B3053B076F609DF7C86BCD3306B5CB2624CCB48332A53B6A7678DA4CBD1960756938B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791243651, "uuid": "a6c4e31b-40d6-4484-b35a-74100051e6a7", "value": "12288:p8GPu7rCW+roCcqJVcZlsBLeEki2lcFZT:FPKrCW+roYJV2sBLeI2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791243651, "uuid": "cbd8791f-e414-45f1-874d-7a1ecff3956f", "value": 858228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791243651, "uuid": "fc4ecd92-9b7e-448a-9d55-c342c59da9f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791243651, "uuid": "08961329-80f4-4b52-90eb-e53fc1289f41", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a95a15-c085-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791181378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181378, "uuid": "b0bb9048-fa06-4135-b67a-8f8e431a7031", "comment": "Malware payload", "value": "4c41ac66c742f351dd43182b87db94bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181378, "uuid": "28d23a9f-7004-4765-94c2-80500798fb35", "comment": "Malware payload", "value": "dee7a73cf29fd6550a9c36ac3eed84a552855bb7a974a70c48358cb852d2a7c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181378, "uuid": "a834ed77-64f2-4de0-98d3-72989eb96ab0", "comment": "Malware payload", "value": "4b7a69786c0df42dbea386cf57fe28eb943ea58c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181378, "uuid": "b8245c52-39e9-4232-9b4a-91171cfbaa3d", "comment": "Malware payload", "value": "9817c9a675af2f1d78b4cabfa21528d3c44a83bf74e61de8fc3d7829dfffab285d2dbe3b9fc50a7e16665684320f3d67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181378, "uuid": "d38d0e01-9014-49f3-81aa-94e74ad26cbf", "value": "T16AE2E816EF504EFBDCA7CD3344B94B4230CD5C2723E52B2B2971E929B11A54A8BD39E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181378, "uuid": "8008f341-ed66-46dc-8010-3ad4474d079b", "value": "768:4X3peSIS8p73xnJwef7etu8XeXiq6OeXU:4iDd392u7kG6OW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181378, "uuid": "05fab739-291e-4139-a4e1-550a4371dfbf", "value": 32028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181378, "uuid": "70955c15-b310-435c-b277-de3a4d6a0789", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181378, "uuid": "598d24fa-64b7-4fbb-9372-25115029af3b", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b24b6d-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181781, "uuid": "5fdddb73-74df-4cfa-bf49-2fe62450a7aa", "comment": "Malware payload (Mirai)", "value": "90e4f9168484efd42de39106966af81a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181781, "uuid": "438ffd51-f965-4725-a89e-1ba4b5ecd058", "comment": "Malware payload (Mirai)", "value": "df2ef07e5ea8cc204056a3b9ecc25eb5683bd34c36504f1cffb0fe7bd844aac2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181781, "uuid": "5400dc87-2de5-43bf-a4ca-702d85b7f1cb", "comment": "Malware payload (Mirai)", "value": "4f689388ba3e4075370c1b8c4e0d5117b77b89a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181781, "uuid": "94e06eeb-7dc1-4ba3-bdf7-971f2ef4979c", "comment": "Malware payload (Mirai)", "value": "b1cadc826eec5c6b8da6840b31b428e089940bda3796895017197106d88dfeaf370e37b604228a170dda1fe89246797a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181781, "uuid": "b2a0c845-5418-483f-9672-c6dce06cae36", "value": "T10B041946FA518F13C5C755F7FBAE02883B266B6AD3EB3003D9256F6437864DA0E3A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181781, "uuid": "4d553650-d13e-4f6a-8fd7-f490efa07def", "value": "3072:A7Qivybn98L2VNwPAQN4uBkyj60291Iso2RAmy:sdvyblNopN4OkyjZ29Xo2RAmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181781, "uuid": "d8cd075a-899f-4bd8-b672-95f1acf52fff", "value": 175996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181781, "uuid": "13598710-2b1f-4833-bc3e-ef0c74f60452", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181781, "uuid": "6aa248c0-f1f7-42f5-a516-1bcbe7517515", "value": "wife.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ee4782-c10b-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791239223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791239223, "uuid": "1f83b629-3470-4495-9a89-757338651b0a", "comment": "Malware payload (Mirai)", "value": "a0824ea95f06b3da59183eaabc5b319b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791239223, "uuid": "84a0c9dc-bfeb-48bb-94e6-155edd90c220", "comment": "Malware payload (Mirai)", "value": "df3505373114ac07684b4201b26e84a1a68272f466c352bbfb48066b51da54a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791239223, "uuid": "f77596e0-7fe3-44cf-8170-76423d834e52", "comment": "Malware payload (Mirai)", "value": "0b7e687d0631c8014a835f4962e418ae80266ef9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791239223, "uuid": "84433a15-2ee2-4534-9903-3f47cc2f0428", "comment": "Malware payload (Mirai)", "value": "4275a8570af62d47a5534c0a03355c6cf6d529a7d220a8972d81f07e60cfe16565d61507928dc1bcef0bc77059ebe8fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791239223, "uuid": "b3538c5b-d843-4479-9030-13432ee09e55", "value": "T118B47D12BF92DD73D46300F1121BAB624A71EC35182BD597E3E52EB8D930AD097193FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791239223, "uuid": "4efbaf8e-ecf4-4a56-8854-7436206daba9", "value": "6144:8AB0E7FkfDV1Kdttr3G/sccRiBkMMBjytDWgIpawXuMYDZ23WWWxQ/XIw+0k5g:sEJkf+tr3G0RRK8hkZ26V0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791239223, "uuid": "6ffdf455-61a6-4c62-8a79-a747d46c0120", "value": 537476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791239223, "uuid": "ab199781-279a-450d-8491-9043f336aa3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791239223, "uuid": "fd9d86db-53de-4be3-8867-e29b8186ad0d", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.30682.21752", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247384db-c113-11f1-927a-4201ac107004", "comment": "Malware payload (WannaCry)", "timestamp": 1791242338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242338, "uuid": "3ec7a319-8ad0-405c-8f8d-a2df48df615d", "comment": "Malware payload (WannaCry)", "value": "bd675a31ff5ea593c51e9bad87917784", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242338, "uuid": "f5615652-f5e7-44e3-bda2-89942b76d910", "comment": "Malware payload (WannaCry)", "value": "df4c8d227144d67603d1b6528e9d5d76d510e7e1fef18549553c383328c1a9c4", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242338, "uuid": "d8d4d401-76be-421e-b2a8-1a02bf1e8579", "comment": "Malware payload (WannaCry)", "value": "010645991d89f70ee29829ec41dd19be803baa7f", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791242338, "uuid": "323b8cae-01a0-4601-acad-a1ce12257ad3", "comment": "Malware payload (WannaCry)", "value": "5cdb003ad3f74f90c1f55c36e2de3ae6c1b8875f08c314d81619563981e177c739359aa97fa466783876d7b002f82a05", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242338, "uuid": "5b5da81a-e410-4dfa-82c3-242cc83aeb90", "value": "T1B036239A71BC91FCD20568B4846B8922F6B23CBE21FE6E0FDB9049691D03755B760F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242338, "uuid": "db6356f3-739b-4a4e-ac26-9d9ffd54da4e", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242338, "uuid": "2bcaa59b-309d-4343-b207-99d635fca635", "value": "24576:RbLgurihdmMSirYbcMNgef0QeQXLKz6626M+vbOSSqTPVXmiHkQg6eX6SA:RnnMSPbcBVQe4Rx+TSqTdX1HkQo6SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791242338, "uuid": "b77d0b97-4b2d-489a-bf08-2cfaef5fc1c6", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791242338, "uuid": "b8f573b5-ec48-4e3f-bce4-148b6fd00fd7", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791242338, "uuid": "f5815970-81e6-48ad-a210-929c8013093f", "value": "mbupload-8pwpcem5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7aa56c2-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185891, "uuid": "877cb870-9571-4b83-837e-fb9be732fe0f", "comment": "Malware payload", "value": "5079cf6c6e6a198ff9ba8e8d233c2462", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185891, "uuid": "6474dbf3-e9e6-4346-ae86-58f56c740958", "comment": "Malware payload", "value": "dfec84d67ae0638a3352a3b709bedd6b030874515249a58117b4172884f0e054", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185891, "uuid": "cc7a09ee-ddb7-44fb-9a85-6d7edfd02add", "comment": "Malware payload", "value": "bb9cb2d518e4f3bf93b317d9c8e370498aba02db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185891, "uuid": "1de58b58-c3d5-4200-bf04-b6a912b09dd1", "comment": "Malware payload", "value": "1943d8e81a841b88631b0a45822b5b5ef0919f46c87964f2f496cf9f520371a8159628bbf46d9d99b7f1d7c9bcc3dcb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185891, "uuid": "08378685-b5fe-481f-ba58-2b0059ce2147", "value": "T19C0533F708B8A8F7DDDE8FB8CE476CC14955A64E3658A008B9FC76C4D827488F60919D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185891, "uuid": "434e3918-888f-4af7-ad8c-a4a2e29b16ba", "value": "24576:k8wv9GwxrE5iuMv60Yazu0sVsP5X0eCotm:c9XWiuYnzuVsPN0eHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185891, "uuid": "6fbee5df-d8ea-4093-acac-3380a0547304", "value": 864744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185891, "uuid": "3c88a3c8-bc0a-44b7-9bc8-270478dc6ef4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185891, "uuid": "18128fd5-2dfc-4d03-87be-8eef19169e30", "value": "bot.ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955fb63e-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181968, "uuid": "2bd9f361-0c22-4a88-8154-ec607bd0e826", "comment": "Malware payload (Mirai)", "value": "210aca08a462bec7f17f932b1d327220", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181968, "uuid": "790eba83-872a-4aca-97e1-0a6f038c5b25", "comment": "Malware payload (Mirai)", "value": "e09008a018fd5ec95274bc0170672dc9514a76e7a98d16661259e82bc1f13c28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181968, "uuid": "1dc7ea33-1e22-4eb0-97d4-32103eee0e3e", "comment": "Malware payload (Mirai)", "value": "e4918f30e1b5dfed79ea4332afc2b220f1dbbee9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181968, "uuid": "95cf7212-9807-4889-b2f9-067abcf4970f", "comment": "Malware payload (Mirai)", "value": "aece57b9455b5f9ae50a44003703832dd5ef7e8c5d59b1e231ae7d68890a7f0826220af06162de78e719b414074ff8c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181968, "uuid": "fb5b03e9-41cc-4759-93c8-83c7345605ce", "value": "T1CB336B22A9791E2BC0E0F47A62F7C728B2F5070E25A88B4E7D620E4EFF215D0555B1F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181968, "uuid": "7231a8f6-2fcb-437e-8494-b3d56b593ee1", "value": "768:M7U+SjoHq9+scN2wNxyxnu3Vt71bquLYuO+hhQS9F29:0U+Sj2S+scNNxyxnKT71cchA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181968, "uuid": "2ba3554a-b7f4-4206-be92-48ef0af4a08b", "value": 54724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181968, "uuid": "6ff159aa-a447-490f-b760-8836dd077a56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181968, "uuid": "e31b012b-22f0-46a4-bd40-be022f72663e", "value": "miraint.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4408ecb-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (XWorm)", "timestamp": 1791190583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190583, "uuid": "25db4895-fcdd-4518-99be-7b957899603a", "comment": "Malware payload (XWorm)", "value": "bec1525a53dd5eaeb4f1eaf190ada5ed", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190583, "uuid": "b1c2c9ac-389e-42ea-8267-14c5fe212ced", "comment": "Malware payload (XWorm)", "value": "e0c09fb044e6f7745b30ec5998c6ea392b9189a03966a5f45cfb48f383b34a7c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190583, "uuid": "b01af637-48e2-4fd1-9601-bfc965611d97", "comment": "Malware payload (XWorm)", "value": "1f56799a853fa12b831bffab57f8a37ac35539b3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190583, "uuid": "0a5c3c2d-92ff-46b2-a7d9-eb44e9c686a2", "comment": "Malware payload (XWorm)", "value": "0366cd0dc8866bdccb3b57255008a3d82d7ae46bd33ef00925630feeddc0732ec833ce13a54678aa98290d71f7f949c8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190583, "uuid": "b479954d-0a40-404e-bbd0-a80d5c0f2a6b", "value": "T188C5C8BC514CAA70B57E672CD43A691007D5350733E4AF3D3AF8369563A1B23329F8A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190583, "uuid": "457a7d29-b9c2-44c6-83ff-061023ef6a1a", "value": "49152:5LGrH7xh/OIhp/KXzHAxnim4pB4Mt+gJs5n4qDzE8k74y8hkMO7RbJ:5LGrHlhWIhp/KXzHAxniH/R+gJs5n4qi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190583, "uuid": "ee131cd0-234c-4aa8-814d-bb6623522eb6", "value": 2531440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190583, "uuid": "7bc02552-da69-4e63-9841-ee5e5b86a10e", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190583, "uuid": "db6cc0ad-481e-47de-9ecd-724325929868", "value": "WhatsApp Video Evidence \u2013 Accident.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b01297c1-c0e8-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791224104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224104, "uuid": "1aaab3dc-696e-4983-8060-f571174c14f0", "comment": "Malware payload (Mirai)", "value": "e201fd991c393cebe5d7d76641a0b1f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224104, "uuid": "6abd98de-a485-46d6-9b2f-b5f75f8fc386", "comment": "Malware payload (Mirai)", "value": "e0d90a97ec9c98f6700c529d9377d1959ab4bd46c0c07ee8d58aa3eacff8a0a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224104, "uuid": "565554d8-1b6a-404c-bb53-05fbb3a7a698", "comment": "Malware payload (Mirai)", "value": "4a83e0c89fb670db9c73bc3a85772522712cd376", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791224104, "uuid": "f11ba053-3a8c-4cb7-807d-e063e3f543a5", "comment": "Malware payload (Mirai)", "value": "326f8d4b93501c9345692cd6a267fb1afe3c60d8c8e0a2a2c1f8bd9a888c1159d7d82bfabc68f78c3dc593dc746cc984", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224104, "uuid": "fc21df48-7681-4d1d-9073-cdebccc9b7f4", "value": "T197445B87FC10DDBDF45ED33748274509B130FBA544925B33B252346FAC7A28A1A67E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224104, "uuid": "76e6db7d-507b-4bc4-8799-8be0fbc74e3d", "value": "6144:qdxsVce5Gyhm3nTJJmcy8yR+X+4Z5ndXhLCYy6:vF25+Yy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791224104, "uuid": "8eb69bd8-7875-4544-bb73-ec775392cd78", "value": 254916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791224104, "uuid": "42d38a0b-bc84-47fb-a9bd-be6ebde775d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791224104, "uuid": "da52641f-98ff-4b94-8437-3396da8050ec", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a2ba67-c09b-11f1-927a-4201ac107004", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1791190742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190742, "uuid": "3dce0bf1-e975-46de-a925-5a5d783687b7", "comment": "Malware payload (VIPKeylogger)", "value": "23567594fa9a182ec47fb9a5681621a7", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190742, "uuid": "01096b4f-10c2-456d-803d-e8bc07895527", "comment": "Malware payload (VIPKeylogger)", "value": "e115ad62edbbd01da8dbbbbf4576b75efbc10aed0600548b2e064d489beee39a", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190742, "uuid": "4d7b95b6-53e2-4783-897f-7107402c4c09", "comment": "Malware payload (VIPKeylogger)", "value": "a738329fdc5be187b09ada2ce83576dff21cf0b7", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190742, "uuid": "9ca8a668-3e47-4058-b19d-ea6824144c80", "comment": "Malware payload (VIPKeylogger)", "value": "4a6ecc2e55d5e2de87addc5aab0a4ae815eee2cf1eab5ee2e30b8e4817743a99236f4360c4e76f52a906c49f7c7b2d77", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190742, "uuid": "563015e2-fe98-46a3-962c-3f756bf7c6fc", "value": "T15EF5E7461F879232B3616B8D8239ED32950AD10364B5CBB038BDD61F362DD17672F6E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190742, "uuid": "efc60117-6874-4dad-90f7-bef181120912", "value": "98304:w1fHGx2M0J4NoislRlnZxGOkZ/M0eNE3cxGPjnKwdGB9uOd13UvHG60Trp3QuChn:efHG8M0iNoislRlnZxGOkZ/M0eNEjLnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190742, "uuid": "7ad8f4d8-9755-482b-9f04-d1e1c5840440", "value": 3511264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190742, "uuid": "9500901d-f3bf-4ea4-b6d2-c4bd098c282c", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190742, "uuid": "15e593f3-5943-4a92-b30d-30393d58c589", "value": "S\u0130PAR\u0130\u015e ONAYI-05102026_xlsx.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5a7877-c0f9-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791231236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231236, "uuid": "2bb0faa1-ba7c-44ad-9d09-b20c5252fa70", "comment": "Malware payload", "value": "992ae666a3463fda69bb674fcf65bceb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231236, "uuid": "489c9838-707b-476b-9a19-f309f6b748ac", "comment": "Malware payload", "value": "e119889d4bf20018acf0507126a9dd0c9a9dd840c01401c301fd5267c795a5f1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231236, "uuid": "53cdb663-57e3-4917-895a-90623807647b", "comment": "Malware payload", "value": "da6a96fa94d5b0359898e3da366c050dc3173c1a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791231236, "uuid": "6d726a0d-64dc-46e5-a3bc-0b9274ff3ba4", "comment": "Malware payload", "value": "45ced8835c0e1e1640ab3d37f2bea1da58d2ecc3cf23162bb532d02b3ea376d78d2a50d6b3a3c6d5a31d055e2210f97e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231236, "uuid": "3d7caa8f-30df-4e23-b148-c8d162c98a25", "value": "T1AFF1027B21F08B31D7D021C8526656A54E72A70B996A04B8F4BF573ADF2DA0370E7B30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231236, "uuid": "2bfc9389-70e3-4b89-b202-28df7aca1176", "value": "96:cCuKzCB6n7sht+O+v1fsn+h4+tIicqbA/GsGqZ4Burxfo/rhb:cCuu26nC4hvZ5mzjHO8dC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791231236, "uuid": "ff82919f-c9e1-4551-85a9-467924a4e0bd", "value": 8165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791231236, "uuid": "9f700c33-8c4a-42a1-9999-5672690fd1bf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791231236, "uuid": "324e2583-0b4a-4e73-a608-3aa408a11231", "value": "e119889d4bf20018acf0507126a9dd0c9a9dd840c01401c301fd5267c795a5f1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb94ae8a-c0df-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791220285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220285, "uuid": "a81e25df-a05b-48b2-af73-6797746086f2", "comment": "Malware payload", "value": "f2f173bd53924f3b8607c09c97b382ef", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220285, "uuid": "1cfe03bf-944b-4531-98ac-31f8ec1152cc", "comment": "Malware payload", "value": "e134e5053b3705c7b24491aa8dfe4d0975d6dfc4420d4e9fd796bb8d9e65b860", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220285, "uuid": "918976ed-c958-4cdd-9031-3dbc7cfc9fb7", "comment": "Malware payload", "value": "6aa46a6ff34758279bba4c9df009ef2656f0aedb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220285, "uuid": "44abdc06-3cc0-4a2c-854a-29d0137f9599", "comment": "Malware payload", "value": "3de319c0dc01b5e524a87377923c61a6c34d3ebc8b57496eef0dfaf471e404204c8fd1ca55e9b3662108eb84b0c22a04", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220285, "uuid": "179d7f9c-2571-45ec-9cd0-a2e9226c54e2", "value": "T1AE562897B9924942C4E43A77B8BD81C833630EBA9BC652566D05FE3C3EBE1D90E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220285, "uuid": "b1c45204-1250-4dbe-a268-74b89e245e22", "value": "24576:az+xjtnwNQg33d8dtapQPM4PFjscIGGqd02npH88/TGnGTWxpjknXRWUO27XtqEN:aTeieiWeJMU8w0JSQApt8+oujGrb75EQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220285, "uuid": "21f3ef1d-e2e2-47fa-ac3d-b52cf8facf24", "value": 5963960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220285, "uuid": "8d1e5bf2-1f29-421a-9b2c-eb614633c451", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220285, "uuid": "fc2ac69e-1aa9-4996-8b9a-59829fa475c3", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448081c5-c087-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791182262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182262, "uuid": "4bca63e8-56b3-4b9b-9a1e-5633ff3d94b6", "comment": "Malware payload", "value": "9adc0444a6048b6a758fffa3c24defff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182262, "uuid": "b3387574-a672-480f-936b-ecc48f9354a0", "comment": "Malware payload", "value": "e1f02c18d600bcf5bae59ddbe040f0bc53c99d458121d0caa8422982e168a5e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182262, "uuid": "a0e9af25-5dd2-4674-b514-3e220c9c2631", "comment": "Malware payload", "value": "0fadd55313752b553727341e076b9b770c37296e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182262, "uuid": "f6ba86e6-0022-446e-bc31-accda8c9bbbc", "comment": "Malware payload", "value": "98fbe4c6ddcb400f09ef9ccc6ad65ae78f95b3a2c453f3242b245deac1fb1a80007c55dc6b01ac46b9be4ada6fbe3a97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182262, "uuid": "0393f303-1038-4821-81fd-e279d4868270", "value": "T180346B47A9D54FB7C145AB71A9B75A30071BE8151F4B0F8BA539EAB4034B9CEF00A738", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182262, "uuid": "326f170b-5204-4868-ad1f-e6b7e0f12dd1", "value": "6144:T4TgnMPxzPn77pZOZV0vxT5pvjPwYLqz0hxmyGklpO:T4dpzP/pojwxvjPwYLqz0hxmyGklpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791182262, "uuid": "72fc91c2-e020-4907-8c6c-8acff1fa1be3", "value": 237295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791182262, "uuid": "9397e501-d5c1-4e54-9c0a-5648cf646f45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182262, "uuid": "4d14c827-291c-460d-b6fb-e601eeb6c6c1", "value": "disssh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37f7953-c0e0-11f1-927a-4201ac107004", "comment": "Malware payload (Vidar)", "timestamp": 1791220647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220647, "uuid": "15e38e07-5ae0-448f-b818-326cbfc38f62", "comment": "Malware payload (Vidar)", "value": "357e6c2930275df89a9272e431e096fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220647, "uuid": "ad7233d1-f0ee-40b8-a47e-e4d5c31927a0", "comment": "Malware payload (Vidar)", "value": "e203aee47ec911c8e6345cd89df9f338127a2b533fa4852f955d2ebcf25f9707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220647, "uuid": "2982ddc3-70ed-4c1b-97c9-47d128d91787", "comment": "Malware payload (Vidar)", "value": "a3940e97228ec9a99be278dc7171ac765cb56c07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220647, "uuid": "d63829b8-ffd5-4377-b56d-d7977a9f79b5", "comment": "Malware payload (Vidar)", "value": "c9630a682a4b32acbef4af3dbe353b983a1ee35512930d2c3ce374c67bb9f8ff6c32b39dc38f98059710e98c2d740f71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220647, "uuid": "66cc9a48-0cea-4e7c-b6e4-21df5addb86b", "value": "T11AC6C457338800DCC94BDAB544B04D7912F23DEE4432BB4A4E99BE952F167966FACF08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220647, "uuid": "03658e47-3a24-4360-8f04-cb9dec7a1860", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220647, "uuid": "98befcd3-d337-4d5e-8cef-808b561edc89", "value": "49152:R5DtwOWvgZk6Pw+WkdW4LGW3F1qEUwtq7heG5d2UXqoePNZ3Sz+tlSyVRF5lav5H:A85o0C8j4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220647, "uuid": "dcd5b558-102e-4f16-9a80-245b24577c07", "value": 12329920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220647, "uuid": "388626f0-b147-4f9a-a8a5-099006f98492", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220647, "uuid": "07e2a48b-22ae-4de7-8e60-b4c133d1022f", "value": "e203aee47ec911c8e6345cd89df9f338127a2b533fa4852f955d2ebcf25f9707.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319a7a02-c116-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791243649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243649, "uuid": "c62d1aa3-871e-4e56-b77b-821f0cefc923", "comment": "Malware payload (Mirai)", "value": "3f4c82af5f00da09d264cf25f993b50e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243649, "uuid": "87a0d15e-e525-4f0a-b4a6-5d3e962fa499", "comment": "Malware payload (Mirai)", "value": "e24e2a92494d8fe0bfcaa0b7cd3ae4bc85d6036c687bac93099631c96d6d1c4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243649, "uuid": "a4344a99-a814-427e-bd4a-3466b67c336c", "comment": "Malware payload (Mirai)", "value": "eb87acaccb4ccfb4afa5ae32e3dbec5bd51a2cdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243649, "uuid": "13def77e-893d-42ba-97ce-b6d130aced81", "comment": "Malware payload (Mirai)", "value": "4ac47eaa655df06fab3bd26ca641fa4b587f9836232ac3b4db0c866eb0843f14689e3bb38787e2c4da62f6483c34146f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791243649, "uuid": "280fa0d9-b60f-4775-b47f-aaf724a82883", "value": "T193B44C87BA01DDB7F446A336845389057120BB73D8825F37703A787DEF7A1A85522BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791243649, "uuid": "b98ef678-831f-4656-93d1-30a0bb34e202", "value": "6144:AxR1T3nfbJ+J3/s4HKFueIBvmE/x/3sMism6X8Ay146VwEEokUgLOmyNIqqDLEoU:O17n9yfZZmplE67qn60mR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791243649, "uuid": "3655bff4-83cc-404a-a927-0a30e75d5099", "value": 531372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791243649, "uuid": "c2bd7840-451c-41a6-98bc-d6b10d3ff457", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791243649, "uuid": "0d5fff7e-7f0e-4525-8b1f-825964c530b0", "value": "eclipse.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c8f2fc-c05e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791164923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164923, "uuid": "d68c9a5b-bdf5-4dc3-aed4-e0d7957d48f5", "comment": "Malware payload (Mirai)", "value": "fa67eae6c1952bc801ff3217e6d998e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164923, "uuid": "a6cebd3e-d49b-445f-9050-4154793462c1", "comment": "Malware payload (Mirai)", "value": "e2546433e7d686414916ec02c249e99b2e57e10823c2ca8563e18ce46178a39b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164923, "uuid": "e53b57a5-66c0-4bdf-8e05-7c13d8b6575b", "comment": "Malware payload (Mirai)", "value": "73599e76362c838bf71b3e6b8186b966686d4998", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164923, "uuid": "ed497464-79a8-447b-94a7-1207960463b2", "comment": "Malware payload (Mirai)", "value": "6511903d306b787b191e0facc2bfe84e8e707efaabb3cb5e5bcd4869b30a6f2995855afbea3db7bd5dbc319eeb1ed47e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164923, "uuid": "547ab0d8-a8fd-497c-b3c7-3d5f455fc94e", "value": "T1C073188578869A1AC6D0537BFA0E43CD372573C8E2CE3203CD619F6176CA92F1DAB191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164923, "uuid": "99fd6c2a-31aa-4687-a56e-0ebd091d3cc4", "value": "768:O8XP/urX5fu5X8o27o3MoMPo+l5Zz70ba2cmGcwBJyxqLNIKmmIsqeknu1StVTXq:zXuZaGDFXUaxXlPywLWKggID/gP/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791164923, "uuid": "5afa4616-3082-4ff3-b347-db19f6722a13", "value": 74880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791164923, "uuid": "78a6379d-6127-4d00-b4ba-af4c1c375f47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164923, "uuid": "1b7f0e97-4074-42dc-9ddb-997bf21af201", "value": "winki.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5e82ac-c117-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791244257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791244257, "uuid": "62015d12-09a1-4a62-9e7c-22d59dbeffd0", "comment": "Malware payload (Mirai)", "value": "c00d818983b6766c4a36de646b3d9c51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791244257, "uuid": "a865c93d-8b80-41cc-9c0f-87f361630b8a", "comment": "Malware payload (Mirai)", "value": "e4d773921a8547c59f5eca2f26dff8769b9ef10df2d51789f9f3f6f7161de896", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791244257, "uuid": "f40482ac-a583-4b46-9a99-7a10b7aadab4", "comment": "Malware payload (Mirai)", "value": "de399e42db69c22081465bb86343031e709bc8e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791244257, "uuid": "53106091-c401-426a-916f-7d05f1f56791", "comment": "Malware payload (Mirai)", "value": "3a57267ce88adf3ef1a6731ecd23c34687df67fb09626e407df0481dc7429ed6c8c1d92a4e7f475d90732b9fd02e0fa4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791244257, "uuid": "eeb0040c-17d6-4133-b9ca-db4a0675aa7c", "value": "T12BD45D66BD919B90C5E159BEFB9E437872135BB9E3FFB006CA045F906BC94850B3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791244257, "uuid": "c789bc93-19c9-4bfb-8f2f-694059e359c0", "value": "12288:bJ1qpArDqu4zc8T7Bb9EWimaMsjUlNTnbL5nfpq3Nmx:khzcOF1jsj3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791244257, "uuid": "84b8e385-62eb-4811-a130-4966895c717d", "value": 626312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791244257, "uuid": "9cc13e72-1da9-4c16-b861-20349da3fecd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791244257, "uuid": "361a5be4-cc9f-4754-8f87-44319e8f1ac3", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226d3752-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791218712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218712, "uuid": "97ac6b19-ef6e-4e7f-8677-e780f9bd4ade", "comment": "Malware payload", "value": "ed2eeeca17a68330c126b759800a45a6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218712, "uuid": "9e05fc01-ed29-42c1-9bb1-07df91454ccb", "comment": "Malware payload", "value": "e6d118a8037f7f5b11a3666e59a7079a5575172679ecdc0262583aab07d44043", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218712, "uuid": "3ed1b396-a474-427a-a716-59393ce733cb", "comment": "Malware payload", "value": "5783a820dcb5260bb603d06b191a61a9c2a2d640", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218712, "uuid": "81d39a13-3689-4ca8-b8d0-15bdcda25e1d", "comment": "Malware payload", "value": "d3f9e21bc86c16fbc900cd789692ffb7bfa20134795ec255c2d43c1237e73dddf63795feea3146a41bc1512195b382f9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218712, "uuid": "3c91cf96-897e-42a0-a964-6fde1ff3ed38", "value": "T1DCB32A82BB43DEB3D89310F101F74B254E31FC3A8836DA95E37ABDA589551D0A61637C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218712, "uuid": "fa6d5aa2-a35d-4291-ac65-23e9822061f5", "value": "1536:clf5j2cdNxSFW5s9DslzYKthmI7MRgNdO2NyzvX6:clfp2cb7m9DslzY2DjezvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218712, "uuid": "bb4e5781-abaa-45e5-a391-8178d116cb6f", "value": 108432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218712, "uuid": "416fcbb1-a67a-4fe7-9f95-95819c5d84f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218712, "uuid": "3380c9dd-a945-4cc3-9290-edbb9f6fe633", "value": "eclipse.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2886e205-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181786, "uuid": "13845da6-8c82-4863-8f86-736f85cf7813", "comment": "Malware payload (Mirai)", "value": "c7dd9197f478774d9196684a18722cb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181786, "uuid": "cca08d25-2359-4e30-b735-cc4322dfca19", "comment": "Malware payload (Mirai)", "value": "e7ca4b879bc74e5792183df8fd08312e7546b626066106a88756aa4577409554", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181786, "uuid": "edb94a8c-a157-4efb-bf9f-3d2e114e9886", "comment": "Malware payload (Mirai)", "value": "88e21b486b60a1f5dc2b42acea3c54bcaaa6dc4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181786, "uuid": "a426f087-a584-46ef-ba29-f4e81ad88eeb", "comment": "Malware payload (Mirai)", "value": "0c46dbfcd4df013a7c4183b5a37761f9643de346b0d6cf6f5b468905011126bc6419a2f5713f82fd9a73fd2fa27ab178", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181786, "uuid": "2c316937-fa0f-4dff-8d89-9bd871646803", "value": "T1E134B50AAB519FF7D45FDE3305F9870124CCB85321642B3A7270EB5DB95A68B09E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181786, "uuid": "94776954-8929-41a1-838a-12c452acd1c2", "value": "3072:ptMHw5H1/mOpqNLXZ6lJzq8aQr9TkJRzj/ZOrFi:phmOMbmq8aCTkzj/4rF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181786, "uuid": "4d2ebf87-6345-45bc-9b99-6a20bb5990eb", "value": 253060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181786, "uuid": "35feceff-0231-4c03-8838-dcf572bac47d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181786, "uuid": "6d561e3e-4c3b-4729-b097-0d5c8333381f", "value": "wife.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a50b9a-c0bc-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791205303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205303, "uuid": "c3e97127-d29d-4fae-94e1-63d745dc9556", "comment": "Malware payload", "value": "960aae789a38e809d7475c7bfcf36fd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "NEEDYMANTIS", "colour": "#92160E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205303, "uuid": "6d1ba0cb-8bc3-4a16-af21-02b0a28c8d37", "comment": "Malware payload", "value": "e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "NEEDYMANTIS", "colour": "#92160E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205303, "uuid": "1842d3ae-25aa-48f0-8235-94d5e458231a", "comment": "Malware payload", "value": "ade4b1581184d3b4f1d44e8b3a123e121f079a98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "NEEDYMANTIS", "colour": "#92160E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205303, "uuid": "8f91435f-0526-44cc-bbec-d78a964ffd7f", "comment": "Malware payload", "value": "7b5abf61c5a55ec4251b20382c4eaf5559e69efef29a761594e0cee463a94f82249bbd007e57d7bf9f08d202a8c33d6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "NEEDYMANTIS", "colour": "#92160E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205303, "uuid": "66eea3bd-b778-4930-a4a1-59e1755892e6", "value": "T13F34E8D15E9206E8E977923C09537D16BAFB3A148674DFAB0E9442A34FB3781A03F744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205303, "uuid": "c957a11d-46e5-4f8f-ba9d-c7bae1ed8e84", "value": "8eda8ab7546f1ff90f0e755d0ffadbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205303, "uuid": "f6e8efbf-821a-4b95-be9e-fe02a2f7ad09", "value": "6144:pwmKsrbMxcm2KM838TztAaLrLhuVuMU4yBv1:pwmKsrbMGzrEValBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791205303, "uuid": "38512890-ee48-4005-980f-759c10610bca", "value": 235520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791205303, "uuid": "eddedc5b-b35a-46f0-83e8-fba9c43db5c2", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205303, "uuid": "f9c803de-d5c3-439e-ab1d-2d2fc82e8e61", "value": "WinSparkle.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d1f1a2-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218936, "uuid": "71864a3e-5230-4a59-8232-af8b5ca7bed4", "comment": "Malware payload (Mirai)", "value": "8f44d6bc8e49a636077db876c08cc8b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218936, "uuid": "ea38a867-2bb4-474b-a7ff-33001fce8ece", "comment": "Malware payload (Mirai)", "value": "e8a2652198384d3863c7bf15d0829bf29cacd22eb76b940839ed766be90017a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218936, "uuid": "6a0db813-cce0-4aa5-933a-9c31669f73a3", "comment": "Malware payload (Mirai)", "value": "a3230e2de9146fd8232ce3af7e84e263ac47dcbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218936, "uuid": "3386ed20-0d7d-47e2-b884-38728e0760fe", "comment": "Malware payload (Mirai)", "value": "a6cb18b767229553226e9db272f4cd0c37e1e9bf65a591bb3dc7b826b55fe0b8526acc793ba0ac2d6983b5966efd836d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218936, "uuid": "b233c2f3-01b6-4a9e-a241-02f2ec6c489a", "value": "T1A4043A08FACBC0F1D84B4D70506AB73FCB315A294132DB1AEFD1AF72DAB76019226255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218936, "uuid": "8be745b5-5116-4da0-9ea3-5e572d0a37e1", "value": "3072:jf+QL5UmJwaoQgl8ajF/VkMfiKSBX0NQfhivR+Y2C:jTVUmJwalgtjFKBqo/Y2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218936, "uuid": "0cf89cce-428d-4a42-9ca4-7ef5f87917d2", "value": 189160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218936, "uuid": "ece7dc3d-e16a-4584-b05e-59b0388906da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218936, "uuid": "3e3be545-353c-4bb8-a9d2-f047efa3aa19", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ea75e5-c0eb-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791225288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791225288, "uuid": "50d6f4f6-872f-4f4d-8c0e-dc338fea36b6", "comment": "Malware payload", "value": "8a1e6442027595f537870fa90a8a1cd5", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791225288, "uuid": "d1c0a65d-18e3-48d9-92d5-cf50169b7d93", "comment": "Malware payload", "value": "e8d687550eb09938482859f2821237f70d9eaf0b5d6eb095ff23f584fbb778b7", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791225288, "uuid": "820c91bc-d52b-49d7-9344-e7b7a90d522d", "comment": "Malware payload", "value": "60cc91586a120d3e8f1365ed5638eb8d45b3af3e", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791225288, "uuid": "830d613c-7e23-4c6e-818a-f2b1bd714ddc", "comment": "Malware payload", "value": "26d9f23857b095b3fd8ff391d27c5a369d2de88ca31f3fa2dc3679b2fb9b35a25739da53844542c07b5aa4d5180faad9", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791225288, "uuid": "591f3e5f-d753-4c6e-921e-d742f5f73711", "value": "T1AB42D64CDEB1A3F0F22703DD37AF699D2664A1D31049C640B58CAFA46F0B3AD8547E69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791225288, "uuid": "cf7b56d0-a80d-4a77-bc28-50de556e55d9", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxz0QQ9VFAE6+7My3tjtxQ:sXX+/DV7k/3vQ9VFAEN7f3tjtxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791225288, "uuid": "1fd20395-bf4b-4252-b1d9-67db0ff4e764", "value": 12217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791225288, "uuid": "1ea31101-9d78-4c38-aac8-b5afa08ab5be", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791225288, "uuid": "dee5c06d-7f6f-480e-83b4-33644f4e75e4", "value": "ffffffffffffffffffffqw.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988e85bf-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791190564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190564, "uuid": "e0812e8a-09c6-4ba5-a17b-ef10f2f8a51e", "comment": "Malware payload (RemcosRAT)", "value": "a669645828361d431cb0f1c0ebbba5fd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190564, "uuid": "8fd602c0-0c03-439a-aacf-3dd597a3c3b8", "comment": "Malware payload (RemcosRAT)", "value": "e8ee53d7067ef49252d133cf218c5df34c58bc17823e6857e9f3266818d8b097", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190564, "uuid": "ef16a010-d497-4770-a9e6-78ec53db7b3e", "comment": "Malware payload (RemcosRAT)", "value": "c4ab53a134a2afa6874e79f55a834697528d8aad", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190564, "uuid": "ceff9d01-0a16-44f4-ade0-bc330a4b044f", "comment": "Malware payload (RemcosRAT)", "value": "6e733d792510a7f1362445459087dffc49666b6d5520895ecd84828e62416bf3cf65745d24d71a5f42b9b99cb5ed5255", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190564, "uuid": "8eb89626-210e-4d02-b6f5-db2842f9481c", "value": "T14BA5E70232BFD70CF1F34E6C86E670946A77BB999A75C7D801B0184E05E5C90CAA2F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190564, "uuid": "10a0d0f2-c744-49b2-80af-af3c4f12a2d2", "value": "384:Auuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu/uuuuuuuuuuuuuuuuuuuuuuuuuuuuu6:+pku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190564, "uuid": "07b3e473-1d67-473c-9b15-de7f8983c229", "value": 2184534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190564, "uuid": "d0c5d1b6-e4cf-44ae-aa5d-bf4dad32af28", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190564, "uuid": "7e03f5ed-91f4-41b5-a63c-b7f73feebf12", "value": "OCBC Bank_Payment Advice Copy.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35d8884-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791190609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190609, "uuid": "73a36072-53e9-4b14-ac47-9b4c3a08f005", "comment": "Malware payload (Formbook)", "value": "7e9a8ed142ef655fa889ec25b9dbf1b1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190609, "uuid": "ac84244d-a444-4b6b-8f39-ceb4265e625a", "comment": "Malware payload (Formbook)", "value": "ea6188f0e81d426bb529b7d46f40e8df3f1655aff783ca60c25999cd862b0657", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190609, "uuid": "9dc3bde7-eae0-4fdc-9990-96b5630f28a9", "comment": "Malware payload (Formbook)", "value": "d1338246fdf7f6699b3688da66589a75c0038af2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190609, "uuid": "3c8fe883-0898-4c21-b7d1-9fa8f4c119fb", "comment": "Malware payload (Formbook)", "value": "d39847fbcfe2e810e29e673f5f3013819c13d22bfd0548f9b098923a33ac9ed63322c25ad6897949ea731561d5afc87d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190609, "uuid": "0e4865e8-cd33-48e5-9c8f-a580454aa067", "value": "T10BD22A7EC758837739B18F488FDAC0DA4F2FDE9E97385A09C24529254EB2C0AD44F916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190609, "uuid": "444cd8ae-e6d8-461d-a1fc-fcc35d9a168e", "value": "192:ATZGxc+GnOkesmYduYCnhJNVuvDw3OTfz73:eGDG1XmYiHDu03OTfz73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190609, "uuid": "06b4e79a-e9be-49a0-b976-b2ba16e74cb9", "value": 29878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190609, "uuid": "2d080aa5-41d4-4502-8fd5-998c186710d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190609, "uuid": "5a281502-9e29-40a9-99fc-f5f932c19679", "value": "Remittance Advice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a58881f6-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185861, "uuid": "6d822cda-7acc-46b8-b034-d3aa2b0f9e07", "comment": "Malware payload", "value": "524324c8ab1dd373f2b162f73cfa8bba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185861, "uuid": "dd77cd15-a5f4-4872-ba24-e1f15194ce28", "comment": "Malware payload", "value": "eabdd17c32c11d48f4ef3286f9766ff1fe753e1367594adc2f55078e09f3f86e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185861, "uuid": "fd080217-8ceb-49bd-b35e-218d8dcec6d9", "comment": "Malware payload", "value": "18eaa67896106f0224cf1003a9d67fdf54cf33a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185861, "uuid": "7923d66e-f331-405a-a8ff-b081283fce9b", "comment": "Malware payload", "value": "8985414c0f4c23bdfb059bcae7c3544935924449e680d87c3e2326a66ca380624df83e531a044f9636001db1d9ad27df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185861, "uuid": "4b878bc3-d1ec-4853-bb0d-a7836305bc93", "value": "T19BB2D727E662146FC18AC63445978A309633FC361B627B3B8B14F4742F70F193FAAA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185861, "uuid": "cd8490cd-cc06-46ed-b8bc-b3871c8609cb", "value": "192:GA51ztcdEuSfhOj8UaU73dKe2/M+Csb/FASqVrwRs15nTDLc6Dqd33w2apK1p:572WxfhOx3G5rEwADo9dm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185861, "uuid": "b7391424-31cd-4dd4-a36c-1dc63194fee9", "value": 25064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185861, "uuid": "b3fe4eb0-a7eb-43a4-a680-a1f701ee2949", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185861, "uuid": "48e5cdef-a1f1-4836-9cd2-77d5e342f0fe", "value": "dldr.amd64test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d15909-c0be-11f1-927a-4201ac107004", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1791206019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791206019, "uuid": "8708dbb0-c3be-424a-a809-e6b630444dc7", "comment": "Malware payload (ParallaxRAT)", "value": "a1df599c924b506851cface2c97f0be6", "object_relation": "md5", "Tag": [ { "name": "69-48-228-110", "colour": "#B3DF0B", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791206019, "uuid": "25f2be62-1504-4e80-a693-3e444862c0d9", "comment": "Malware payload (ParallaxRAT)", "value": "eaca658a963bafb0998aada2c79864d42f526dc34076033005f4b34f236d76b1", "object_relation": "sha256", "Tag": [ { "name": "69-48-228-110", "colour": "#B3DF0B", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791206019, "uuid": "4106e0f6-f605-4975-9fa3-cca0984d9c23", "comment": "Malware payload (ParallaxRAT)", "value": "92ff8be19442befaf32397a14af7d255198c884e", "object_relation": "sha1", "Tag": [ { "name": "69-48-228-110", "colour": "#B3DF0B", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791206019, "uuid": "50241822-6e2b-477e-ab68-61f6fac8eb03", "comment": "Malware payload (ParallaxRAT)", "value": "2a2a8796449e8cfaeb459b490f86d9368e8c6c86c3342fa305627fa4848b59bade17c02f5ce516e4ac3c0d4897fbbac9", "object_relation": "sha3-384", "Tag": [ { "name": "69-48-228-110", "colour": "#B3DF0B", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791206019, "uuid": "9dcac0ec-1296-43b4-9bac-f64a9064d32d", "value": "T1754733C6F61A5BB4D2902044357D3E67A8F2FD377F0C8402A7E7E68791CF9A2A6241D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791206019, "uuid": "90ff1361-cfb4-4062-bf48-18a42e4cb9cb", "value": "786432:8NhkPmeNDUzxbx1baSqvogaLUUS6jdG3q7xXSc:y+DNDUzxeU/AUlRGWxSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791206019, "uuid": "979243e9-0a78-4093-9392-aeb309d69b59", "value": 26958616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791206019, "uuid": "d447224e-3ee9-4109-a33c-941dc6613734", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791206019, "uuid": "a4add0b1-87aa-4f82-ac7d-54750e20c9a5", "value": "a1df599c924b506851cface2c97f0be6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb93a05a-c05e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791164933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164933, "uuid": "1fa14233-a51c-46f1-84ba-50bea6d256a3", "comment": "Malware payload (Mirai)", "value": "79084eeeddabc69c39ca17a670bcbde3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164933, "uuid": "6bcdc303-a4e0-497a-a9cc-4f1f641ea999", "comment": "Malware payload (Mirai)", "value": "ead87b575e540b6f5d5757d1c8bda695fe67be92b17e252106651d750e4744e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164933, "uuid": "08c37fa7-7880-4c1f-9cfa-a19650adfb27", "comment": "Malware payload (Mirai)", "value": "25499c31435718b9acc8c385a88996d4d0182e99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164933, "uuid": "b15cb56a-c00d-4257-9950-94a2bb616e7e", "comment": "Malware payload (Mirai)", "value": "ab0812b45ab17289131adafb035140081bd569d51eba807586462edf772f85823a42e994e1568daf550b764e2e60ddde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164933, "uuid": "52a655d2-bced-4f51-be2a-7d7a23fb5dbc", "value": "T186E3814CEE64AB3DC3E332FEE75902CE336A1B98B7E670219D314A5537C8B95A535120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164933, "uuid": "789af626-dad5-4e77-95a7-e5272d888aa6", "value": "3072:+HvhA6gdpQPNfceNSi2qVqyD7MMGFRuwGf3n4goZcxBZPKXysYk3:RyNGMGFvaIgoZcxBdKb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791164933, "uuid": "42f65834-4482-4d02-9f3f-298f4c066d00", "value": 143760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791164933, "uuid": "ed6fef95-bf74-4235-9a99-e729c4d4411e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164933, "uuid": "68f3ce82-d542-4e4d-9baa-efcd6d2b845c", "value": "winki.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc45934-c063-11f1-927a-4201ac107004", "comment": "Malware payload (PythonStealer)", "timestamp": 1791167027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791167027, "uuid": "5927593f-78c0-4a24-a5be-dfc818a4a996", "comment": "Malware payload (PythonStealer)", "value": "7a5e9b41b7d6b1edb066ecb2f4268c19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791167027, "uuid": "2e7887d2-491a-410f-b0a6-5f520a8efb96", "comment": "Malware payload (PythonStealer)", "value": "ed07f823263ca2ffc386aec71230faea469ce8638b329176a02fe73952c78745", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791167027, "uuid": "760d6666-d13c-4068-b7cb-0a008f516e65", "comment": "Malware payload (PythonStealer)", "value": "205067a7b165ba250b0b8c668e016d4ffed914c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791167027, "uuid": "14c82d36-254f-4400-a16d-330d1e49a255", "comment": "Malware payload (PythonStealer)", "value": "7fb9a2e5928dfb5bd1a9320fe7a5974ef6025d05b8c730e322cb7627ea42912769d72e5ee7d3b6e43b2f87ffd7fac96a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791167027, "uuid": "77e9d8b9-5f37-441f-8ffe-df59de50e2b5", "value": "T1B7F6330D75902086C20AD1B926EECE1264B2B6970B7605DF2BE1FFA01D75BE3152F739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791167027, "uuid": "15bec5b0-c201-40dd-8071-49342c9342c1", "value": "3f7419dcd097c9ef0b7fe5300f39861d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791167027, "uuid": "ab68c8e3-58a9-4aed-8f8f-badf46e26fbb", "value": "393216:qe3Xtky920T5E4j6LodxpP/Z6l3YSpmNKlzJd:qeKy9p555dx9/Z6l3YSamzJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791167027, "uuid": "2983cdd6-76b5-4c3d-9248-8a333c47687c", "value": 16225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791167027, "uuid": "9d2d3170-49c1-4d75-9b42-e71e5090ca20", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791167027, "uuid": "9fdda9a7-65d4-4e43-a76b-39db67e0f90f", "value": "ed07f823263ca2ffc386aec71230faea469ce8638b329176a02fe73952c78745.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b590575-c098-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791189468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189468, "uuid": "e42d20a3-d39b-4a7c-9fa7-fe506bab4cf0", "comment": "Malware payload", "value": "d20db97a2e0397274c266ccf121b1430", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189468, "uuid": "fc9aac60-ac70-4b7b-ae60-e2a357a684b4", "comment": "Malware payload", "value": "edadcc3a890abcb4cf88a88b74754fc0ceb883d7f992529bfe782f5155dcf009", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189468, "uuid": "851ad7ef-7044-4ddf-bb98-8567577b84f1", "comment": "Malware payload", "value": "9b337bbcbfe63756240cadf4dd958ffc1970f2d4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189468, "uuid": "e6e0d1ac-cc3f-48bb-9e71-a9d38ff3523c", "comment": "Malware payload", "value": "5e24ac130891b3b3df6ca56ff5cd952b4a912a106d07fba7f71b15a44b13f262a6b96b9e26b4bf1ec81dfa541ac0faa0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189468, "uuid": "525d0a8b-0c8c-48cd-b77e-ffa743e8793c", "value": "T100E19ECE0B1245F7CD4E67F682026B5FE36CA757A1050BD11EEA8202F883AB8991DC03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189468, "uuid": "5b0b022b-8531-49e4-810f-9ace71fec75f", "value": "96:l5mW+ZvDweg8M8ZLD3tZrEsSBkbXLuy48VWEA5wKzcyr5FaNRwuNy3jB8/Ph/RMZ:mhDDMOrEi1SDwKwhVkjBw5/RIAgGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791189468, "uuid": "7a972dc5-8967-4c5a-806e-01d4dab6b1a9", "value": 7038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791189468, "uuid": "9e25de47-ffbb-47fb-89a7-77e8c1b5da94", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189468, "uuid": "c88e811b-b2eb-43a0-b93e-f89154f5e007", "value": "e67a2ba0a1117dda385972ab09f86ad8eba6c9a1044d318f630889155505dc0e.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f992f9-c0c1-11f1-927a-4201ac107004", "comment": "Malware payload (ConnectWise)", "timestamp": 1791207228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207228, "uuid": "85c842a4-19e0-4b30-bd65-954f2fe4f2c2", "comment": "Malware payload (ConnectWise)", "value": "6c720f16ee6b64d25c1584f6e51d3d62", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207228, "uuid": "67b2623a-d38a-4ecf-a711-08c751e21bbd", "comment": "Malware payload (ConnectWise)", "value": "ede2c35788a9f4a3dacce408c9896a89b99a02cec657bd6801d5e23866d016cf", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207228, "uuid": "bf16b74a-fb04-4f8e-8f90-e499df8c7559", "comment": "Malware payload (ConnectWise)", "value": "7a29f8f07ba76e1846e7d52de42653453628b56c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791207228, "uuid": "e716d8f9-ef94-4117-85b0-c7fac157ff86", "comment": "Malware payload (ConnectWise)", "value": "b5570a46ca76480ca2d23d95aa5d74bc18a9b6776ebee9620f78a087e6960e866f3234874c3851d6a2998b93b4d8fc85", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791207228, "uuid": "90d473fe-2e45-49a2-85c7-8bc203982cbc", "value": "T1F1D6230473F8A119F1B72A3AED3956F1587B7C22CD62D15E1758364D2AB0EC19AB2333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791207228, "uuid": "f74343ac-ce33-400c-b092-bdb1011fcb95", "value": "393216:BmkEdQ03NldtmkEdGmkEdqmkEdlmkEdOmkEdl:7E2cx/EwEUE9EME/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791207228, "uuid": "4eb55d3a-9dbc-4d82-8d38-93a31e2f24d0", "value": 13225984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791207228, "uuid": "5e456aed-cc27-493e-9849-527f8f130cb5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791207228, "uuid": "c8acd6b0-410a-4959-9488-5f0f80b54632", "value": "ede2c35788a9f4a3dacce408c9896a89b99a02cec657bd6801d5e23866d016cf.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886524d2-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218883, "uuid": "06a75d40-f9c6-4463-91e4-5acea8cd6a6e", "comment": "Malware payload (Mirai)", "value": "bfad834f5619d4356ce1188af7c84ae0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218883, "uuid": "78d2a1fd-7518-49e7-99a4-4b5601d5db3c", "comment": "Malware payload (Mirai)", "value": "ee14e27b54a25c9675cb3428eab6b93b436801dede93a40d10d85774b93dd99f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218883, "uuid": "7e7ec585-5aff-4243-be7d-a1c9cfc253c5", "comment": "Malware payload (Mirai)", "value": "ddfc3e6371b5d6235eb360dc03a1f642af6b3131", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218883, "uuid": "b0e0239d-1d77-405e-92b9-b7e0a511cfe1", "comment": "Malware payload (Mirai)", "value": "e0864b0a1b27d77429ba1a1cd9ec71385f02da74874c2b0e6fb310050cd55793f8ce88779d17f5ed651f9db1131968f0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218883, "uuid": "7d33356f-1473-40c2-8d2e-d000c88c8a95", "value": "T17414AEA2C8A06EECC7209570F0F0DE795B63E511905B2EFA65ABC7B44047E9DF2093B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218883, "uuid": "d08bf307-d5e7-4fc6-af4e-64ea660da644", "value": "3072:5csMgpwVkCsQTm8S6QZiqg3e8hjrDxKBgIW0MUwf9s:5jM/+CsQs6Hr3e8dZ3R03wf9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218883, "uuid": "d6accf58-dfbe-4fe6-8f9f-a3785ed1656c", "value": 200512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218883, "uuid": "401059db-a8be-422b-bc44-f02052a45ec7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218883, "uuid": "fd086c0f-3bc8-48ed-a902-944b2b4410df", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268ede4a-c0ec-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791225591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791225591, "uuid": "11cc240e-2f8d-46b1-859f-7d38b64fb497", "comment": "Malware payload", "value": "2ccbef26b5bb28c717ec50a2e495cea1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791225591, "uuid": "3c8fa1a7-e77b-4b31-a4ef-e4455e73a5ce", "comment": "Malware payload", "value": "efd9505addae8bdee5b85e91279dfb2c2b545ef33e8f9605164d393b674dc28a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791225591, "uuid": "2c75da4e-62ff-4ff8-b7ac-be6e129f5dc3", "comment": "Malware payload", "value": "963adadd93f2ee2e8822805f141e214842f9085e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791225591, "uuid": "732631a1-36c8-44dd-8ef2-f136d54b4db5", "comment": "Malware payload", "value": "7bec372e2838dc6f01c294ec5b6cefdfd56afe72188b68e03e22e2e1a81c397b8f88d974380291659ce3c397c43b6f1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791225591, "uuid": "75540b22-b477-40c2-8bb8-6c2a0c55b30c", "value": "T116E4A3A4CAA37481DE53487AEACB234BA37C7C420754E97211456E90BBDC377359EB0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791225591, "uuid": "abdec5cb-0e71-434b-927b-4ac88f6b3229", "value": "694a10f92efdb5ba9c32ad08fff67a41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791225591, "uuid": "5266c69a-86ad-4239-9c82-4bbf99c35c41", "value": "6144:R8a5cImtHCQKT5hM1rzUHArDrQegVsQz1P9hYBVtLxXB01EgnSZAVyuAQ:R8ONmtiPharJrPSbGNipJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791225591, "uuid": "d0b40042-c7e7-4665-a3f3-8bf590588ae2", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791225591, "uuid": "1b7eda74-f647-4e32-ba2f-ecd7ba93f13b", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791225591, "uuid": "5d334523-3ccd-4911-a7d2-38097553aece", "value": "SecuriteInfo.com.Variant.Midie.189383.69739163", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b36d35c-c05f-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791165201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791165201, "uuid": "c3f9de4d-1592-483a-92cd-ac93ecb92b37", "comment": "Malware payload (Mirai)", "value": "7341a87f623d5ae0cbc0e70fa2ddc79e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791165201, "uuid": "aaf4a60f-5ad8-4c7a-96f9-5b4b091114f7", "comment": "Malware payload (Mirai)", "value": "eff3f4ab2ef40f7ab1f1740ad7c22556a403a7c126c93799c419997be74b6575", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791165201, "uuid": "1187a8ae-e9a7-45e9-b809-bd2a7bfd6ecb", "comment": "Malware payload (Mirai)", "value": "b89f842623b0cfeff8115010f9f1a77d281b33e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791165201, "uuid": "bfab9b15-9e48-4c1d-b09a-7faee24e8745", "comment": "Malware payload (Mirai)", "value": "03354592628c2a2aab186a40929d10f457fc3ffd721b95e42f8ba6eab5e33887ee4ba4c5f081888697b49c826723993c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791165201, "uuid": "d86848b9-5fc9-4a8d-a13a-71c040e21ac5", "value": "T141A3830F2E654F7DFB6E873847B79E329246239616D1C140D15CF9022F6424EB81FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791165201, "uuid": "d762094c-484b-412d-87b0-6920c5d4e601", "value": "1536:FTHGGGWJhYVXn9AoR6U+krWE6UiHD/+DWAJFc5RN7Pk1DM91S6BBx7V3cmp:FHJhQ9IE6UiHmO1S6BBx71cmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791165201, "uuid": "a77f2d45-8745-4884-a07a-6ccf22c897c9", "value": 97932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791165201, "uuid": "9b4416e2-2800-4041-9942-1738d2cf3fcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791165201, "uuid": "3db0814a-1bce-44cc-82b8-ccbbb650932a", "value": "winki.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dcd192c-c117-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791244260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791244260, "uuid": "00abf16a-987f-4f89-ba13-88d72e0da4c3", "comment": "Malware payload (Mirai)", "value": "60df6b57cbfaf0b8e471fd94726d3612", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791244260, "uuid": "eb0a09f3-7353-498b-bd04-3387abcf57d3", "comment": "Malware payload (Mirai)", "value": "f036b2546aeb4dde5308b887d4711c19accc635c2d3ff5e4229f9ce44d192bbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791244260, "uuid": "f31eeee3-d7f4-4513-a4a4-daaba27e1b64", "comment": "Malware payload (Mirai)", "value": "eb4e81272e22f682f2fa726ed238ce7cdfed42c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791244260, "uuid": "7d22d708-e341-4862-bbf9-748b106accfe", "comment": "Malware payload (Mirai)", "value": "46a5e5bc42d3b47ad52237cd59255cece7d273c5b154ccf1df85525f24215aedfe6a0dcf3b2402c5f6ac60fa186a18ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791244260, "uuid": "88c08f22-21af-4c96-87f1-fd8f07e9ed74", "value": "T1CCD48E87BA61DDFAF897D336441306296020F2E351A29B2FE15FBC94DF2D1902539BC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791244260, "uuid": "8afb480c-07e0-4b4b-98c0-b531ef958c90", "value": "6144:IQdEcJTuPG/Zkw0vyKvVnwMA8u8WyzAlTfhrtroIyMUz6Gmt6WdVkAjLCImYsLKv:DucV400Zv9wMAr8SVO0DdcImYs2d+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791244260, "uuid": "fe1c514d-9f23-4586-9f99-dd8a58903b66", "value": 611540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791244260, "uuid": "3c3627f8-15af-46d7-9546-4601507ae76a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791244260, "uuid": "22360d77-e83f-4de1-a013-15d405c884cc", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045ffa00-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181725, "uuid": "3f93174a-056b-4cb8-89e7-b2057370e328", "comment": "Malware payload (Mirai)", "value": "4cb555c673484fceb75ccfe6dc5b4683", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181725, "uuid": "9ec6beaf-2946-4570-90c0-d3806061203f", "comment": "Malware payload (Mirai)", "value": "f06550221cc323701c19fdd00687a5675ddc4221bc146e6de5840cf1b7144ffe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181725, "uuid": "18abefef-e6bc-4c0c-80f3-8014976ea640", "comment": "Malware payload (Mirai)", "value": "0daae01c530b2289aff38544bcfbc94c525859a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181725, "uuid": "6e1aa71f-2c39-4f52-a5c7-5c641152855b", "comment": "Malware payload (Mirai)", "value": "afe1222d291807923d3b73134f5f5fd18fe88b64affa1bf84ee86019276d6bfb9751b74c44c91f145ac1397d2c7f2a43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181725, "uuid": "823a2509-07bb-41d8-96da-43dc77472a6c", "value": "T102233AC0A683F9F1EC11457C307BA7726E77F43AA03AEDDBD7D99423A841602960729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181725, "uuid": "8dda4b5f-2c79-470a-96a6-3fbaf1310516", "value": "1536:Ovmt6GStZRjrMcPzOubNryooPDdgYfQ5I00mv4a+:O5GS1HMcPCuhdoPhg7iqvj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181725, "uuid": "56a8fb6b-115a-43a5-8a03-51cf162c0ce9", "value": 49852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181725, "uuid": "48948179-290b-4547-9049-14b4a954df89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181725, "uuid": "6af126e2-d638-4e62-b1a0-5f5ae6c333df", "value": "87sbhas6as.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c4e711-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181961, "uuid": "e384a292-3f69-4af5-a47b-c50841289313", "comment": "Malware payload (Mirai)", "value": "587a22a3fec8145518db47c2f0fd8983", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181961, "uuid": "be8dc1bc-2181-4070-9a85-b7ee28833ef2", "comment": "Malware payload (Mirai)", "value": "f0ff6ec2c23b643c0324cb199f39691eee470fdcadf7b64835e3795a2eb39c58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181961, "uuid": "9d41c146-dcd7-4a9c-b815-6f7d88ae5026", "comment": "Malware payload (Mirai)", "value": "82c4cbba9eff6bd4f6944f8879672b195f136396", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181961, "uuid": "d21b3f88-bdef-4c77-ac15-d78a1be7f9a3", "comment": "Malware payload (Mirai)", "value": "25f40392afd72e897ac89aa128b34b0c48bae9a9d6945e8c84ac58a7e00b2c0400daa4881c3bc554d79fa4020f5a88d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181961, "uuid": "c92e827c-f744-4abc-a278-2f6219bf12fe", "value": "T1CA530179E6485EDBF34D713D8F26D5C677E303661CB0CAA0AB986780B90B93AE40D560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181961, "uuid": "0e374f1e-9d91-410f-ae0d-ead2d809633e", "value": "1536:c3Z+WRG19+RKPkcos6SIl4hN0i5PghjJ4u+qgw09D:c8+a6Ll00z4u+qgwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181961, "uuid": "42280f75-0bc4-46d4-b456-644e2344297f", "value": 62556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181961, "uuid": "9108e753-61a4-4b66-9820-b6459d4fea05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181961, "uuid": "b9032659-8313-455c-a290-f6ce3b6412cd", "value": "wife.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d07a9a-c0ca-11f1-927a-4201ac107004", "comment": "Malware payload (PhantomStealer)", "timestamp": 1791211140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791211140, "uuid": "5bac0e1b-6fa8-44c6-b1d5-a8110261fa1c", "comment": "Malware payload (PhantomStealer)", "value": "61d9d64fe0ceaf33116f130f35879ceb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791211140, "uuid": "103612b2-1eac-43eb-8f35-c59644b68848", "comment": "Malware payload (PhantomStealer)", "value": "f103df0af6684dd4e14e698172bc510552053197b2aa2daa075679682ddaaf6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791211140, "uuid": "3813a6cb-d383-4d44-8791-a323759c3384", "comment": "Malware payload (PhantomStealer)", "value": "ec74018a2cf7375efb9b29e6a44fa51bd0c94053", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791211140, "uuid": "e64ac1d4-c164-404c-b2f6-a5860fab05a0", "comment": "Malware payload (PhantomStealer)", "value": "7a00b72275e3684e08d76acd2c2fdd27f90f3ebf10b6b951a6f2a73ccb050eb7a94e53b3dd4581187fd859b36801fa06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791211140, "uuid": "e92617dd-2688-44bb-a004-261c79ddfcc1", "value": "T1A8451214266AD917C49207B408B1E3B45768AE98BD34C3139FFEFDEBB83621538543A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791211140, "uuid": "1b0391b9-26ae-4a08-95f1-464dc3212743", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791211140, "uuid": "3542701c-b79b-4f0a-9179-23280c6facc9", "value": "24576:M+bvFWUuB7XJ4SCkdB0QdA6K7at5y2438ZxkT7Jukf:M+btab3TrKWsuITtFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791211140, "uuid": "2a9cb35e-529a-432c-8605-cc98c7ee8572", "value": 1275904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791211140, "uuid": "11f477e1-db1f-45e8-b553-f44a783dda27", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791211140, "uuid": "387ef1e6-f2af-4b41-8891-86dcd15807f0", "value": "payment details.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3adfe420-c0ef-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791226914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791226914, "uuid": "1918fa60-c86a-4281-a616-f69bd37fd893", "comment": "Malware payload", "value": "f88e5558908cbda54dd2e38673fb6512", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791226914, "uuid": "90d009eb-b26c-4c10-ac3c-1c4299bd8a85", "comment": "Malware payload", "value": "f120fb5991d2d8f92de9936f5c8f9a1d31eb4c3e74c22da06ee5005572abdaf3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791226914, "uuid": "90cc7c5e-2e83-4223-bd65-0ac407439ca3", "comment": "Malware payload", "value": "a893c6fa50a13b3bbdd99a5261ea9429cb83bc13", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791226914, "uuid": "07ec3cb6-ca70-42a2-82e6-5452eb1f0146", "comment": "Malware payload", "value": "86a99f3b0db980319cea3102ebc6c5eaf162adfc33228baeb037462cdd79f9d276e79c7b66e96703510e33dbfe8125f4", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791226914, "uuid": "f4d1fb37-6132-4320-a1a1-f2214bb65907", "value": "T19B5533C956A9AB47F82C92346BB02C6B9D5040B357E7FCC116E713885D8ACD39A874CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791226914, "uuid": "22819d96-de3c-4a96-b426-6a1b7bb72822", "value": "24576:Wkf2jkrv5c9XP5ze7EB16Q3bGfOeu52inhs+1SmXbXegQnlnfVIDU23kNnpk1A2p:Wkpa9/567gT3uY52inhs+1SmLXqlnfV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791226914, "uuid": "df3ea92a-9102-456b-bfa6-7964efe1ae15", "value": 1312006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791226914, "uuid": "5983150d-4aba-4977-b09a-846b8e6ff956", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791226914, "uuid": "98747439-93b3-4a5f-b734-33b3ceb7fc63", "value": "TeamModBeta (1) (1).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e39f380-c0cd-11f1-927a-4201ac107004", "comment": "Malware payload (SilentNet)", "timestamp": 1791212343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791212343, "uuid": "7344deeb-034b-414a-bfdc-caabaa7c0376", "comment": "Malware payload (SilentNet)", "value": "4b266c6c517897e8c0f1429db503c6a5", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791212343, "uuid": "5b7dddac-e789-4ef0-91e9-c239492401b0", "comment": "Malware payload (SilentNet)", "value": "f12d7d3ef07d9b16cfbaf4036756d68133441f073ed33ea6400d3f5ce0923444", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791212343, "uuid": "6d6ecb24-cfef-4c15-84ed-5cb11cbc656f", "comment": "Malware payload (SilentNet)", "value": "18bd7c3028f7f137108266807c1a353a76460ebd", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791212343, "uuid": "35fe8067-bd4c-45bd-a514-84e2c2cdc5ab", "comment": "Malware payload (SilentNet)", "value": "b910878fd4076bec58f3c3f90378a9c3dc374f8a12587c748eede0bb88024e1a0d46844f0f017aa7b849bc437859d49f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791212343, "uuid": "8158cbbf-4958-48d8-953d-4ff639dec0e7", "value": "T1AC563362AFFCC9BDD8D7157611F0C466A4D848CC9106A02B02BB6DE9382FDED4B09E5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791212343, "uuid": "1429f12b-2c54-4662-b242-1de5aee4e428", "value": "98304:W71No1XSY1bkeU7+Ek/o9OnMvTLiYJUamwqSYsJyY8Ci+nD53vxohwGpzu+PGnWF:W7c1iWweU/GVATLcahnwYy4vxohwybtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791212343, "uuid": "5385e497-1d65-4ab7-b899-65c3413a0acf", "value": 6083242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791212343, "uuid": "c52629d1-4faa-4a17-98f1-7807b44e0968", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791212343, "uuid": "8c5f290d-51ee-4f6e-8889-b8e9dd76a625", "value": "frostclient-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "215ecc0d-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218711, "uuid": "8ec5aa55-86a4-4fa0-aded-421e08c08f37", "comment": "Malware payload (Mirai)", "value": "5800ca2354334f6497bf9728db3c28d2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218711, "uuid": "ae0b62d2-e665-4e68-9d9e-8148170591c0", "comment": "Malware payload (Mirai)", "value": "f207ea2dbfe50c3788880be140e1f04dccd7b9850c529a8c75dedf1c1abca61a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218711, "uuid": "1cc27b5e-64d2-4d95-a6fd-e0413cea0ecf", "comment": "Malware payload (Mirai)", "value": "eca95e59ca0dc96c503dcb5c5bb8e18ee2966d9f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218711, "uuid": "0d4a3f90-1229-4bf5-90cd-7968bcf6d6b2", "comment": "Malware payload (Mirai)", "value": "dc9a0db82ea7281440979c4ce754c817361e82368624a3d23545983cb25aaffdec4201831195d888ac0bd48bb9892131", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218711, "uuid": "f1dde9f5-f19e-432a-90fd-939da9c09a1f", "value": "T115B30886BB43DEB3E49320F102BB5B364B32FD3A4867DA81D3797CA499510D0A61677C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218711, "uuid": "28bd58ba-7a27-46bc-9c75-a5dd671b7680", "value": "1536:/9h32JjFiMTgjpmDGFGl9Y4Kf+Z2EFyis+JUqhTJK+A:/9hGGMTcwGFEKGpIPAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218711, "uuid": "4a06a090-148b-49bd-8352-3ea1a0a56557", "value": 108176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218711, "uuid": "d74b4e97-1d40-416f-861d-7e03e8dcda55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218711, "uuid": "d5102980-9509-44ba-8c4e-3f00583bc62a", "value": "eclipse.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17605f83-c053-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791159853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159853, "uuid": "bde86109-6dad-4752-8b21-b8c6f1298908", "comment": "Malware payload (Mirai)", "value": "9c5656c37ca809b06cc85c7369b447c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159853, "uuid": "45ee316e-e474-4a0c-8b45-a335843d8ac8", "comment": "Malware payload (Mirai)", "value": "f380544dc352ff8d00a9fa20722c12345241fd7c148b66cb8c0bb80f6917ccff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159853, "uuid": "f157526c-9363-418d-8d7c-7a7b4b724908", "comment": "Malware payload (Mirai)", "value": "f72efbe6c4acf89cad480ecad24a963cf50032b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791159853, "uuid": "ea07fb68-73fb-4173-86a5-a8eed693f6e2", "comment": "Malware payload (Mirai)", "value": "eacde45fac7f7c46ba989e06b2a18d3dc83c455dc7cce0183940291bbfbfb47b353b0a67a2822fb2dbdd435e89f5558c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791159853, "uuid": "ee682638-a11a-4bc0-9514-5e4e21034781", "value": "T148A45C82FC929B12C6D02AB6FABE95CC331317F4D2EF70169D245F24678A45A0F77A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791159853, "uuid": "b28640db-b70e-4fd2-8b9b-5e7798ad8219", "value": "12288:IjyDUQ4wP3bVCQjjg9mWSfNpYSW3drZ2vvVVatgxqPg99O5T7BgHyim7fI4:KE4wPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791159853, "uuid": "43fa980f-bd1a-444a-abff-09ae2db2e8a5", "value": 467132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791159853, "uuid": "3a29e522-9985-44a9-bdaf-da4b6bd5b39f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791159853, "uuid": "281f5f34-4e1d-4a98-bbad-b70e0802af60", "value": "f380544dc352ff8d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c2b45f-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218966, "uuid": "fdf2cf51-92db-4c86-aea0-94bcc72891e7", "comment": "Malware payload (Mirai)", "value": "96d75fbb00d39744e1bdb2344e9cf120", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218966, "uuid": "95d57fca-684c-462d-a4eb-1db02941560b", "comment": "Malware payload (Mirai)", "value": "f50e4abbc1de2aa73ac566f2e1cb96cceba73cbfb4320c4d6213ec4cb9927d57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218966, "uuid": "9f8df9a3-7f32-4b2b-b6ef-1ae306a9d4fc", "comment": "Malware payload (Mirai)", "value": "038e64dec209dc2bded75904d90f8de31a77521d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218966, "uuid": "bbd8e71b-afae-45e3-ac44-f26c284bc565", "comment": "Malware payload (Mirai)", "value": "51c02839519989cf95860ae2708d75d4033fd12f9d1a6ba07f68a37b6c7eba253b4b522a87aaf51188afe0ca41f589ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218966, "uuid": "8b76c926-0294-439c-a23f-6d1339348bb7", "value": "T122046C89F7C3C1F1E8530DB000A6AB37CB729A3D513AD706DBE89722EC66741D52962C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218966, "uuid": "6a855b36-fc28-4866-9285-289513939929", "value": "3072:kPSpTGkfMnyKkoGKDm/7/0SkZNHhMzFbGLbe67cxKHMPJRlZZ8Z1:7FHoGAmT/07XHhWae6UlCZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218966, "uuid": "c9ac1ea9-c0e4-4868-83a0-93a765ef4a11", "value": 182504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218966, "uuid": "16217b3d-f03b-4cbc-9556-31b2f42f55a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218966, "uuid": "a60e9701-9fcd-44d8-98d8-000da19ecf1c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5858982-c08a-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791183821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791183821, "uuid": "a427ae1b-f768-46a4-a959-a733e922b137", "comment": "Malware payload (Mirai)", "value": "a470fdba2b2a67f1da3cb99941d64f0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791183821, "uuid": "781d983e-02f9-48d4-8764-3d574b13478c", "comment": "Malware payload (Mirai)", "value": "f526f260911c311b3a7f79d527ef81330dfc3b02221b81922d18d47b5dade98a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791183821, "uuid": "c9559185-3ef1-4906-9509-128f55acb1c8", "comment": "Malware payload (Mirai)", "value": "5348dddcb5b927bc689d728e8a8004ed7703c5d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791183821, "uuid": "68db16fe-b2ef-45f2-84f1-6eeb79cc0779", "comment": "Malware payload (Mirai)", "value": "400811770a67766799386cf7ce4aa3bd3ce9d3d0dcff551aa0aba8aec0fabaaad524950419d9be03807defd9d870da54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791183821, "uuid": "0ce9d331-503c-4d73-bd58-8eb152b1eac6", "value": "T128342905FC148B6BC6D237BBFB9E428D37375B5897DB33019A246EB02BC6B9D1929101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791183821, "uuid": "6735c987-842d-4428-afbc-29f57ee2f02f", "value": "6144:iC/7q/Vnq/4FD4f7pe8r4WSzn1+4ywrScxKpY0vgdZHYlZSjHNH2UsMIO:GBGr4WYIESc90vgdZHYlsjHNH2UsMIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791183821, "uuid": "f34050a8-90ab-4453-862c-b25d213f0355", "value": 244690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791183821, "uuid": "6be75411-a04c-462c-867c-bd457faa108c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791183821, "uuid": "95e8efe9-b7b0-40e0-9b59-ba1b93bb809f", "value": "adissarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "748b701c-c054-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791160439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791160439, "uuid": "b8a0baae-bbde-4d6d-8490-786cf9b2baf4", "comment": "Malware payload (Mirai)", "value": "e422539150d1b9dfc35c075ca622588f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791160439, "uuid": "ad5d2b24-105f-4782-aa09-a26eabfc0bf8", "comment": "Malware payload (Mirai)", "value": "f5a7d9d169aff0adc6b109a35c5ad7f0f2fce8ce1d4425daaa405507181048ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791160439, "uuid": "ab0f07eb-31f7-4efd-b213-351f83db81d3", "comment": "Malware payload (Mirai)", "value": "b0585bf1a299c607933f2baa6d984b4cd0d90177", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791160439, "uuid": "1d443625-1c31-45b1-869a-7e7e4a070746", "comment": "Malware payload (Mirai)", "value": "82210cdfa3ee98a328f927aebe7b24cddbe6d62203b0dc6ddbc3c85127b4599051550f311d68ff7c29d7879897b20522", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791160439, "uuid": "6cec8e71-3e33-4191-8964-e68c96c72631", "value": "T1F0543A03AE855ADBF41FCDB0897DC3C22EE1A0DB61E5A93A657C89DC7F5B10A05934C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791160439, "uuid": "b3bf7c4e-fce7-483a-84e1-69d372c76275", "value": "6144:ZFDACUHS7/NGng21/hjFvZbiokno7x31Bz3u9Qz2813Oqq9:ZFxUHK4VjFH7p5z28RO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791160439, "uuid": "965a47df-b81a-4968-a4d7-21878263acf0", "value": 282688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791160439, "uuid": "fe9aabaf-dda3-4fab-9aaf-43edfef48179", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791160439, "uuid": "c894cbc4-50c3-43fe-9f3d-0f7428f973ce", "value": "kushnet.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3da4a6-c06a-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791170031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170031, "uuid": "033fa8d0-eb09-472f-86d1-436affde0865", "comment": "Malware payload", "value": "f88c7b63d6beff89c4fe04a0f45a2a11", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170031, "uuid": "bde83da5-67b4-4c45-9ead-de8f7290a002", "comment": "Malware payload", "value": "f5c8298c37963b6db62a60c2ff7cbd51d24fe2560c8d0db1386c53e8fe92db93", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170031, "uuid": "9126071e-3516-48f1-b31c-ffecae76586a", "comment": "Malware payload", "value": "dc805d894bbd31ceda0b1e61bb97450eaf5d1a46", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170031, "uuid": "3f0366cd-ef5f-4714-8110-bd63ba90e370", "comment": "Malware payload", "value": "228fa75ed014da5036957152eefcbd89c7ca43b518af6de89158ae83c130135348ed4a57d55decb71a169595c3d4a77b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170031, "uuid": "474c3050-53ff-42b7-a3fb-755bf4560ce8", "value": "T103072352FBE89E1ECC7381351F4A5235111AAE23C792D34BD968339C38B76E40E467E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170031, "uuid": "aecfcdb2-fb61-4769-90f7-fe3ee02c2b43", "value": "393216:Ov+P5ymhhVaoMMom3QFnebb1jD2ND19E2GlZYn:urmhjR6m3QFne1jH2GlGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791170031, "uuid": "523aac96-495b-4012-8d9b-ce82f9aad254", "value": 17339100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791170031, "uuid": "ae786a07-1dd8-48b4-b03d-88c7688abf83", "value": "application/vnd.android.package-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170031, "uuid": "b23d28c0-3eb1-453f-8f9c-d2015bc6f133", "value": "f5c8298c37963b6db62a60c2ff7cbd51d24fe2560c8d0db1386c53e8fe92db93.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a050ad3c-c0e3-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791221930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221930, "uuid": "2e277ad0-4e1a-4780-8f5b-fe8b2ea812cf", "comment": "Malware payload (Mirai)", "value": "a1767a2288c53fcb27be05c8d16dabea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221930, "uuid": "b5150164-ccd6-43b7-937c-c4000d9afdf2", "comment": "Malware payload (Mirai)", "value": "f5ef28c40529370de4b1846a110340afbb02c625cfb03a40de37f2bbba50fbef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221930, "uuid": "fd87ee8d-7e67-4f69-b11c-5362f686ddcf", "comment": "Malware payload (Mirai)", "value": "79e4286870c92febbc72e9801f083429597bb05e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791221930, "uuid": "127c3965-1f2c-480c-be13-e0f24e738e4d", "comment": "Malware payload (Mirai)", "value": "e97aed6492a4647e53a2c24968299329030301d2a56afc995f1d05712367018576460b0c35fdc6c76e489f1d273e5a78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221930, "uuid": "2d00dc1c-5929-4662-aea9-81680cd7a9da", "value": "T1B9D47D0379F094BEC8D6C0744B9B933A9D62F08A2239B58FBBC66E817E19E50771D741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221930, "uuid": "8d33c338-02c0-49e2-8417-1e68254547af", "value": "12288:RQ9kwa5NH7khiqDsF3qZ2WcJ8tct1ywvE:Pk0T6ZBQKGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791221930, "uuid": "7668b486-6902-4191-9073-0eb743ea66f6", "value": 625192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791221930, "uuid": "6be08996-2fa7-47b1-8cd5-802ebb94d47f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791221930, "uuid": "a620a6bf-b721-4186-b6f4-d81700a108cb", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6c15b4-c05c-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791163972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791163972, "uuid": "cee99103-bdd3-484f-9031-6a6c34968ec0", "comment": "Malware payload (AgentTesla)", "value": "70afea5aa4689e70efb1428008a0a3ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791163972, "uuid": "38e4d1fe-2afa-43d2-8711-5ef1cdaad3bc", "comment": "Malware payload (AgentTesla)", "value": "f61318a710fa4fbd24b163df3a089bfcef25b04da61880e132064ec5c5d7ed5e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791163972, "uuid": "bab13fd2-055a-4a97-b0e4-ccf0ae3f0005", "comment": "Malware payload (AgentTesla)", "value": "cb6d417b8b06b426b2e258336c5f3f2c0fd019cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791163972, "uuid": "5f9043f6-779d-4884-b2ec-fa622b6297a1", "comment": "Malware payload (AgentTesla)", "value": "d75fcf55be48ffc12760c8850b9c3c4dccc7c6065879ec24ecb7e905a182f61688cb0fadcd364a85c21a8d70045643ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791163972, "uuid": "a4e927c1-4fd4-4e93-b53c-f50d4de6d0e6", "value": "T18CE4F16CD55B29A555AEC3082F4F8B5313E08B9F220ED1B8C059D7A1223B065F9F2DF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791163972, "uuid": "4c7555e6-ed69-475f-9031-b2cc5fb21829", "value": "12288:aIxRUjousre7LFk5dlkKR4VewADh5OlEeB9I3JdjpsQ8XGZSTUD72vx0BpGRf43E:a8PSiyenhclEeB9I3JdjpslUDSx0BER5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791163972, "uuid": "73e258cf-3229-4145-a5c5-7a786f3716a4", "value": 702423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791163972, "uuid": "de2c4ff6-c3f4-4d0a-b9d8-1a10e960b8b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791163972, "uuid": "80291c5b-ce5e-4b86-b23e-7df2445effdc", "value": "revised Invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4598d58-c05e-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791164921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164921, "uuid": "d352ba8c-4782-4ab6-8d11-1e19916cc3bb", "comment": "Malware payload (Mirai)", "value": "22c2e3a121978b753ffe87934127f92e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164921, "uuid": "e3103cd0-1cad-43fe-b327-55818ccf270c", "comment": "Malware payload (Mirai)", "value": "f6bf1b51a3526dfe3178b81b6670491e745dc499987a100ac942de895ed84a21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164921, "uuid": "1e7f0933-fd31-4aff-b166-421979472be4", "comment": "Malware payload (Mirai)", "value": "4f55397f6308353a329100b56833d6e0da35196b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791164921, "uuid": "28d06062-b448-4947-8fd7-ebd813472f76", "comment": "Malware payload (Mirai)", "value": "0ad471bc6c866a5f446e139f0d3b649ab20a0f792f29ee391719f90beea515e64f59280eac7746c621a6ae51b5b2aa2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164921, "uuid": "2996ce99-a6b2-4763-a159-883194dac722", "value": "T1DE539E6AED3F3DC4E54905B8B824CF7C5723A909DAD759E188664272D007EDCBC983B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164921, "uuid": "aa2b3ba2-b39d-4dcb-9ca2-ac12f631c100", "value": "1536:QDp0xKDrf/rShdmbpNnlmD/1hL1hoekCN:Q1Drf/Tbp27Vhoek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791164921, "uuid": "8736668d-55e2-47c1-9136-581593c6b365", "value": 62588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791164921, "uuid": "0855fc81-1f80-493a-8a81-aeda9597423f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791164921, "uuid": "ee415ba7-cb5c-46f9-8e5f-c46721fc1ead", "value": "winki.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e40d6200-c08a-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791183818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791183818, "uuid": "df76b59d-74c3-4485-9725-80b02f820d20", "comment": "Malware payload (Mirai)", "value": "61c6362a2c61bb6bc74d676f523bff75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791183818, "uuid": "3b3ae9ea-1bc4-4741-acea-dba5dfe32f54", "comment": "Malware payload (Mirai)", "value": "f6c65d2e236cd6212312c8def6ebe1c75461b03d73d4d9088fee3c5531eefd19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791183818, "uuid": "4192dbf1-40df-447f-a6d9-c9a4b9b28e41", "comment": "Malware payload (Mirai)", "value": "0119051106fb63fadee3aafab073d4c4608c5b34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791183818, "uuid": "7b85b710-168c-4d17-95fd-fa30d0e92b5b", "comment": "Malware payload (Mirai)", "value": "c20fd258a248ef272e27c00e113cd0bac731e7bcc8377e5aa19840bcdb0ee7d73f59393f45cc6de1d50ed05798132c01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791183818, "uuid": "97f572a8-4260-4cfa-aac2-1ecacf88017d", "value": "T163D37CD1B683D0F6DE9345B53077E7369B32E53D051BEA82D3B4ED32A8914209A173AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791183818, "uuid": "8b747318-7fd0-4d09-9474-18f05265864a", "value": "3072:zQXEkuGPPYH2C2KyKV5Cgj4JTuqiePBAIwIK/qh:zQUkuGPPYz9yA5CgUceP/lh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791183818, "uuid": "b9657e86-d0f1-4955-91f0-06848aeca9e2", "value": 133676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791183818, "uuid": "df3810f0-9973-4a56-a991-bd44a30a00fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791183818, "uuid": "5aa6f746-6f35-4b92-a42b-6af1f50105d8", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afadc96a-c0ca-11f1-927a-4201ac107004", "comment": "Malware payload (SilentNet)", "timestamp": 1791211218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791211218, "uuid": "93e403ad-afbc-448b-9500-f2a4dd29a8d4", "comment": "Malware payload (SilentNet)", "value": "c9bd37a52f7c3c0e58333845df338fa7", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791211218, "uuid": "21efddf0-7a75-4995-a9cf-48c1b2ede304", "comment": "Malware payload (SilentNet)", "value": "f7798c606e4aa5cd54e3fe5cfc8d70a5c91ed64e9c37156c53a6e24bc0269c9f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791211218, "uuid": "52f5e6d3-c859-4543-a5e2-d68b913ff72a", "comment": "Malware payload (SilentNet)", "value": "bdc853d9b2c895efae2394eebb041d81a2abf4fd", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791211218, "uuid": "9b80a774-41a8-4935-b898-a0e92b58125a", "comment": "Malware payload (SilentNet)", "value": "e2fb78ee41ed792240828b27fbc265cd85502b4f62ddefb64be3e847eda878991762f066ceb61086d7299f1e0d49e50d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791211218, "uuid": "f35059c2-8d31-4456-98f5-a618d7516263", "value": "T13A17335154B83B35DB373230881C4E92B66C0284C2DEB59DBAF88FE5B4934D3CF5696A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791211218, "uuid": "67b6ccc1-1e24-4cef-bc82-d77a8c4b8699", "value": "393216:LrC+rCxu0keY1eWdB3IHr9ODWMMsap9NEFZuLi5VK2XbgCP0SS:LrrxJeY1eG3ILsq1po2W5UOfMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791211218, "uuid": "e474263e-4541-4ffc-8f9e-6be61e9cab52", "value": 19875747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791211218, "uuid": "4bcb7eb9-ac59-475a-b70d-b601c83ca0cd", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791211218, "uuid": "f46d8b3e-b24a-46ee-91bc-0c1a8d6357c6", "value": "1791124176602-3baa8b5c-420e-4720-b7e2-a493fa7f8963.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b44cc5-c09b-11f1-927a-4201ac107004", "comment": "Malware payload (MassLogger)", "timestamp": 1791190933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190933, "uuid": "b23e5100-c1e4-47f8-8ffc-654b4cb2a62b", "comment": "Malware payload (MassLogger)", "value": "0ea49231dcd1d392b1b13dea058f08a3", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190933, "uuid": "78c4d97b-dfc7-4461-86ae-26df9ecf4a54", "comment": "Malware payload (MassLogger)", "value": "f796203f3f35c2c4f2b0152b93712c4baa9f7c52ffd4a71d4b5f2a41523f74e0", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190933, "uuid": "b3468c68-82ad-4850-8ebe-e32b3e79ac9e", "comment": "Malware payload (MassLogger)", "value": "f7e0561786869ea019a20e3cc3dc5043841ab717", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190933, "uuid": "21302bf2-cff3-4bfd-b6b8-e801e9452852", "comment": "Malware payload (MassLogger)", "value": "024832bde4c89284a5e4908afae7f3ae0d3ab75bf6ca8f261f2a1ec9d075b37f4c215e7329d937d6ed5e66152ee7a94a", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190933, "uuid": "e96b7240-ee3e-4845-a769-7effca92154f", "value": "T1AC7101027707E1758CB18B66C99FA809D5E02D97AC0F08057DCD89D66F3539AB5F90A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190933, "uuid": "5b6ac601-81e4-4ccd-bd2f-038d6c4dd5a0", "value": "48:Zow667EovJyF7LeZaYh7yiRSEtlaxIZ3ajLVAU01Wol0/CsGdJCUT/eB/BhgcY7S:aw+oRyinf9JZqjLVVol0/H6JhT/2/r1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190933, "uuid": "1f1c6fa7-59b2-4743-9412-0e5b5864b176", "value": 3559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190933, "uuid": "46e676b2-112e-4f91-9b68-b0250ec09263", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190933, "uuid": "e23dc532-4349-4f1a-b884-0350840e7707", "value": "PO 1037.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a67468-c06c-11f1-927a-4201ac107004", "comment": "Malware payload (Gafgyt)", "timestamp": 1791170728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170728, "uuid": "9cb9c2c8-6053-4eec-839a-3c93bd6a38bb", "comment": "Malware payload (Gafgyt)", "value": "146ca25c64421c93d0896ca815670f52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170728, "uuid": "0e7cb388-3d58-421b-af71-6f080bbead6d", "comment": "Malware payload (Gafgyt)", "value": "f7a1fa3463a548743ef3748dad33f678356bd659405e4f412d85cdabb9929e45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170728, "uuid": "ed9828b9-622b-4f90-8579-dafe1fd461ce", "comment": "Malware payload (Gafgyt)", "value": "f54a676ddc95fb0912a816fb44d63400ccd2e351", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791170728, "uuid": "97a6d94f-bd51-4a40-9fc8-7e55373bfb82", "comment": "Malware payload (Gafgyt)", "value": "04229c5c77b8438dd612c839d177fe3aaf6b4e9a490f244d30e432343a2c8822e74064d32bf0a26393dff267a96b48bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170728, "uuid": "7916e162-e07d-4dd0-8583-beeb423606b5", "value": "T1B0544B05EA408F5BC1D1177ABB9F425D33339F6893DB73029A24AB742BC6BAD1E39111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170728, "uuid": "6ef1e233-e163-46d0-82f1-6d1a439333ac", "value": "6144:jeFNHB+yOWXuVc8adFn3PjV5zcGOmumTcCXYk+2myz5c7yZGVLmxUNt:R0Xx8adJLV5zcrme32myz5c7yIVLmxUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791170728, "uuid": "78447ade-0ce6-4913-836c-4ddac1bf5c5d", "value": 297608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791170728, "uuid": "2d476f55-a170-4fec-8858-5e8863bacfd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791170728, "uuid": "85181597-c9f0-4510-9730-61233102dd56", "value": "f7a1fa3463a54874.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d263959-c0ef-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791226918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791226918, "uuid": "9fd44eb0-6d1a-4bdd-aed1-b32e91e41b09", "comment": "Malware payload", "value": "afbd3474faa2e6b39737f0edacb943cb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791226918, "uuid": "49862865-ff1c-4803-aae2-55face4dd5c6", "comment": "Malware payload", "value": "f7d01f83d708dd5449ae460583dad018b4bc927ae74cbafc9c697725e804a27f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791226918, "uuid": "ad96b3aa-fcdd-4691-b601-b028f6e77d91", "comment": "Malware payload", "value": "daaba46b58760b0b40aa31fb15081c211b6ece49", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791226918, "uuid": "9bb6bc26-8c8c-4fb2-8d1e-3547c766b90d", "comment": "Malware payload", "value": "c86fa6833885ce429ff1b12eff2954613a66c1f2dafab5c5cfbb3c83227f35909d6617d1b4556acfee5d166f5128ad09", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791226918, "uuid": "547d0c19-f79b-4824-a03b-089c2c2b0a9e", "value": "T168B5235AA15C84B5CC6F7273B3218EB2E98F058C8509F07702BD05CE0497DE947EEAB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791226918, "uuid": "e8a74808-dff1-46c1-b58c-8ffc17f5134a", "value": "49152:wyXAk8j60r+pjcup2YYNy+582DLtposeXek9SrF:wYAk8PKdKLoLeV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791226918, "uuid": "07fc07c4-9f47-4242-a595-1a476a16403b", "value": 2342632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791226918, "uuid": "55bf8e25-f54f-455f-8d2f-aa4527d6c90a", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791226918, "uuid": "0405b67f-1b61-414b-92ad-9dd335acfd39", "value": "WaterClientV6.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e528e2-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181753, "uuid": "54060f5e-ad0c-4830-8f7c-329c9282d2fb", "comment": "Malware payload (Mirai)", "value": "9143402b50772c1e0d6c437f14744dfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181753, "uuid": "31778d3e-a0fc-462f-88fd-6d32968ed0f4", "comment": "Malware payload (Mirai)", "value": "f8058a3a47b536b7366339583b63c4b28f48d062566c9bcf2208f6907f25dc24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181753, "uuid": "2d1acb2f-d069-48ed-b45f-ffff7c0cde6d", "comment": "Malware payload (Mirai)", "value": "12a0a1611150120fd1806777041eedfff4b3eca4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181753, "uuid": "adee2642-e139-45b9-87a6-02a26f6f3dca", "comment": "Malware payload (Mirai)", "value": "42ed1df070c9b880b14ec05c466249b05c0dfd0d8bc12864d71d4b768f875caa4cedf80eb0c53050ac9f6b096b4b8e93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181753, "uuid": "98d35a4a-e856-4104-87c2-ff6351cb98b6", "value": "T191142B03E5919B12D0C251BAFF6E454937236FBDD3EA3102DC24AF64778A8EB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181753, "uuid": "78279997-754f-4cc3-b4fd-4a8903bdbe80", "value": "3072:jvDcDfqEFroYYAuYkXQod9EqwM+arfoc1w4/qIaUG6mFhvPhUFLz:jIDf/5zYXQTqw3azoc2Mq9UG6WPhELz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181753, "uuid": "3d1d4d5b-692e-48ec-80cd-851aa66502d0", "value": 196720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181753, "uuid": "67ceba4e-c634-4950-8f25-26db5b2d12f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181753, "uuid": "16cf1000-dd2f-4727-880f-b3f25dcabcc1", "value": "wife.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f010f526-c07d-11f1-927a-4201ac107004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1791178255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791178255, "uuid": "d04f6128-4393-4fde-95f5-0e3a2b2bdad5", "comment": "Malware payload (RemcosRAT)", "value": "2c71b1a2da29ded2e9fae8f7f682c7b1", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791178255, "uuid": "6f6ce736-65c9-4e67-9ce4-d4007f89623c", "comment": "Malware payload (RemcosRAT)", "value": "f88971f2b24f63bcb40e9a01ac8bc79850c9ea0410eb2f11ad5400cea34553da", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791178255, "uuid": "d7223b05-09d3-4594-b25e-3118f316e7c4", "comment": "Malware payload (RemcosRAT)", "value": "809d4f1cf5789089919b8fbe15d6f6e8f0a80683", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791178255, "uuid": "853e61d6-0514-4c3d-8768-3bdfa21f00af", "comment": "Malware payload (RemcosRAT)", "value": "b874c8f1326ac7cdb2f7dbeeb1f6f5a8aa6ad3a30fb2c451bb3232b30c781f4f739f41c72a8e34c80f7529f697833424", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791178255, "uuid": "65b97a68-7288-48c7-ba08-5efa7051f78d", "value": "T1418533AD2BE74D951C706C2F8E4B9B7C48372CDFC5C8E953E199A8AA9E1720D52030DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791178255, "uuid": "182db2bc-7547-4656-b015-b4226a8bb5aa", "value": "24576:digOv8FR1ONNC8JiMec7AdTAMqlb6EEoW5ApG/Ii4Lm0VwCk6bKyn8WgdDdzdMFc:JOvcOCy7Ad5qlWrT49iJCk6b6dDdzdMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791178255, "uuid": "494afdc1-ca0e-416d-8495-24b19fceec2c", "value": 1873137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791178255, "uuid": "4fc57cb2-54a0-42e7-8e3c-697ad8061754", "value": "application/vnd.rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791178255, "uuid": "53ec0997-befe-4918-b07e-e1759fc4de15", "value": "IMG-Bill - Ref#843993400 New GROUP BOOKING - SOA.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e226985-c09b-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791190922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190922, "uuid": "d6e26182-b742-4886-bc15-38b3c8f6df42", "comment": "Malware payload", "value": "e67cdbcc4b5fe7fa07a3d58141be6d87", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190922, "uuid": "65aac51f-666e-4fc5-b780-bc6bb956bcfb", "comment": "Malware payload", "value": "f88fa992ec10a58553d3adf2b4c1fcc7c12e7a62af2a4ae9c0768e1fa129e500", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190922, "uuid": "96c19bc3-ca14-4c90-adc3-07a2bd45f78e", "comment": "Malware payload", "value": "d6119c6947af6c011414af3e3066b217cecddff4", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190922, "uuid": "6b94e831-7fcd-4b2a-8d40-56d76b33f97f", "comment": "Malware payload", "value": "59582203286e603c3fb28d636174dc813d5cc8b72c8d9d30468a1705d8f019aa4ab6bc282865f96c131bfc8a3cb03a69", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190922, "uuid": "b419b185-f489-4ad4-a7ab-5f0f6b517f63", "value": "T158C0C083F001467D0F4BF4A441B1980C446046C1807101F37F3CDC04C44C0282760000", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190922, "uuid": "0e9123cd-b37c-4c79-99c8-59dbca081031", "value": "3:jblYFFEm8nhQBgSSJJFIGF7dN0PbKuDK8ErDUhlKNRc0ZspaKnJvXpv:ju3NqhMs8GFIqLRc0S0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190922, "uuid": "646e908d-33bb-4c10-a9f1-eb9f0a94e315", "value": 175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190922, "uuid": "232486f9-19f9-45d7-bcce-e5f53d7e2670", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190922, "uuid": "cb51093e-4f8e-47fe-a338-8b2506132c39", "value": "agent_20261005_000813.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d8d9829-c0be-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791205846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205846, "uuid": "a75c5630-87c7-4c6d-a3e1-29f92c9e2a81", "comment": "Malware payload", "value": "dffa5743e05515ab8953a1872817d0f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205846, "uuid": "3a8810b4-2d24-4f0d-9e0c-df1c0ef9d602", "comment": "Malware payload", "value": "f893ab0ce9775cf0f526a3d2068370fe8b496d3f0a0f7346f281a32feada0f1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205846, "uuid": "2b09a991-8c6a-41d5-b133-7a6f25f5c759", "comment": "Malware payload", "value": "321e360199abe46b17b6184bba4eaa7cb9254d27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791205846, "uuid": "dfe33b46-3fb1-4ddc-9192-cdf8caf596b9", "comment": "Malware payload", "value": "19627ca575dbbf68a49090862b507054afe9b025669be7fc3684809fdd6abf3eb3092fa70c77572541b4786ba0496172", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205846, "uuid": "debfbffb-b7ea-43e9-a6eb-13ea9af55627", "value": "T165247C58B3A108F5EC738239C9935602EA727C151770DAEF03A0466AEF3F7D1563AB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205846, "uuid": "733d3718-47d6-469b-b855-7584102ceb67", "value": "3312ae96e2123e9bc97a5d11efac2934", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205846, "uuid": "58c9e3be-a489-4259-a403-ba039eb06ac7", "value": "3072:3reR7l+9T2I7aCLVIbQpwThO+9uYHyGpVUwe9xu5i84huWW9xEmEhrlNjQqKF:b+laSI1hwThO+vHZ3lABe9yZ6qu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791205846, "uuid": "e8c403e8-d363-4930-9dc3-1907a50e8c8c", "value": 219039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791205846, "uuid": "a90b92b9-3f55-4b66-b7a8-6f8d0daf5f3c", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791205846, "uuid": "080addc6-b790-4d79-a296-5d0f6b28fe13", "value": "f893ab0ce9775cf0f526a3d2068370fe8b496d3f0a0f7346f281a32feada0f1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0998a919-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181734, "uuid": "5101c45e-d498-4cd8-acad-fac3972697be", "comment": "Malware payload (Mirai)", "value": "ec4323037de87df1e03f84672ab7139b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181734, "uuid": "454c803d-ffa0-47d1-8a3b-52de81bff7a3", "comment": "Malware payload (Mirai)", "value": "f974df60d250c338eb72cd3d4db90875f03e31694adfcd6623e8224b32489794", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181734, "uuid": "d8d83d53-3fed-4c46-8495-ef89e2bda297", "comment": "Malware payload (Mirai)", "value": "3cc53e2a6028182208748e91bdd3d765c9d50d73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181734, "uuid": "d8607814-5074-4abd-9d41-1165f3e99181", "comment": "Malware payload (Mirai)", "value": "626df94703ff758021c7d693180dac06fbca14c7bfe2e1fd9c5eca64ed51c2fa570b86d8b75de6a65d8a591c9a76ca12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181734, "uuid": "fad52c82-dd5c-4756-8bd8-1c16ebe3d465", "value": "T183F34B83BF83DAF7E55300F141F69B221A31ED3A0422DA5AD7B47DB5A8516D0E60A37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181734, "uuid": "7c0624d3-b90d-4230-af28-348890275e97", "value": "3072:fhgyPA+a9mf1tRaBqZxv3i7jE4FcBGGR:fVPA+a94lZ344Yc7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181734, "uuid": "040dfa80-7018-4986-b260-2ee850621208", "value": 159432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181734, "uuid": "6189f347-be9f-4212-b3d5-6958a0d5aeb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181734, "uuid": "10603d43-2341-47e2-8f07-07790500db7d", "value": "wife.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebecf6ba-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181684, "uuid": "446d8649-ef74-4826-b2ed-e10ea138cfaa", "comment": "Malware payload (Mirai)", "value": "70507cec6789f291cc3759132637c8e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181684, "uuid": "316b1c58-f51f-4326-8849-b9198ea636cb", "comment": "Malware payload (Mirai)", "value": "f98985d499803026fc2d75226640d21a01c9e003d99c283d863c4c7f1d1f38ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181684, "uuid": "05899734-619f-49ef-af06-14b92644c480", "comment": "Malware payload (Mirai)", "value": "38f6553cbf97d24a80f7ad12d6c255c69b9d6b39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181684, "uuid": "c93af4e6-6c8d-4ac2-a81d-1731452db2ce", "comment": "Malware payload (Mirai)", "value": "4fddefbc95ee3416bb16153960f3caa3d626456161a9210cfba9f8b6e147dde18caf090005012b67782407e9391a39d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181684, "uuid": "2a5bff9a-a3fc-42fe-8d63-c6a5ac412f25", "value": "T125F33963DA26AF56C123A0F4A1F18F751B22AD6A09530EFEA477DAF44183CCDB205774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181684, "uuid": "4f8c2ce4-b4f4-4b05-96b1-e7b93d4788f5", "value": "3072:1XwCNagLg1Vd68fmdAHg5K9SYmWhyFfXqTu:161Vd68fmiyazhyFfyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181684, "uuid": "bd5031f4-35ed-420d-b6d0-c72e70711a10", "value": 159644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181684, "uuid": "ba85f452-00e5-45e6-9e02-b833688d9f64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181684, "uuid": "9706e2a7-0918-4b81-bbb7-658e6ffa0957", "value": "wife.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d59254-c0dc-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791218876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218876, "uuid": "14894916-0613-4b7f-91dc-f40b5060d4e9", "comment": "Malware payload (Mirai)", "value": "90cd000c866f588c4183866b84ce38fb", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218876, "uuid": "ef3a9d0f-e610-40f1-a3d6-efde2deffed2", "comment": "Malware payload (Mirai)", "value": "f9f73b9a4aa84b10551769c4553099468a9dbe9dbd33f82b7c6c4e65e25901eb", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218876, "uuid": "c63b820c-eb63-4983-bc3a-413aa56127d7", "comment": "Malware payload (Mirai)", "value": "36256e43dde999e385ec57257e048a78ba6bac53", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791218876, "uuid": "ec09fca6-75f9-4f6b-b6ec-90b77f3e3872", "comment": "Malware payload (Mirai)", "value": "f409741e8fb66ebd5c2c996942d9e6b8295d04b343c588c34a60cfadb8fed8b0bddf1656df78cc70848d1de2e41b70b4", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218876, "uuid": "bc42e324-b219-457a-9c3b-e74f3a0379ea", "value": "T14A83029120492D31CA15C930B9DD829737B7622893F4A375393215369ADF1AB78FECCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218876, "uuid": "565f9886-f20b-4795-bd40-d743133aa1a6", "value": "1536:1OQn3wBblLk+hjCYNWEhwind8DwQhpAqu0waS/wOatLazh5:8GwbqsjBMnABQhpAq7wALtLa15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791218876, "uuid": "48b736f9-c6af-49fd-bb5b-47369eaef40d", "value": 88360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791218876, "uuid": "4cf7bf95-9843-459b-8e92-5023308101a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791218876, "uuid": "65840168-017f-46e8-b36f-e22a5ad73027", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d45b95e7-c114-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791243063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243063, "uuid": "9e5a4fa2-e0b4-4cd1-b7ef-97d2660f6a5d", "comment": "Malware payload (Mirai)", "value": "964e200fe1e8f1c4cb698b2bcc4c1cef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243063, "uuid": "42724e25-a58b-456f-a0d6-79c44175d2e9", "comment": "Malware payload (Mirai)", "value": "fa0d1f775bf727001cbeea1bc1dba16a9dbfbe76c4ce9a1aa5fd9e6529595912", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243063, "uuid": "fb963f0b-1ef4-475c-b755-3c791718f0b0", "comment": "Malware payload (Mirai)", "value": "3168d37f51e9171836299b60e163345390680cbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791243063, "uuid": "4157457d-fd50-42c7-a374-7b3b3a597aa8", "comment": "Malware payload (Mirai)", "value": "9507bb5b2297f5026c88938729b7d2d4638eafe81463b8f95dbb9f75ade1e6861c9c2364415e9abb4330b7291d981aa4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791243063, "uuid": "ea9dda02-d29b-48d1-904b-fd6aec71a696", "value": "T184758D4AB2F364BCC067C430878FCB629935B86511227D7B75C4AA342E66E705B2DF63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791243063, "uuid": "f1c07f70-5436-4da7-a2f8-043eec8547a8", "value": "24576:F7kDsBuXkrD7Vcl5TjW2SMXw5PqFGr6wm8QfSwbZ:xkA80LVcl5XW2tXw5PqFfwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791243063, "uuid": "cae28f16-3128-4284-a84b-74a3cdb24271", "value": 1673608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791243063, "uuid": "cfbfa1dd-5142-41cc-80f1-f4af496047fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791243063, "uuid": "aebed306-3a91-4dc1-a735-17cc10efac33", "value": "eclipse.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d94bd3-c097-11f1-927a-4201ac107004", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1791189242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189242, "uuid": "9a9c0474-36a1-44ea-b7f6-a3e7d10b4bf4", "comment": "Malware payload (PureLogsStealer)", "value": "727bfa92803b3adc0f6f49a24aa200d7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189242, "uuid": "a796f3d0-0c72-4373-b97e-406f1ec3895e", "comment": "Malware payload (PureLogsStealer)", "value": "fa1ca66a8f16efdf98e87c60d5760235bde36568ff036292ef51e24f17c637c9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189242, "uuid": "704ce4e9-fef4-4306-874b-4ef7b73ab9cd", "comment": "Malware payload (PureLogsStealer)", "value": "6f6835d70549635d9b819419f2cf12ae87e3e3cf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791189242, "uuid": "47388b9e-8981-471d-95f9-2dfbd7fb0b1f", "comment": "Malware payload (PureLogsStealer)", "value": "65cc43544f8c8c3a9e26ed63796cec886dc1a08abd41ec51ab99c89c3ca4a819353ccd1799dc41fb9fb7afe49389e5b9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189242, "uuid": "e075d581-5a92-4a2b-9267-0747f0926d20", "value": "T1B5651224DB8B463647CCC378173B0F2440B6F9916A4CD0E4FB0D9A97A27CB9D91E2DA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189242, "uuid": "b340039f-1990-424a-876d-eb1cd1057a80", "value": "24576:rUPdKTrnspymjRnAjt4XPhGzPtqVByjK+g4nMwWvwzMBddcVc6csnPe:gPdKvOwOXP+PKiMw2jkcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791189242, "uuid": "05aa8647-84e5-4394-98a8-a46aef4ea797", "value": 1509553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791189242, "uuid": "04c3255b-2394-4d20-960a-0e398d0f6a22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791189242, "uuid": "a1b5e89e-3f68-4f0a-98c7-679c44d56f6c", "value": "Requisition_2026-ML-001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de8bb6ed-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (PhantomStealer)", "timestamp": 1791190681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190681, "uuid": "8dd48874-e24c-458e-ac90-beab8048ee10", "comment": "Malware payload (PhantomStealer)", "value": "b6a48e76a9b4407e3dba633ff4884214", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190681, "uuid": "c0a0f7de-f329-4d11-9ecd-f5151aade42b", "comment": "Malware payload (PhantomStealer)", "value": "fa9693ab0228147ee3d8107d46fca3129a5f2470b5cedf3956301d046f5a713a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190681, "uuid": "c8fe49a1-d654-4db9-b9e0-f2f8c8b8a123", "comment": "Malware payload (PhantomStealer)", "value": "5d4abd3e8300bd76fc7d165d9033f7c0c9bebec6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190681, "uuid": "34944739-e5f1-41ea-9e83-422a798f8175", "comment": "Malware payload (PhantomStealer)", "value": "ba768a39260147e3bd5750d7ec3897dae37450acb93e83b2414f6299cdb8186f46cdff6286e7852b62a300da19e02bca", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190681, "uuid": "0d544c00-ea85-4ac1-afc0-07e332c610f8", "value": "T17E264A810F0B94B0B62E572DD076B9500659E51313B9EF3D30B8464BB79EA27678F8E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190681, "uuid": "37922a41-4ddd-404f-b450-1b3e3364c722", "value": "98304:YBMKOJDb6GJ6X/eGCMFf+NZNStIhnqKtFy6Z03sr0x1aoqR8YEaevAkuK7k7T9aV:NKmmwHwKby6ZclQoqR8YE/eUkPQD4ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190681, "uuid": "7e533d5a-2a57-4e9a-97bb-3571f4a8aa0b", "value": 4508866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190681, "uuid": "18b5c202-f402-4c95-8ac7-b8415c3960f0", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190681, "uuid": "4e2fa215-047b-4f01-8762-189ac250167c", "value": "Shipping Documents.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1aa38e-c086-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791182033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182033, "uuid": "5a56d917-548c-4f34-bb1b-2ab244c82c42", "comment": "Malware payload (Mirai)", "value": "a847bf5b05072ffb5598856b11b2f01e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182033, "uuid": "94fd328b-92e9-4f0b-b62b-ec96a8baabaf", "comment": "Malware payload (Mirai)", "value": "fa97321b62cc801e57d3197ad449c126f6781303a8e3b63936f61f0d1b566333", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182033, "uuid": "2fd50358-6b20-4b19-bb27-97067cf583a4", "comment": "Malware payload (Mirai)", "value": "34d7e4c2c0b74875723e15666748fdaf81748e96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791182033, "uuid": "58ec0fb3-0a44-4b94-b729-b91f74c53d35", "comment": "Malware payload (Mirai)", "value": "80ce875cbd90c56b7122d5720e82c67bdbde3e52552d9765b968e7f633e375da06f8d93fd0967d2e1d0ba899fbb25cf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182033, "uuid": "22719ebc-76ed-4966-89f7-920688f5646f", "value": "T1A2042A46FA518F13C5C751F7FBAE42883B266B7ED3EA3102DD256F6423864DA0E3A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182033, "uuid": "0dbd18f1-bdc7-4f74-8af9-418916274687", "value": "3072:4+Ene4NSjv0YahJ+J5uslFqY4EnymNENgkiLhF9Ay:4+We4NSjv0rQvum4Y4EymNqgDhF9Ay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791182033, "uuid": "48a1e30e-b8be-420f-8ec1-2da2f1cef7f1", "value": 180092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791182033, "uuid": "9b68e6d7-280f-4eae-a03f-1cab093def8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791182033, "uuid": "347e5260-5fda-49e5-8e58-53fdbd9a3961", "value": "wife.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5277bca-c10b-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791239225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791239225, "uuid": "0898f35a-b798-483b-a5f7-d3f50c3d7e71", "comment": "Malware payload (Mirai)", "value": "bdd5af6fc65e99872202558029f86482", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791239225, "uuid": "a39e64a0-210d-4016-aa16-79f0a2e33fc0", "comment": "Malware payload (Mirai)", "value": "fac09f790776e16863fbd09d1dec12aa31807e110f9b532c404647d22c07412b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791239225, "uuid": "699c1f35-8c06-4a65-a944-010d7f523e2a", "comment": "Malware payload (Mirai)", "value": "63bd3f184deb169c40563ec04656f87d2a6155cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791239225, "uuid": "f17cc9d7-2046-443e-bd99-24b69359e92e", "comment": "Malware payload (Mirai)", "value": "f49499cc58adc82135a94a7721bf0cf3bb9f0f86b29477362028c066ca85d472e643bce66fd93b1bbeefdf8da53a47e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791239225, "uuid": "d5911c01-4972-4283-8b51-9b29bb6bdc87", "value": "T12AD3F906A951DF12D1C221B9FF5E425937136F78D3EE32029D24AFA0774A8FB0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791239225, "uuid": "0f054366-dfef-4153-ba9a-1e5915c61540", "value": "3072:cOUEKb6MXllBqmDa0R1n7SbW0Z7r9/eEm9lwC:cOX1MXTBqUaqSRZ30Em9lwC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791239225, "uuid": "497dabde-569d-4029-824d-56afea828ffc", "value": 139160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791239225, "uuid": "7ec58eea-01e1-4d80-92b1-ade5edf0f6b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791239225, "uuid": "ec82f258-9385-419c-b961-f77cd876b7e8", "value": "SecuriteInfo.com.ELF.Flooder-AEG.39963138", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba373ce-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (AgentTesla)", "timestamp": 1791190542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190542, "uuid": "384c1106-f3f0-42a9-a604-7187e785be69", "comment": "Malware payload (AgentTesla)", "value": "1463af6dc760b81888b0a1d52a735a6a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190542, "uuid": "6f8ecc1a-72ed-4500-86ac-11c7a8f2de92", "comment": "Malware payload (AgentTesla)", "value": "fac9bd40b22caf9387b9b94fa0626f6adbf75f36492ceb1a9cde6242679adfa4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190542, "uuid": "a2990589-eaeb-4c8c-829a-3aaddbcd4cf1", "comment": "Malware payload (AgentTesla)", "value": "b249216deac358ade097adb26813facc34735335", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190542, "uuid": "32a5cf3d-f965-4eeb-92b4-2b40f98f87cb", "comment": "Malware payload (AgentTesla)", "value": "bd0f10dac4489768f27139061945be4e189dd2cb2f5b2c32bd064ce9708262a7aa51d327704e0cb28be7d0003fdfa883", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190542, "uuid": "bc6b9b92-5014-4b68-b941-9b6c5960a515", "value": "T140E5B5B92744A23377257B8C9536992164CA701339C9CB3831ECF225772CD1773AAAE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190542, "uuid": "d1eee944-38e6-4d61-9f92-8c00f3ce7d6a", "value": "98304:Q4rDFXgu2ArWqdpJP5MbWSizKBvIo9FbCUAJ+G5NU7ncmX1/t86956RK:Q4rZXgHcWqjJP5MaSbeCFbJW1NU7cmX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190542, "uuid": "bf7666f8-7fcf-4623-87a1-c5d51510c3c9", "value": 3266904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190542, "uuid": "2f486db4-f263-43f5-8b6e-184974c12199", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190542, "uuid": "58f46108-3ba9-4414-8111-6c7549d3446e", "value": "Quotation_MHB-RE-21D-001-26.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "debe8a9d-c085-11f1-927a-4201ac107004", "comment": "Malware payload (Mirai)", "timestamp": 1791181662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181662, "uuid": "4ec81e89-f21c-4aee-a3b1-028d2c730b42", "comment": "Malware payload (Mirai)", "value": "9414534541a09607dcb09ad7d383cae6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181662, "uuid": "caa28d40-d473-4165-a5aa-86ae758de6c2", "comment": "Malware payload (Mirai)", "value": "fadf32ce2ed240a99554d3fe75694b55ed345da6e67a3b16a6ddd641f50c0562", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181662, "uuid": "7c5c3880-af16-4780-b79e-4682030a1410", "comment": "Malware payload (Mirai)", "value": "876ca987d15b45e6657559fc81639a1e7af6df5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791181662, "uuid": "6b8924f8-2bd3-4dc8-b67c-9eab5a7846c3", "comment": "Malware payload (Mirai)", "value": "6874aed7449173e061dde8136eb0e76e1900e3c80a0cbd13022bed00c257b955f3b0c0fd13c6ee5ec4a2a9a58cf6a9ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181662, "uuid": "da230c2b-24b4-4f7e-bc49-f3a06455806b", "value": "T18C833A91FD819622C9D152B7FB1E428D772653A8E2EE3207DC256F20378792F0E7B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181662, "uuid": "0b15e643-ac0e-41ad-a545-3e5040b58b77", "value": "1536:h3h2lsOGZztFfLQ1U/OUEfcEZVcR5Otub72bNOo+LrH0y926Oakr:h3h2lsNpFlREnU5OtuOgj0IQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791181662, "uuid": "580da77c-be65-4445-89e0-679169f12d53", "value": 87852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791181662, "uuid": "3e101221-54c1-4915-afa0-bfe7dbcd4381", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791181662, "uuid": "e7eb1aad-a4ae-42c5-8e30-a1e563e9dbd9", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77384a37-c065-11f1-927a-4201ac107004", "comment": "Malware payload (CoinMiner)", "timestamp": 1791167744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791167744, "uuid": "7a2f0821-6aa4-4e17-9a58-41a8248e1247", "comment": "Malware payload (CoinMiner)", "value": "8de4f7dc19cf7f78385e3cbb5b31a684", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791167744, "uuid": "c5103bfd-bdd9-40ef-9df0-f85e651e8fdc", "comment": "Malware payload (CoinMiner)", "value": "fb7460f1febcc0f1e96f2df6c4b940f3beac750ce8cd1f30f98086400fbbe20e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791167744, "uuid": "eb9a237e-92d8-4367-8d26-fc729d9b4fb7", "comment": "Malware payload (CoinMiner)", "value": "4f1cf8799aca04e99ebce7553a3042ae29706f00", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791167744, "uuid": "fa65c397-5186-4683-9cdd-294814c565f3", "comment": "Malware payload (CoinMiner)", "value": "1814b69ccc3e78eea2ce1102f788029880a939c7576d8d5934fb620cbdd31ee2f3a48e2e6db9111f1688af9ad54617c1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791167744, "uuid": "3daa0c4f-146a-468f-aa23-ac98a476a26a", "value": "T16F172315B79724EFCA168234187EA720FE6EDAA46245CB7B879CC27C3D72C6918C43D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1791167744, "uuid": "2b78d365-685f-4036-8f8d-e906dc644440", "value": "2f395dd587b12a61e6877a545da7a7d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791167744, "uuid": "515b8967-424e-439b-b82d-4d1b5396e25a", "value": "393216:ySiO33nWRq4q1bHqzekMosMGbZqzFRq4EJix33nII:viO33nWRqt1bwekfsTb+FRqZJix33nII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791167744, "uuid": "96dd17d1-c33b-4cfc-a215-a379bf3ef923", "value": 19390360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791167744, "uuid": "8850db22-754e-4370-b963-8bd4fb4cfd34", "value": "application/vnd.microsoft.portable-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791167744, "uuid": "5d9cca65-a7b3-47ad-8189-a098f4bc7e15", "value": "fb7460f1febcc0f1e96f2df6c4b940f3beac750ce8cd1f30f98086400fbbe20e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46df83d0-c0bf-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791206318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791206318, "uuid": "2c635ffb-9ea5-4d1c-9eee-d48ab16b3756", "comment": "Malware payload", "value": "bfabd10cc55cdda854a763ff8bba0f72", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791206318, "uuid": "9bc7f141-c6db-4d20-b763-bbdaf9a14fd0", "comment": "Malware payload", "value": "fcb25bcd035d93e2791be4990119bc3980ffc16209faec1cb557208168dc7f72", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791206318, "uuid": "7715534c-a957-4b29-962e-a0e6801c8b57", "comment": "Malware payload", "value": "aa3589322313f36ff2f401bcb6171d5b4adb8c27", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791206318, "uuid": "f5b596f4-b803-4f4b-b148-b7c7bc830ac9", "comment": "Malware payload", "value": "20e4b3990f4c19f7215ed72de7a5d6d22009cc58fd111a9dd05f1b71fe414635c2f0bb4c2cd1fd78c8ef2ee467c5bd40", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791206318, "uuid": "51d5871b-5333-40cb-8330-482758d84a61", "value": "T10A7633FEEF347E4DA73BD6F7F1701589888267097C6754A144E842A2ACAB94017C38DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791206318, "uuid": "10df7d72-245f-4799-b07a-777771d3c331", "value": "196608:rVZRR8bkqiT0nYzeM5PEsqz8UPS/j1paY7nDPkS8lQut5u:RZROiJyMLi8Ua/hpl7DPkK0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791206318, "uuid": "1d3a060f-fe89-49ee-8d3a-6381563ea42c", "value": 7596301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791206318, "uuid": "9e2bf57a-9f3b-4a6e-bf86-e84f7c54fc45", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791206318, "uuid": "53de5f82-4a73-4580-8816-a9a107f91c4b", "value": "bfabd10cc55cdda854a763ff8bba0f72.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188cc31d-c0bb-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791204522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791204522, "uuid": "d1c823a1-75af-4fc3-b0e4-4751cff932dc", "comment": "Malware payload", "value": "12bff79c7d029f7d912e1da5c553dc45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791204522, "uuid": "0b45270b-4b9c-4411-b1ea-adc3191eae41", "comment": "Malware payload", "value": "fce20206059d8255440bfa6704d44c72bf93c5bda993bb494c1614219df2ebbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791204522, "uuid": "78202c37-07af-42c3-9093-6ea19784f3a6", "comment": "Malware payload", "value": "aa30674115d636c06c4b1337b92c8e657d036308", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791204522, "uuid": "1965f573-46ba-4eb4-8bac-7642b5214b0b", "comment": "Malware payload", "value": "cae4400693d304668d7a80bbbe4d6ea29172c4192eed8796016eb96849454c70bd9439aae53e19050507c354a190ba2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791204522, "uuid": "d3a89092-f7d8-486a-9a6f-2526bc3264d0", "value": "T143D20A3AEA725913C4E599B855F3832CB9BA465FA4794B153C6B0EC4EF91AC02013FA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791204522, "uuid": "78dc7724-1dce-4eea-b427-c8da7ebe191d", "value": "384:EZ8woIvFHwcOxoUFCHqkW6EcAXqGlFU+pphxF5CMDfI:EZ8wogOxo8cEdO+nCMzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791204522, "uuid": "6e1e2ffe-38dd-4a43-962f-d99e0fc9a4ec", "value": 28828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791204522, "uuid": "3ddfd60f-88eb-41d8-bb6e-1c3e6dd36e20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791204522, "uuid": "cc952723-0c6f-43ac-85ed-153ac6f39ac3", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2760fe1-c08f-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791185963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185963, "uuid": "c78fb230-e7a3-4099-a471-6719d4d54af8", "comment": "Malware payload", "value": "3bce921ceae94873080eb5700166483b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185963, "uuid": "048a1630-c89b-4877-8b66-e17dfe9efa03", "comment": "Malware payload", "value": "fcfc1c6b4f9b2a5cbadc7677bb66062ede5207bb9f657f986ac57bcb2342f48b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185963, "uuid": "bbf4f803-1288-4ab4-8c16-41797dc73403", "comment": "Malware payload", "value": "c52f048c9c9ae7b7404d84453d9cccd88cbfc332", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791185963, "uuid": "15a1b65b-d964-427a-97c3-effc2c155579", "comment": "Malware payload", "value": "34638bbc4283a39a39ff5a0314d8a338dbf440af9aa0db56c7493de96bb7605d6f68d9a6c231b26178b3445efc617bc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185963, "uuid": "0d4a6ed5-206a-4e5b-bac2-6783e35b0eee", "value": "T184D53A03FA042F95C950593389B60E9537A6AE586F319747E704B6BF69F33020F5AF88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185963, "uuid": "ae3d905e-264c-4c47-8c23-b2e28871caf7", "value": "24576:xhKbneardC/xC8VsUNQ6oQUQ17mWnCb2nr/S+quZyrbzxeY56NTRdVDZwA65qQl7:xhOO77QeY56NTZ65qs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791185963, "uuid": "200d410b-05ad-4c7c-8121-d4898697d331", "value": 2949246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791185963, "uuid": "3ad496da-b093-47e6-901a-d180a71e22b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791185963, "uuid": "2ec3b683-e77a-4328-96bc-1410020637da", "value": "bot.ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86026b7b-c09a-11f1-927a-4201ac107004", "comment": "Malware payload (MassLogger)", "timestamp": 1791190533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190533, "uuid": "b9e5cdc0-c056-4adb-9420-84b32bf76af9", "comment": "Malware payload (MassLogger)", "value": "162fcf959e60127378b579e32845d85c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190533, "uuid": "494e5492-c637-425e-813e-02c57cff65d9", "comment": "Malware payload (MassLogger)", "value": "fe3a4057803790281558f0ff04eae94118e0e3bdc4fd236a801bf89a7900cad1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190533, "uuid": "d66c8ac8-a7d4-44cb-83e0-68c04e29088c", "comment": "Malware payload (MassLogger)", "value": "c8e47ecef7d0214e00b5369203c8ac44d1d33f7b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791190533, "uuid": "f94fda6a-fd12-4cb9-a7dd-4639347cfaad", "comment": "Malware payload (MassLogger)", "value": "1b01a1b5b5aee53e2f04c6f715114eb9e9775388c23fe2e7cb270dd92a1a2189c7e1d07f850587efae1dd2b7c98dadf0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190533, "uuid": "e445eff1-31f0-4671-90c6-3e4fe2c456c9", "value": "T19FD55CBC8188E1816A7C351780046EDE17D3B83F76E1AA3E7DDDB99A7F44B01325B588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190533, "uuid": "22cbc71c-f66a-4184-984f-a9ba35a2e793", "value": "49152:RYPlMUEVUo0b6rRo/bURGTmN3fu8vo6uXgu6VS3HVgmSH18djE/J7mpD1wbK8PGh:RYPlMU7o0b6rRqQRGTG3fuN6uQu6VS33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791190533, "uuid": "0fae8044-1b1b-43a0-a380-e9adb17c2cef", "value": 2746256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791190533, "uuid": "f653cd6b-39a3-4b80-a3ff-f4213ad3d6c8", "value": "application/javascript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791190533, "uuid": "3cd35ef1-a79b-4394-9b3e-ede93d5c9c02", "value": "Bordeaux Order.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae6fda7-c0a1-11f1-927a-4201ac107004", "comment": "Malware payload (Formbook)", "timestamp": 1791193628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791193628, "uuid": "de5132f6-04ef-4775-9421-0ac3db0f7de8", "comment": "Malware payload (Formbook)", "value": "4b73a59310314ee30cbc0325aac8eda0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791193628, "uuid": "9e161540-418a-4332-9351-a7a9fcf5bf80", "comment": "Malware payload (Formbook)", "value": "fef37229535dcfb8938d555c3cd14cb9d0dd59fb24cb3abab2727a6c6228d02d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791193628, "uuid": "716a592f-a949-4d8a-bf59-2648254683d0", "comment": "Malware payload (Formbook)", "value": "ad5e6d708510055db7343abb3d67752950788438", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791193628, "uuid": "5174f494-7f76-4552-9187-ff7e21cda66b", "comment": "Malware payload (Formbook)", "value": "cac073fc6b4c9261e5f9428559c71f1810ea47e02568263927f5d68bf180045454e4e1807c0896fc82bc920c556f902c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791193628, "uuid": "6086a842-da8d-494c-836b-f1d4f420f99e", "value": "T137711F037707E1748CB18BA6899FAC09D5E02D97AC0F0C157DCD89D66F3539AB5E90A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791193628, "uuid": "c1355278-50d5-4350-b1be-609c47578eab", "value": "96:aw+oIlyinf9JZqjLVVol0/H6JhT/2/r1V:aw+oIll1JZAml0/s/2//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791193628, "uuid": "91438b2c-33e6-40cc-aa6f-44b77e5ca170", "value": 3607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791193628, "uuid": "e6949e0f-b559-4de7-9a2b-3f095f88a693", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791193628, "uuid": "986f1419-99ec-4c4e-bc71-c301fc547aaf", "value": "RFQ - PROVISION TO SUPPLY AND DELIVERY OF FITTINGS AND ACCESSORIES.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd98f96a-c0df-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791220288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220288, "uuid": "e8f28b8c-441d-4912-994b-f0c20d0271f4", "comment": "Malware payload", "value": "254d0939aa583860da690f6092e31f53", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220288, "uuid": "dafb8d6e-0731-4c93-bf1a-fc9e5c613016", "comment": "Malware payload", "value": "fef49f45f8eac22450386d4752729225b570a7b0ff05cd29ee6847bf4d69bfb8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220288, "uuid": "54ba9a7c-4073-4c89-b8c4-7d565e4fdad5", "comment": "Malware payload", "value": "c6400b76914e0d7c0fd7d7a6b9c877e1285b1e44", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791220288, "uuid": "35fc6343-29a2-4492-ba52-91b066a525fe", "comment": "Malware payload", "value": "299843950a7e004b9c4e03e573fffb8bf1f2d4b7bff93c64fce6bcf628145bb5b8a75272e08a06198986eb1dd3094c03", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220288, "uuid": "b8dc6c63-235b-46ca-b3f9-49514d544cb8", "value": "T18D565B81FB48A226D95A0F324CA30F60B3516D42C2E4CD6B5309F76F55B16F6AA4FED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220288, "uuid": "948742c6-be8c-44bf-b5d4-7bc77920c685", "value": "98304:uql7Gi0y+M9mlyyTU4c5PXy9EcLEvVPWryAnEjEm:eIyMZymcLENPqZnfm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791220288, "uuid": "17c1fcc1-8845-4627-b66b-622baf399a05", "value": 5898424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791220288, "uuid": "05d61eb9-3ad4-431b-b2a5-2a5309a9b241", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791220288, "uuid": "5fb828f5-a75f-4bb4-8c67-0015813a26fd", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb95100-c071-11f1-927a-4201ac107004", "comment": "Malware payload", "timestamp": 1791172804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1791172804, "uuid": "750712a7-3270-45fa-b689-6fb22b1bc36a", "comment": "Malware payload", "value": "499e5d99e15aebf69877ee76bdafe6f4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1791172804, "uuid": "585e7f5e-15c9-45f3-9c89-588fea003656", "comment": "Malware payload", "value": "ffa91bd5a14c9171559048f3f5bb6e76d9224e106de839c13dbf4843c313e763", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1791172804, "uuid": "7a9e2645-a6e5-4bbe-a829-28b9b80054d3", "comment": "Malware payload", "value": "d17e6e19f2fca9e02c717434e108684362191f5e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1791172804, "uuid": "cc72df7e-d467-4e67-adb7-01a264720e89", "comment": "Malware payload", "value": "105d68bea190302e6c7caae5e5f53bf9577108b12b6d88bf0f582f40796e6f03f726823920bb139fad7ce490e5b42faf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1791172804, "uuid": "4624f3af-8dcb-473b-a1f7-18ff38187f66", "value": "T13D04C507AB519EF7C86FDC7306F98A0124CCF4572664377A3274DA6CBA1A58B05E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1791172804, "uuid": "92d22346-7a2f-4eeb-a271-dcc7fd0e70bb", "value": "3072:QhkgHidRHGKAmL1YrtvvjfJ/mvmGdER7xdEH:QhkYKZ1YrJfAvmG8TEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1791172804, "uuid": "d5f956e4-d665-4d3a-8ec3-8b019a706497", "value": 185592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1791172804, "uuid": "c82a1d3f-5961-4731-a32a-493e9bd4950d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1791172804, "uuid": "25ca8872-0d7d-47ff-a1b3-ab2a5b04d30a", "value": "eclipse.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }