{ "Event": { "published": true, "date": "2026-01-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-01-21", "timestamp": 1769040181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "c2177d6d-f233-45b5-8dae-e5c565a3ffdd", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a58962fd-f6a0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768983028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983028, "uuid": "6e221675-2c66-4b2f-be42-92d1c9e2c735", "comment": "Malware payload (Mirai)", "value": "8ee4a021aa728b9ce9ccd56dc73a70de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983028, "uuid": "5935684f-8db9-4f55-b935-23f1dfc0a557", "comment": "Malware payload (Mirai)", "value": "003a39abe9c9e7f73c5e7e9229b470c9bf678c2303f0c550742296741ee51bc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983028, "uuid": "4159b220-f8b5-49ad-aa83-19a638ec43da", "comment": "Malware payload (Mirai)", "value": "79c9c7b67a43efc1e86aaf8d941002745bc0bec8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983028, "uuid": "37347db5-bc6a-4ae7-a69b-69f908f6d5e5", "comment": "Malware payload (Mirai)", "value": "ec3f867cf51b867f410648005a02291bde9186404caa78d7f8552c8bdc807d9ea01ff387e02b3600ef6b8682738dee57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983028, "uuid": "b6d996ec-2db6-43b4-8668-78fb44553680", "value": "T1EA733C02771C0E43C1A65AB4263F27E0B3EEE9D021F4FA88651EAB46C575E335186FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983028, "uuid": "56b76e84-7c76-4b58-b89e-8269947e4c94", "value": "1536:I+5IgpIRW9sfeXSH3bthyfXWBIZQG1oy7+5NY3c0/wbZnIx:I+CesrDBI51cMlwbZnIx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768983028, "uuid": "883464b2-619f-4aee-9301-967d3cbcf068", "value": 79276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768983028, "uuid": "7905ed26-d418-4a9d-9bcb-121c4e74e1c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983028, "uuid": "56b4897e-1b08-4b33-9994-b687237fdd3c", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8826f9c2-f67f-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768968805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768968805, "uuid": "aab69669-ed26-4358-861d-ac508297fabe", "comment": "Malware payload (Formbook)", "value": "9a594e6f1c58b63b5e449bb914d601d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768968805, "uuid": "8f1f5fb1-8f47-4fbb-9ba7-feb30bf0c7cf", "comment": "Malware payload (Formbook)", "value": "0181debef17f37a78926c383a839ad2994f6dc49bcc5602890558545d58a9876", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768968805, "uuid": "43442066-c4c7-4f66-bd3c-a2f753f87141", "comment": "Malware payload (Formbook)", "value": "163e263bdd47b57dc237151e40d12170ac4b8a5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768968805, "uuid": "5a16165a-de7e-4163-aed9-cb556f3bea8a", "comment": "Malware payload (Formbook)", "value": "832f6e92bb924ba157c9bf176bef54ed061346097605c79817c8d77cb8e6cc6888e05f969a4d9050b49d971b75d8b2ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768968805, "uuid": "7139d977-3573-4046-9d2e-a3743e915d4b", "value": "T19645C00273D1C062FF9B96334F5AF6115BBC69260123A61F13A81DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768968805, "uuid": "96bb1f64-fb0e-470e-b86c-b95f7977ec2e", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768968805, "uuid": "351f54b0-b497-4f17-9302-03fd0ad84787", "value": "24576:7qDEvCTbMWu7rQYlBQcBiT6rprG8aOCIvCY0qDAeY4dCvDT7XUiM1J:7TvC/MTQYxsWR7aOUYVUKkvDv61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768968805, "uuid": "e57ce0d8-6a8c-413a-8b1f-84249ee05429", "value": 1213952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768968805, "uuid": "5866dcb0-7260-476e-b982-0480d0298e1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768968805, "uuid": "5391de49-89af-48e1-9899-4bb011e505ef", "value": "1EP041074.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62808d90-f6c2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768997518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997518, "uuid": "e7c853c5-3214-441a-87d9-887ff3215a77", "comment": "Malware payload (Mirai)", "value": "fec6541f3a7373b409cc6f5675a9a6ac", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997518, "uuid": "1bc7caef-77b4-453f-9fa7-9d2786cd4d7f", "comment": "Malware payload (Mirai)", "value": "01ff471d09d3ff04ba0e9ae08ca0e1b5a909e6f98b31dd61cb6636b7bc561781", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997518, "uuid": "056a75f9-645c-43d3-969b-77a78f088f17", "comment": "Malware payload (Mirai)", "value": "d13d717d23b1e07fe2bf389199031217b89b42c2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997518, "uuid": "15035dd0-5253-4680-8a40-ceb539b1462d", "comment": "Malware payload (Mirai)", "value": "3a1a2bffe31a84b24cf7a4249ce4425024c11bb968fa782d6247127821953dafaa835ef0e1bc573e71f405dc94571969", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997518, "uuid": "2518eb2a-84e9-42fd-b601-f79cce037c70", "value": "T163F03AFD21A32EDB85145D4161710518D022E3E9D5A3CF88BF5D3827898C7287824BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997518, "uuid": "038c3c60-a5c6-4943-b876-f0f91af39e94", "value": "12:TeJKE+ITtNIkKEOTjKEkT1MXZTo80NgTJoNDTWz:gKiNIkKxKqjoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768997518, "uuid": "42b6aadd-2236-46ff-896c-d875f30f3f5c", "value": 548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768997518, "uuid": "0eff8fb6-4343-4bdd-8cc1-829dfa541499", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997518, "uuid": "803f4a44-f58a-4779-a99b-12101cb80a97", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e0bbf5-f6a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768984614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984614, "uuid": "e22adacc-04ef-4cf0-afc5-8dc9484b6a22", "comment": "Malware payload (Mirai)", "value": "40d4201a8226dc9cce7819eba8e0f23f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984614, "uuid": "75b455f4-7f9a-458b-9150-0e7e233433b6", "comment": "Malware payload (Mirai)", "value": "02674827d14825b3c638e9c601fcb907751b2e45aea19ecbd7a7dddb011a55fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984614, "uuid": "5635d68b-fbb8-4423-aaf2-af8d9f6c258b", "comment": "Malware payload (Mirai)", "value": "96a134dc2dccb4e927c221c7f3f22154d0f7c5ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984614, "uuid": "f35621ca-ffea-42a2-925b-b4d5580f57a4", "comment": "Malware payload (Mirai)", "value": "4a1b46a94b1aa1c2fac691d08ab4e803a3b434a5a412b10e2d2a7c12d6ef6b5f25d53237a6c69e66dc265b1f93eedc22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984614, "uuid": "e509fb06-2717-4ddd-8524-7e3b6bb52d52", "value": "T19FD31907B98080FDC8E9C1784BFEB136D932B5AD127CB10B2784BE366A5DE205F6D615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984614, "uuid": "b6058dfd-7224-4ceb-8405-84ad193eba7e", "value": "3072:rYXHPEc0qgdHT/pqCxhQJfxc0Zi2u0M3QMoL:rYs9zJx+60um", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768984614, "uuid": "89290081-c2c6-443b-9293-122d0a0a78c8", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768984614, "uuid": "ad0eb7e2-c8dc-4e9d-a99f-284e17027510", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984614, "uuid": "59835053-d7bc-458f-95df-aba9a6c3273f", "value": "ub8ehJSePAfc9FYqZIT6.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f598438c-f6df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769010220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010220, "uuid": "b86921b9-46e6-4815-b12a-19457db5ecc4", "comment": "Malware payload (Mirai)", "value": "e61e42edc28c5ba432808ac85d35fdd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010220, "uuid": "fc7e6b68-915c-489e-b5d1-403f92f50b90", "comment": "Malware payload (Mirai)", "value": "02b72ed0838bc87f7669991f3828fbd6243d557b1c97e8e7e96a5e36c233d9e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010220, "uuid": "b8ecf86e-ac5b-4710-97a5-20081f861b21", "comment": "Malware payload (Mirai)", "value": "308805ad2af74b526bfd41abfbe02c34bfb0c93e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010220, "uuid": "b3ab901e-c530-41b1-adc5-bbe7cb0ab1ee", "comment": "Malware payload (Mirai)", "value": "59e18ad8316590855bc2bd2fd74673c45ad4092f5d3e157fc04fff8165083703992f64d5b34ac193a10759a53e69ad2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010220, "uuid": "ef84495f-04ba-4304-9430-cfb6a009722e", "value": "T17904B719AB510FBBDCAFDD3702E90B0139CC955B22A93B363674D528F54E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010220, "uuid": "19884b9f-8ea5-44c0-a812-81fc0488f5fb", "value": "3072:nKpzGjeNkSfcQqmav8SqaRVlnYz65DVt:nKYjeNYQqmeqavlg65D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769010220, "uuid": "dc5c4be9-27ab-4350-9c06-93ce52512f24", "value": 177760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769010220, "uuid": "6d543adc-a8da-4560-b9c1-59d31f0ffe93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010220, "uuid": "e53030ee-9074-4941-ace4-a110c00a9bcd", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b983de-f6ac-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768988175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988175, "uuid": "21e96904-da6c-47a7-86c2-38eca52e780d", "comment": "Malware payload (Mirai)", "value": "72b347f9c37e8fe957481c42c6558c25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988175, "uuid": "e624daad-87a1-4a88-9cf4-b80a3d4019ed", "comment": "Malware payload (Mirai)", "value": "03874436523114abad968a8969763be951c6de4333de31430839922eea1f88d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988175, "uuid": "78acb625-08c5-4c08-8842-353095e6aeb2", "comment": "Malware payload (Mirai)", "value": "be8dfad2192f28e81e78ead6306e47590681e27c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988175, "uuid": "195a8dda-3c1a-47da-9022-301f0d8afed0", "comment": "Malware payload (Mirai)", "value": "a3e33bfff238a6b4d7caf386cd78b084b43ead8a26d387adc8297f8437a599b04f8e891153f978537d812eb7bf68de85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988175, "uuid": "c7ea71bc-fba2-4f1c-a9a8-3ab41eab720b", "value": "T1C9933A46BC814F11C9C503BAFA1E118D331357BCE2EE72229D106F25B7CAA6B0E7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988175, "uuid": "9164a4fe-0899-4e92-a86b-574ce2a4d68e", "value": "1536:roBnYB4hWTS+7zqe4Sle8ZkBkSR50goaCZNQSM8ihtKcnaHRdX+Ld7Ew5nYu/wbL:rj4hUS4qb+e8OSW50XaNtKcaHDX+Ldod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768988175, "uuid": "52aeb0d4-0af3-4654-965c-2b00e318ad0c", "value": 91380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768988175, "uuid": "f2aa11c2-4559-4172-9f39-f896e3bc1c7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988175, "uuid": "d7ccd827-d646-4e27-be47-ebe44b6fa3c0", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "797e8b0e-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034923, "uuid": "1482b48c-0ce8-4edb-8e29-b93f1f84bf0e", "comment": "Malware payload (Mirai)", "value": "77bc8c04beef1f628a44e5a42692ae1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034923, "uuid": "5a7317b8-911a-4a24-83d2-ce9a24ace4c0", "comment": "Malware payload (Mirai)", "value": "03ce1d9b84f583a9f7594483ea79869c08bce7978108d93eef9f9511a43708b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034923, "uuid": "754fd6e1-1967-46ae-82a6-e0c7b3072d40", "comment": "Malware payload (Mirai)", "value": "c9403437bbf312f65fec7a96b6b306c2f42eddbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034923, "uuid": "d7493522-7f99-4c6c-b9e1-5bfcc54e8010", "comment": "Malware payload (Mirai)", "value": "f18f8dcbd13ef51a3849f1e5a65a1e9d3ca10fd15b41a019032871ce325311e612ca4eaab31d2ff3f0a13134009827cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034923, "uuid": "e8ec2c37-3ebd-4a41-b984-67442ad42ce0", "value": "T193931952BD428F13C5C221F2B7AF068D3B126B69D6EB3242EC217F9123869DB0D77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034923, "uuid": "bea1c07b-00b9-4ef6-a773-c0344a467a72", "value": "1536:uTRl7bpULUxj0DWF2OLkrJk+4beGHWYK35XvGN3oYcrUn19+D/r:uTRl/pUhi9F+4FHZK3CtcAi/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034923, "uuid": "00845eaf-a24a-48e5-a3f7-be9e3619ee54", "value": 97100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034923, "uuid": "7277103b-eae8-4f3a-808f-45fc1f3d1184", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034923, "uuid": "8190a9d5-3c87-4995-88ac-302e8ded0346", "value": "titanjr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689803e2-f6c2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768997528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997528, "uuid": "f93fa4fc-2ff1-49ca-8567-8005d1a07519", "comment": "Malware payload (Mirai)", "value": "dc41555982ce94e96818c7566f56ed04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997528, "uuid": "99ea785e-5051-44c4-be88-5550d116079b", "comment": "Malware payload (Mirai)", "value": "0528ef076f17fec7d758288c6c3309ca75e37ae5280f3922c52eb904213dc4fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997528, "uuid": "ae208b20-8966-42c0-a62a-648a3ee3437f", "comment": "Malware payload (Mirai)", "value": "a9af5c7c064aa9d3f212b1f5f997ac717751c27b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997528, "uuid": "5ab4cb4c-1eff-433b-86dc-593190816aed", "comment": "Malware payload (Mirai)", "value": "9ef9dff9b4e5abed92ddf336c90651a7da11a6263537de31b7c8554f4e82300ba49ff303282f17d5908c8c1621ff04e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997528, "uuid": "5b6a3087-282f-40f8-ac51-b0ec0f5edb8a", "value": "T1AEB31B81B987C0F6DD0B1870905AB33FCB32E5258036E979DF98AE35D663642B71639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997528, "uuid": "e974a013-69d1-4f5b-93cb-f4d66babdf2f", "value": "3072:ilmGfvZJvwlZnJS4SjApwTpbspAU57fHbviVF9:ilmGfvZJvwzkHcwLm7zqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768997528, "uuid": "7725a5f3-3b68-41a4-b501-f962b361d8c1", "value": 116532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768997528, "uuid": "33e7e786-85b8-40de-a96f-5892f7e607af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997528, "uuid": "97246c43-9a7e-4b9d-b7f1-c5a3003f4521", "value": "goon.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015e328b-f6c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768998644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998644, "uuid": "3d9aa164-41a2-4e37-b422-c6f3f3d93a69", "comment": "Malware payload (Mirai)", "value": "d3950b9df873b8233cb0cc4c07eec87a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998644, "uuid": "cf4ae828-34e4-4893-9175-1d1bbe847a9e", "comment": "Malware payload (Mirai)", "value": "06e493fdb91aeead44733c9383dc693cc5521b0cd59b492ff769d618bc3d5f46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998644, "uuid": "916c9bb0-f5fb-40ab-b3b2-4ac4378ccb31", "comment": "Malware payload (Mirai)", "value": "3f8e1852fd7bee715988d12a726204978fe7a67c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998644, "uuid": "a56699f9-ed69-4b3c-947c-a7ebc5f38a30", "comment": "Malware payload (Mirai)", "value": "6c457893e797d8a111e5373d63fbc4c590e06892a155b38e00af95b96221b1e5d3c4c132761c5f97771f4c767e3f082a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998644, "uuid": "044253dd-d711-452e-ab1a-842b331ee5e8", "value": "T1C0C30A567750DF62C32DC23009F3C752ABEA26D226D29549B26DDA0C2E7174D682FFE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998644, "uuid": "bb4c7b9f-c410-4b72-87a0-19dd47182662", "value": "1536:trITbKufCylt8UtFVX+5XZUHvEMteRGDcp0CK3MED2PLiZCmDPP5vrUXe:trqjbtFVXmXZUHMzxrE1CmD5jke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998644, "uuid": "6167087f-9f5b-4c45-aaab-1fc036ef6fa7", "value": 118704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998644, "uuid": "996f6947-c7a9-44ca-871d-a3d295e0d326", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998644, "uuid": "5242370b-e20e-4333-988d-8905eda47f88", "value": "life.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7210731a-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034910, "uuid": "32c1eeff-fae5-4258-94ac-2f8b33b66795", "comment": "Malware payload (Mirai)", "value": "0acf0c89f82535a28efcaef22149ff72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034910, "uuid": "b1111a27-f719-4024-b0fb-5fc5580dea2e", "comment": "Malware payload (Mirai)", "value": "0725116cab37fe76b32f0e460f6dd085bd44618f800918722650bfcd99fbfb5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034910, "uuid": "ce50ca02-546e-44aa-9ed0-a1214ff0b148", "comment": "Malware payload (Mirai)", "value": "e0b09a1287cddf0eea51efe00ad7d87f9cf9c3a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034910, "uuid": "ba7b00bd-9552-4939-bd99-e31d45e0099a", "comment": "Malware payload (Mirai)", "value": "45d04773b17f3e42adb67265132b8e6f99d732ce7879c25fc16a9de4179f6dec5802fb6be1fe2f6cbe43784efe415af8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034910, "uuid": "5b25a6a0-94ef-4479-b1f7-f0f7b419c39c", "value": "T167E33A55B8828A22C9D513BEF92D018E331327A8E3DF7213DD115F217787A6B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034910, "uuid": "453c4ee7-0b5b-4360-a876-f69c89b09ce2", "value": "3072:nfCRy9wfcdohwrCcEKo1KAvXPf2iagsSxxQumS0T+k7TCQ:qRkwfcdohwrCWo15PuiaaXmSdk7TCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034910, "uuid": "2acc743d-8f2e-43f9-8114-a57d1b3d5674", "value": 149376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034910, "uuid": "715a2a30-d00a-4847-8453-fe319ff83a76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034910, "uuid": "5c79e957-1f00-4c74-9bd2-4f35f7b36f57", "value": "4rm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9c7f54-f6a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768983635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983635, "uuid": "35bcdcc2-7f15-42f7-94eb-5c83dac2cb9f", "comment": "Malware payload (Mirai)", "value": "62b2c578a37cfa81e14e828e429a6c93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983635, "uuid": "871ef2c0-d230-4bcf-a509-ba053b2b67a8", "comment": "Malware payload (Mirai)", "value": "074585aaa483924b792a4d83831485d25b72fa02bf94a14a841b8c545a24867e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983635, "uuid": "d2ece630-bf36-4a20-a124-b99e456e06b7", "comment": "Malware payload (Mirai)", "value": "3a2fc5fca99d01f7dfc383b60577eb3bbc47295e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983635, "uuid": "49ab04d4-1701-4b61-a735-261e21f201b4", "comment": "Malware payload (Mirai)", "value": "db866e30c565cc10cca7d8574d5dd2b78b1909b9cae46c4ec3669eb2f30ceb90b7ae46f01369476b76b07d2ae7ce37a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983635, "uuid": "b0a49094-4525-4762-892c-9f665f5d9c26", "value": "T15723E16188826E57DBBF16B28C74C6E073754B274FB9EBEBA4E05F405F03852A114D98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983635, "uuid": "20574cbe-c1e9-44a1-be16-bacf9fde2693", "value": "768:CW0VE5MzgJdkr6aHoiM62f01IaCDA8rvMVTM0azsmO1Oh79J4cZfbmK4uVcqgw0H:xeqk9HoiM62f01IzmM3I1m5GwbmK4u+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768983635, "uuid": "3de79096-0385-4d0d-9dea-46ca27061bdd", "value": 48140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768983635, "uuid": "61fd82de-d0ff-45cd-bdab-75414504ec83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983635, "uuid": "5f554634-de49-4984-ad06-4dd3126e20da", "value": "ub8ehJSePAfc9FYqZIT6.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d61ad3-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768998626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998626, "uuid": "21a14b59-fd39-4604-9fb8-fac22aa61056", "comment": "Malware payload (Mirai)", "value": "967550631d826a085cfde88393758ccd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998626, "uuid": "ad87cfa7-7e0f-48e9-a5ce-f7e63019e54f", "comment": "Malware payload (Mirai)", "value": "08b9bdae9fd508af47de9768c527fca3e9398aff95e90d495c433c7161ee0ada", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998626, "uuid": "2a39a91d-47f7-4b97-8c9e-6e9575faae87", "comment": "Malware payload (Mirai)", "value": "110cb32b8f88c86a547249c4468434573ac73fe5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998626, "uuid": "0631b608-fbec-4c0d-b227-278243119adb", "comment": "Malware payload (Mirai)", "value": "a00b06b31a25a5a9baff2dec1dfd17c1e36d22376aad24461359a7112af2c6231f62066419c7d2a4d7b32caf45cc2889", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998626, "uuid": "c864d372-1bfe-4610-9d22-18268f2b9b5e", "value": "T139634A42F69190FDC09BC17887AFD166FA327C4D53207DAFAB84BA312E36E215709751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998626, "uuid": "f3c3dd91-87c0-4cb1-8d0e-276df2236637", "value": "1536:vGKwg1QIfXq4/cG0hyFYI/9w/NgTUKor:OBgp/cLDIhTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998626, "uuid": "e29a550e-ef3a-4038-8600-27cc60972135", "value": 71840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998626, "uuid": "5d8cbe40-2530-4447-b447-38caba6bd8b1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998626, "uuid": "79cfbee8-19f2-49e0-8aba-f6b047267bf0", "value": "kk.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1bb4d5a-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768998617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998617, "uuid": "f1069987-c889-407a-8fe0-b33ac6f26e6c", "comment": "Malware payload (Gafgyt)", "value": "1612e00354042f0be41ef6d41d011a17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998617, "uuid": "cf6f023a-8ed9-49a5-b373-c8a6994b26ee", "comment": "Malware payload (Gafgyt)", "value": "0962ef7a29559deeca1895f0a632f4c70eb58f18771065e2d5192803c3556a0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998617, "uuid": "e62c1ad0-154e-44b1-a698-ed9807fff336", "comment": "Malware payload (Gafgyt)", "value": "0398bb9cdf62b01c3f93f2bb916b337ebe1b6ad3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998617, "uuid": "19b923c3-930a-4ba3-8d9c-dcc67dddf39c", "comment": "Malware payload (Gafgyt)", "value": "b7e08f6a5de0ffc1694b2e25b4cae257db65e39a8c895808f065d1a561083d61da5ea39f3beb221a076dfc0415f23a92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998617, "uuid": "a860db7c-a555-4ca5-8e7d-6b3e398cb7a2", "value": "T175637D85F797D2F1F1834670002BEB6F9B349D154011EEA6FF0A3B75AC71A529A1A23C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998617, "uuid": "5aa24517-0cb9-4cde-a2e0-72570647833e", "value": "1536:/wyuOkIvk+cLcBaH1LIDeLWpTKfjZBSOlorg:/cOkIRcLIaH1cDeLvTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998617, "uuid": "0c8c4a86-b13b-4c4a-8040-0164b0784fc3", "value": 70892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998617, "uuid": "a5e4f3dd-d2d5-4d49-a83d-9c941d9f6cd0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998617, "uuid": "3390ae0d-dbc5-45e3-aba3-c2ce33e9720a", "value": "life5.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e76764-f6aa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768987108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987108, "uuid": "1dc3c229-4a35-44c7-a128-cfb5931913ac", "comment": "Malware payload (Mirai)", "value": "0bd260b08eb66492f432b32d78c2b084", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987108, "uuid": "391ec157-e4ac-4779-9f80-421340baf82c", "comment": "Malware payload (Mirai)", "value": "0a0565a2216f09fa039902f24f4e1c7ef05fadd5f338109d518e7007135bd09a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987108, "uuid": "30de2364-924b-4247-98f1-31e1222dbb40", "comment": "Malware payload (Mirai)", "value": "c8ef20bf56fd7098d6695ce274628e8411086e93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987108, "uuid": "2c2ff845-ffff-4947-a9e8-b0b21fe3fc89", "comment": "Malware payload (Mirai)", "value": "99eb9a3e7b6f7d28f6840f7bfea6fd1e062aa65f1ca914f6b366dee486671e391133e355b590188e652213e2c7980e9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987108, "uuid": "d3bc2c4e-eb86-4b36-bdc2-671bd3d7abb0", "value": "T1DBB36B63CC792F98D219D174B1B48FB92B539921928B1FBE5567C3B48403D9CF90A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987108, "uuid": "1f87d8b3-4e70-48d0-a78a-f4bedc79e191", "value": "1536:AaX881YV+YWyTxxR8CW9plubTWcbvVJUkpKr62li8nkh2t:AwYV+LyTvR8BplsTWcrsBrXkct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768987108, "uuid": "ece73714-023d-4f9b-8673-f29fae10ca75", "value": 114884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768987108, "uuid": "1f30d3ac-f108-4767-a3ef-cf96ef5b6572", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987108, "uuid": "232665c2-e8be-44ab-a9fd-5709952904ce", "value": "ub8ehJSePAfc9FYqZIT6.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3cb274-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768998613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998613, "uuid": "69d4f722-eaf0-4ee0-9172-cf949723b7bb", "comment": "Malware payload (Gafgyt)", "value": "19cb0f0ae2be454e42270ede28ee2414", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998613, "uuid": "862ebcfd-53ea-4975-a209-2d8117903574", "comment": "Malware payload (Gafgyt)", "value": "0aabf7f19492992fd773b8c940768b3de295587eefbd190a204da6c9c3bfefd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998613, "uuid": "061eb7ae-cb37-40cd-9eb6-cf6b856fdc51", "comment": "Malware payload (Gafgyt)", "value": "6f8ca10440068b7b010f14603808a46b18b79f20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998613, "uuid": "b59d9984-72f9-4097-b371-f044b22edd5f", "comment": "Malware payload (Gafgyt)", "value": "005c02fb67d6f9f123daf02462784f665451c3184884cce1bed419a6bd60b7057c4a5ea5a47783041b4e0c54b53afa88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998613, "uuid": "7655f1d5-cf41-49f0-bb7d-bba06c60f383", "value": "T14E736D85FB9BD1F1F1874670001BE76F9B34DD194015EE9AEB093B65ACB27528A0F22C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998613, "uuid": "cd4c7d36-e46d-4842-9567-c9ba2b750810", "value": "1536:xA57zGxx+A0aEdtPHY1HagA5+svggUOXTLs4XZP7aor8R:65O+AwnHYZaPAmggl5Vf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998613, "uuid": "7ad3067a-f431-477e-8622-dbdb764763eb", "value": 75160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998613, "uuid": "3846de1c-88bd-4500-8b8b-6eb512f4ba41", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998613, "uuid": "583a4fac-c9d6-465c-ac5c-4a6bc7525f2a", "value": "life.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f6800a-f69c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768981416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981416, "uuid": "f64f99cd-fccb-40d4-91a8-5a7bbe349066", "comment": "Malware payload (Mirai)", "value": "7b0972313f0313b2785b49d5d10dc50d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981416, "uuid": "ec16eb95-d389-4214-8a74-82e7a7e07808", "comment": "Malware payload (Mirai)", "value": "0b5a44d310d868e79d7ef9ead43c6080e0479684513099cec7d3deaf3c5c9676", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981416, "uuid": "7c8d8894-74c4-436b-a139-f1cd66669858", "comment": "Malware payload (Mirai)", "value": "21ceb24af45eb375b9411840c8915e878fa721c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981416, "uuid": "75e7654a-4120-4e3b-a42c-84bf3ef74018", "comment": "Malware payload (Mirai)", "value": "42572f8717f6496a2925264b4803752186bcd14b8b08cc863b8db3aeb87fd98e69b6ca1f2116deccf7afde9f91c162d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981416, "uuid": "37466d81-977c-489f-927c-5957ae13e1bf", "value": "T1BCA2C034369B9D04C26028BCD97DD54B71D34BF881F870BE74514A78D2AB683A7BB683", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981416, "uuid": "0189f8f5-0ad5-46d5-be1c-3eda8216d4b1", "value": "384:sDJfMCv0zkPFuo3j8bPXVV6w+JX1xNhymdGUop5h8n:sy+3Fuk2PlabNs3Uoz+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981416, "uuid": "6176a594-03e4-4cbc-8b23-9235455baff6", "value": 21808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981416, "uuid": "98cb16d9-9516-45ec-ba90-976398f832de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981416, "uuid": "2c3f7d89-893f-4ed4-9166-47c779d9155d", "value": "Orbt.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef702652-f6ab-11f0-a129-42010a9c0007", "comment": "Malware payload (Babadeda)", "timestamp": 1768987876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987876, "uuid": "b6f04ecc-55bd-461a-af5f-162e7d308aef", "comment": "Malware payload (Babadeda)", "value": "4708c76e2591d93ec4032318e1f40483", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987876, "uuid": "70919165-9d60-426a-bf05-319dd5d60b1f", "comment": "Malware payload (Babadeda)", "value": "0b9c98d0df580bc39ce95df98163130d5b0a2473949ca707e866dd81a954a6e0", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987876, "uuid": "69eab6e3-2210-44fe-9bb8-22985c23435a", "comment": "Malware payload (Babadeda)", "value": "fa34c01130e120945777cb838c4f1d09ec758b60", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987876, "uuid": "4be6c4d1-e75b-4eb7-8924-6f10c2a5f90d", "comment": "Malware payload (Babadeda)", "value": "875a799c0e5925bc9568a639b7e95f0a573feeddd6eeff4bb60a6703a22c50205083d131dde8956f2d39909955aad142", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987876, "uuid": "3933ef16-5c79-4239-ac5a-f49c0c5c9b73", "value": "T16625F2C2B084D2F1FD784D366037147A47336E3FE688B85A9388B60316F65D24F7A55A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987876, "uuid": "350deff3-d38c-4f0d-ba9f-8cd4c0893fe7", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987876, "uuid": "4cbabad1-6e24-4e76-9da9-2a40d77e8ee1", "value": "24576:+cvkTs2nz7+itUtSQnNSDqQi07BVBRfft9Kk:ZvkTjf+iOMU+i0/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768987876, "uuid": "9de6d7b3-9635-404d-a02d-e9818fd70cda", "value": 1040896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768987876, "uuid": "437b670e-95db-4900-b7f2-d2abc94b455e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987876, "uuid": "5c60db93-23ac-4998-a4d4-7642da181435", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6c5cfb-f6a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768985804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985804, "uuid": "31a150b6-f1a2-4c1e-b463-7cc44cb94105", "comment": "Malware payload (Mirai)", "value": "931722863190b5978adc84fb5ced6b9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985804, "uuid": "b281da20-b1f5-4774-a322-26d98680b55f", "comment": "Malware payload (Mirai)", "value": "0bd753010fee80888a5969498a1215139f2548a90cad6298e01bcf54c40b94c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985804, "uuid": "33a3036a-f725-4b9a-b7f2-6bc43c729018", "comment": "Malware payload (Mirai)", "value": "9cbcac75d4dd550d0f70de84d76839801f090a28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985804, "uuid": "7afea14b-7a15-4202-9e99-557326d005ce", "comment": "Malware payload (Mirai)", "value": "68b1043c436c0b70c94c7f20eaacb61e19ae1edb80cb3f1c0efb331c4d03460b79a436926ca69ace8770b9a5db0aa1b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985804, "uuid": "e4dabd96-5672-40a2-b39f-f313d94de050", "value": "T11853027BDB678083A1E4E8758E3E4A403CED2DB5D2A55F73985D8B4895A092BDF040CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985804, "uuid": "f7bd1a12-e6a6-4540-8fce-6b56c728946b", "value": "1536:ymLPbVL6eAku5zKrvuE5XMP2MTLqTzBwe0Dmg3jnfF56SrsMLT:lbRSVKjv5c2UEz2bjjnf+SAMLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768985804, "uuid": "24965585-56b1-4df0-885b-f1827c629337", "value": 62044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768985804, "uuid": "041aedf9-30ba-4070-8480-3f62e76c4e72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985804, "uuid": "2386e3c8-5e8d-49d4-b7cf-bb3cfb9677ce", "value": "Orbt.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f5e85c-f699-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1768980029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980029, "uuid": "e7851e77-91dc-41ef-a6dc-1fb70e33fd28", "comment": "Malware payload (Adware.Techsnab)", "value": "7074ac1f44a3793ff92b482ebeed6a18", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980029, "uuid": "568d7e1d-3edb-4c12-ad77-8da010fde325", "comment": "Malware payload (Adware.Techsnab)", "value": "0bf401c83c97cc5551e787ecd18295f9416152ce91de9a9031176c7fb738f983", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980029, "uuid": "e116a401-9ace-418a-b0a5-a56b0c7c1294", "comment": "Malware payload (Adware.Techsnab)", "value": "0d799421725f9fc9d1ec8c324051fa42131b0bb6", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980029, "uuid": "0f5c5543-9a64-4e50-b519-31f8fffadb63", "comment": "Malware payload (Adware.Techsnab)", "value": "8957517f4b54c5984ad4cc70b79bc667c4d33531a43755f284c1ead1d7e01fdf638538a3a2132ed1f2b2ed7c35d2e115", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980029, "uuid": "af805d73-c50b-4d8c-a294-20f1a5a33d7d", "value": "T16666337175D9806AC877AD36A468EF3FCA26E8215711C1DFA3889037C6503D0E1BBA77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980029, "uuid": "fba8670c-1737-4754-9b1e-8a6c9612536e", "value": "5939410b96773d14b36f2ddd9c7141f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980029, "uuid": "e68deb25-dace-4d57-a590-c3c78177bd08", "value": "196608:Gss/Z6qScGDnZXRV6q7mFMxGKE1eI7uSVinsG+P:Gl09EFK7aeI7wn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980029, "uuid": "eddf3907-f75e-46f5-a306-70fb3f2ea609", "value": 7060134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980029, "uuid": "b4771931-6e23-40a0-8f3a-3667559f32d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980029, "uuid": "56eb2760-6277-4d49-a089-99e419d1049b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa7a130-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034925, "uuid": "ca2b64f4-d03f-4a54-87c5-effaac56e658", "comment": "Malware payload (Mirai)", "value": "dcc40efd4107d17064e05f233a243f6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034925, "uuid": "38f39671-61cb-4171-be90-abb3685a8c17", "comment": "Malware payload (Mirai)", "value": "0c4196c3d4547f720e44cb42902ec77a7fc35724bb61b6f712e9d19caeb07a06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034925, "uuid": "604f260d-579a-4070-8485-24f306637fb2", "comment": "Malware payload (Mirai)", "value": "ca39483f82d86c372d7bbaa5ae756ef70296ceab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034925, "uuid": "f2fcc271-fa85-42cc-ae7f-8acbc6e8abab", "comment": "Malware payload (Mirai)", "value": "3760b7ee0c72d42c11921f5a0f349f9cd92c700c94985b077ce068c26f7f918b93d8cdf1dc0f248f28620017d62348c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034925, "uuid": "25b07357-d673-4e07-8161-0576d6bd7d3a", "value": "T15BB32B87B501CEBEF84BE6F645A30915B531FB760D930F66B267BC93A9311D41822F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034925, "uuid": "69d1f9b7-2584-43bf-b2a6-2197c0e3d121", "value": "1536:3yXVYNIsXpnGwB5IbmdiTf7C1vqO8883vmQDARJnFSNYeuH7y1g4LivG4dM:ppTBGaIL7C1vqOKAnFIYZgLivGgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034925, "uuid": "b099d763-277b-4605-823e-17952e8c5975", "value": 107544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034925, "uuid": "f6a2f839-ea96-4da6-87e4-a5f1a0b08049", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034925, "uuid": "6f660487-f7ce-4aa0-a72d-6c395c7aeef2", "value": "titanjr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff48c64-f69c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768981059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981059, "uuid": "2c4cb882-bed9-4f78-8e72-ad78aa2103ce", "comment": "Malware payload (Mirai)", "value": "3778357ae3432d61b5d37204f513ba98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981059, "uuid": "c19401ad-1fd4-4883-8da3-f00a79cf1b3b", "comment": "Malware payload (Mirai)", "value": "0e29b1ed62aba6e908d5c01c864d57acad3c6b025871f508e68f5ed557bfd99d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981059, "uuid": "1904824f-6d1d-4029-a697-6c444c0fd644", "comment": "Malware payload (Mirai)", "value": "4fceedc1c8545df042f0db8211bf267647581577", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981059, "uuid": "594d4f83-246d-4976-b248-8f299ae28d1b", "comment": "Malware payload (Mirai)", "value": "1964b9478f59663fe2d83b25b1ee48a1cdd2e955a43c58ada84498d66880dda35172063b628b4d9d2fcb7000ed2806f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981059, "uuid": "b49ada5e-bf64-4b84-b50f-d57664a41be8", "value": "T1D923F147C8970604D8DA493C29AF7B8758025B29834BA433AFC8347F55FFBA4AF64245", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981059, "uuid": "99ba4f7d-17db-40a6-a022-c2a9081d146b", "value": "768:IOwm8yv2l1cQIfZgRWh4yRI4i8H25qc9L6/Xni/kbRBhaLtWTUuiU1Hct9nbcuyD:IOj8sEXaZEWhRRI4ii2wy4BhaLmUTWGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981059, "uuid": "85cf88ba-9695-4148-bcd4-a93afdd8ce9d", "value": 45652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981059, "uuid": "c3a37e25-84fe-47b9-849d-b2f504e5be8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981059, "uuid": "9dac175d-edf1-4283-b940-c6793e7174ac", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a237ddb-f719-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769034736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034736, "uuid": "780bbde4-be20-41a7-9192-e3f7d36e4db3", "comment": "Malware payload", "value": "b11064069de07d7a72cdfa4fc2172ea6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034736, "uuid": "df47f85a-45cd-4ff1-9852-80001524e6bc", "comment": "Malware payload", "value": "0ebc8939c36b195c185762fe1bb64fa6c7d22420783c9e82233affd6aebd2382", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034736, "uuid": "327f8b43-1704-44ff-97cf-711d553c09f4", "comment": "Malware payload", "value": "61df909825c3d893c64a23dc341c0dd36ea03c2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034736, "uuid": "97f6c91e-de8a-40e5-a826-0390129c4750", "comment": "Malware payload", "value": "c0894eb157088ae68d03702a7d59576a51a8977c7e3eceffea8fc7d5b0a49c59873102d5ced2fe0a36380f04bb03c528", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034736, "uuid": "61753822-de0a-4878-9b8a-def2a477e162", "value": "T1C6331985BD829A17C6D4533BFA5E43CD372A63ACE2EE3213DE155F2123CA42B097B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034736, "uuid": "2adf2705-b101-4f43-ad3c-ed82d4024282", "value": "768:sP5GAh+0w0OOTXnOwENV5NWgK6r+K53x4zvOiITCRWyvbwC9pj0jmV:GY0Uo1ENz7L53ezvjzdvx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034736, "uuid": "79de5e38-07dc-4ec9-a77e-5e554362163a", "value": 54480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034736, "uuid": "afbddf2d-00b1-4263-996c-8fc76c0de841", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034736, "uuid": "29c508d7-1e2b-4798-b2b3-1ed34dcd8aba", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4486138-f6d1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769004205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004205, "uuid": "aa8ee711-2b03-458b-8d1a-5fb1f254a1d3", "comment": "Malware payload (Mirai)", "value": "a6d9eb2befa23925e4fb8e02e9efa2eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004205, "uuid": "562cf9aa-960e-4ee6-a576-b2cad15144d8", "comment": "Malware payload (Mirai)", "value": "0ebf87b4e6f9225a6062947618de49be2a4cdb146e9b68c07056d2fa0c91f16b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004205, "uuid": "2de78ba6-42da-4a05-9c8f-5228298b3d7a", "comment": "Malware payload (Mirai)", "value": "95db62fc15e2e71544f692da1d27e8afa93e9305", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004205, "uuid": "dce57cb4-29de-4410-b7fb-bfb730c9c2d1", "comment": "Malware payload (Mirai)", "value": "d201dec25af33e6b27e64cfbd045cfca289bafccae70f4320c00f56b5436881c7a9e0b78c0012e71025a42bc10f5eafb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004205, "uuid": "dff86b62-9da3-4c7d-9051-4e85f03ba63c", "value": "T1C913F1AB99081A61C3F60534D91CC586D6E30D7CB0ECF03D7D1D949963A31B76BE4B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004205, "uuid": "5f423d88-0002-461e-97b8-456d8438b425", "value": "768:g4pMYWW7zSiQWxyxrpOoG7f5xY8UZz1sQXxgiQs3Uozk:gYJ7mswhpO55pUkKgqzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769004205, "uuid": "0a51beae-c425-489b-b3ff-8b4816a17cbc", "value": 43136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769004205, "uuid": "97306a1e-b008-4cf6-b37e-ccfe84e49310", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004205, "uuid": "bd371864-8d1d-4aa8-a0f1-0f24f275dbba", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac6175c8-f6da-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1769007950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769007950, "uuid": "a22316b5-4a88-4fd7-88d0-67ce08657b4e", "comment": "Malware payload (CoinMiner)", "value": "42fe651f35fa6b16d280374f757d2817", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769007950, "uuid": "72c318a5-d400-4087-a3cd-b7c7a91c2896", "comment": "Malware payload (CoinMiner)", "value": "0ecf3547251601ff8fe19f49b499afcc2ad311c529475cfa69b9946a9411fb57", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769007950, "uuid": "34d4aa85-fa5f-4d02-a125-96ef66467b4c", "comment": "Malware payload (CoinMiner)", "value": "078ed4a77beb863900b28035ac74d870e69d270e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769007950, "uuid": "1dedb3d8-d0ca-4d6b-9660-936b9db4860f", "comment": "Malware payload (CoinMiner)", "value": "33d15ede5e9e7201525cfc2665f5068b45601f79bacc3ea273b487251dc1554e7b85e91c175fa6bf21aaa9ddc6745387", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769007950, "uuid": "114768f7-6cae-4722-b8d7-42e9133ce828", "value": "T14BC5338581021BFFE821597850484AF3822B79D627E593EBEFCB5B07ED116C8473E993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769007950, "uuid": "9c9e8782-1924-4d26-959e-9a55cee53f2e", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769007950, "uuid": "c98c04d1-1ff2-43b1-87c4-923ced4417e5", "value": "49152:L35o78QpQA3yiP02/GkEatiGAr6OzriD4haJEkn:LjQpbrPo6OzmD7Jnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769007950, "uuid": "3c133f2a-259d-4912-82bc-118ca21fbc68", "value": 2701824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769007950, "uuid": "5a683e5c-b196-4f61-b410-8e8ee9df5685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769007950, "uuid": "c5250ce8-24cc-4540-8b85-3f7816c29ada", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a7beb6-f69c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768981060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981060, "uuid": "fd025405-14c7-4261-995b-dfe2ef187716", "comment": "Malware payload (Mirai)", "value": "8a8a744159889edf1ecb4ba58af35278", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981060, "uuid": "42c0c1c0-ffff-475a-b1e2-036f145cea1c", "comment": "Malware payload (Mirai)", "value": "0f11e8b57cc0e4c27dc4481ca0a769ee969eb6d03921ef17ca8252503a1cc52d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981060, "uuid": "3f331f89-9a9e-4314-ac44-ab60c3ba0786", "comment": "Malware payload (Mirai)", "value": "f128176daa59c021543c12dbee7be3bfd6df2c1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981060, "uuid": "222c6dc3-5415-4fca-a769-2dffabc160ba", "comment": "Malware payload (Mirai)", "value": "3495aa43591504df74cfb69e45370e864ee08948f9f52c331d1581a056fc839143ecbf5c17dbff3ff52456a90cbe7bb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981060, "uuid": "c8ef7eb6-9c4b-4215-9049-3dd9458342e6", "value": "T10043F22751232061EC25F93BE9660DD3A79A635CC6B631F7B72AD60907D14438BD8CDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981060, "uuid": "2bfbf425-3a62-46b8-8d54-d1469201f02a", "value": "1536:UFOS31yT8gkKUe/0/p3uX7q3LDUC/kRt1GSEG:YigX/p+X7ILDUxnwSEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981060, "uuid": "a44a6624-552d-4f21-9a19-4ea68ab1cbce", "value": 60620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981060, "uuid": "853e9aa7-0aa4-4f72-87dd-acf9f4bf2d2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981060, "uuid": "9d4b781f-dcce-4066-9adb-b31a66b8ba43", "value": "ub8ehJSePAfc9FYqZIT6.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ffe6988-f6d9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769007473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769007473, "uuid": "01b7cb69-33f9-42e5-b74b-53e8332bbe5a", "comment": "Malware payload", "value": "393f0cb8ca7d3383b8e4b9c9d518d0dc", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769007473, "uuid": "5a2aab86-aa0d-437c-b69b-f1920443a439", "comment": "Malware payload", "value": "0f7d358f3a96d7f185be26a349ec16dfb75bde1bda8312945931d69b472d950e", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769007473, "uuid": "d703005b-7478-499d-a691-34ee43946a7b", "comment": "Malware payload", "value": "41a5efd21848fb43e553ef31ce6a112a28276711", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769007473, "uuid": "03dfa24e-4f84-466e-ab57-5aa7d32f3b34", "comment": "Malware payload", "value": "30514371c76c45432d71662ebad60c9d400d35b8d1daff3c12bb5763d8085be62b9d3e13ecd3f1b96fec6951eb25e21f", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769007473, "uuid": "36a86b81-7370-45a4-ad38-21c1652a8397", "value": "T10A67336494248C4D445587B3EBF73EB231A42C4BFB6A4C3DAE2650A481F17EF5AED01E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769007473, "uuid": "34c8332b-af2f-4ccf-b6de-a11992e1ae7e", "value": "786432:OWcwuRRIOktcs6cxbAJBN5Yr/aVmqX0TsGFsfCem/ZOiLT:OW5uRRIO7CbATYra3ETxF0CoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769007473, "uuid": "b6e2062e-7dca-4e79-a468-0e32a7074eb5", "value": 30042433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769007473, "uuid": "eeef5c21-51ee-4f4c-899b-ebb7d76353ee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769007473, "uuid": "bf6c3d01-3777-4a00-86df-c83753721628", "value": "proxy", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c42ffc2-f6c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768999118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768999118, "uuid": "f245a9fb-fd98-4643-aa58-bd728dcbd92f", "comment": "Malware payload (Mirai)", "value": "4f84190a7784802f3ed649caf146b082", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768999118, "uuid": "7876e2cb-414d-4eb7-b68a-bf81ef68f4e8", "comment": "Malware payload (Mirai)", "value": "0fa2c350881d04f3bf91ab5bea177369fec23017e5529ab9844c168066550a14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768999118, "uuid": "eacf2b77-f380-49e2-b5d4-b28ae849b89a", "comment": "Malware payload (Mirai)", "value": "410aee39f734196fbe782cf4b296df6e99f6c258", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768999118, "uuid": "0ed822f2-bef9-4bd1-9bc3-9344e47704a0", "comment": "Malware payload (Mirai)", "value": "e89d7b8a9e04f138be9ac250034ebd3d82dd06d2eedfe652af9ebcb073611344bf09eb2e73783a106b59061d7f04b420", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768999118, "uuid": "cea98893-a66a-4749-9037-ca771730001b", "value": "T10CA34A0273654147F3EB0DB1283FBBF193AFD5A121A0A2C5695AEB4F8131E32154AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768999118, "uuid": "9af11d77-2243-46b0-85a5-2c2f3c82e0ee", "value": "1536:deooH3OB6RCA6T0krLYIHiv2oOxfGVmvUg4aiAtQlaencnLMcVsFBHE4K1zjtquY:aOB2WhxfGgvdfJjtBS9J/7+T2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768999118, "uuid": "105a7e19-ad75-49b2-9ee9-adc7f9ed0d49", "value": 99640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768999118, "uuid": "25510102-4c09-4642-8320-abe5a2d0a05e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768999118, "uuid": "b84046d2-f968-4d0a-a69d-fa5e80e36817", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de01400-f69a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980277, "uuid": "64f0e33c-ed54-46f9-9acf-e938af117891", "comment": "Malware payload (Mirai)", "value": "4775331f6f67842a7a70595598e6a797", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980277, "uuid": "09e18c55-c460-4aa5-9994-8ab711a22794", "comment": "Malware payload (Mirai)", "value": "0ffa26de2ac2f7d5fd7ff3ee317e598b925d71b75292ab48c2ef514338400f4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980277, "uuid": "2761e82a-e9ca-47a4-b6ec-9d4854719643", "comment": "Malware payload (Mirai)", "value": "faec0e26977a63b3967ced0cf9d90a398be15bd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980277, "uuid": "f5299c79-d062-4b6f-be8e-3aab475a9883", "comment": "Malware payload (Mirai)", "value": "7e80e7334b5dbc9f74528d7b8f0ce3c1619bd7145ffe7c649b860582422a5ed6aced7748b2a2a3847364a8517ba11ad9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980277, "uuid": "89eb3c00-e06b-4469-ab4c-9f7bded391b2", "value": "T133D32A0B698080FDC8E9C1784BFEB136D93274AD523CB24B2784BE325A5DE215F7D615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980277, "uuid": "bcdcd5ab-cc85-49ee-8997-a54eb05a657e", "value": "3072:CuBo+B5V/qEt/XPgK0xhQJ/AcSli/iUr3oHFdq:CcnyxGdSCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980277, "uuid": "6987856f-0263-47bb-b1be-b7c6bca555b8", "value": 139736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980277, "uuid": "a58cf44a-85d3-4945-9094-b7acd0c7cdc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980277, "uuid": "68a2a03e-cbb7-44b8-a16d-ab40677462dc", "value": "ub8ehJSePAfc9FYqZIT6.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0304e6c4-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034724, "uuid": "77c11d24-8c03-4e91-8741-0bff29393d58", "comment": "Malware payload (Mirai)", "value": "da3ef06b6326a05bc71a8c93945e4d60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034724, "uuid": "109dd30e-dab0-4bab-a8ec-276c0535b13f", "comment": "Malware payload (Mirai)", "value": "105e02593bad28306e810b5c3ccfd4f3c76d8b1bb33e0dba4540381289ab8bda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034724, "uuid": "edc96e64-c703-4adb-963e-3d30f038d510", "comment": "Malware payload (Mirai)", "value": "d852927709637f319bc8cbeff386d6234b13b64f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034724, "uuid": "725e868f-e035-4266-bd96-55b303c45705", "comment": "Malware payload (Mirai)", "value": "67589289cc5bd667831ef5f9afaa45fe9e6f8026c888cf5740e30ad52f8a844b2f9d4c01b097393d161c1bc7562525d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034724, "uuid": "e3f7209d-748f-4607-8c09-f61166a9c168", "value": "T1C3839E37E4255E54C19189B034F58E391F13A2C882973EBB5AE5C6B86097D9CF601FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034724, "uuid": "2730644e-f81a-43e3-838d-f2e82b9be693", "value": "1536:0agENhFLMgqNw6EWOcrKCTp37SK7riCOMImF7MRA:0ebLl56DOcOC5p7riqJARA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034724, "uuid": "45c2f9e6-41d8-40c1-9467-9825061a8e00", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034724, "uuid": "bc930276-9293-4cc3-bf5d-c9287173ea4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034724, "uuid": "c5266d27-8f16-42eb-a912-33dc688ef1a4", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9114a029-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034962, "uuid": "723fccab-6d13-4516-ba1a-46d1938c5a54", "comment": "Malware payload (Mirai)", "value": "80ceb0ede77151e6987e6ad6b048bc4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034962, "uuid": "e60ac4f8-a9f0-42b0-94ee-892341d1c86f", "comment": "Malware payload (Mirai)", "value": "10a06336fbd2fb352d25b78d3d91c1fb5686801ac5a433a1cd06f8deceb79ce0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034962, "uuid": "83e206e3-8c2b-4ed7-bcaa-1adf7207d2fd", "comment": "Malware payload (Mirai)", "value": "24cd3ee9e1e821023f492df9883fc5313cbd35a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034962, "uuid": "bfaa517a-d5fd-43a2-865a-33c2177d3fa8", "comment": "Malware payload (Mirai)", "value": "d4a26278ab45f6ff88bd28e53d5c1847e1ed7a3e6b8ab7911a6d1e1947b8a6448101156603ba633e17674db09466e64e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034962, "uuid": "e05305c5-7e75-43c0-9d7d-192c0e8fd615", "value": "T18C937CC0F683C4F2E84705B1507BE7379B32F1B9101AFA43D3699A72DC91951EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034962, "uuid": "d7dce1ff-4257-4813-9d9f-e4f8229d4240", "value": "1536:W/QCZaxGdvts3i5JPho0sxPu++4HRsUIKqI4FrS4LSI:WYCZa8dvm3oJPhpsxP5lR+KfUmDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034962, "uuid": "d32a0a75-0334-4e6b-9e90-d281fc9885b1", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034962, "uuid": "8453a0e8-1080-4b30-9216-4f4840336cf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034962, "uuid": "50dededb-0490-40f4-a9da-2498d0d17d29", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61513dbf-f6c2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768997516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997516, "uuid": "d2694b71-c966-49cd-93c5-e36fe8517bb2", "comment": "Malware payload (Mirai)", "value": "cdd6da27a92ec1cc7ce07214d1479f04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997516, "uuid": "0741d0da-1890-489b-8dc8-7aeb41fc0afa", "comment": "Malware payload (Mirai)", "value": "10ca4e5b561e13068d524bb4f0cf674af0bfc084b6aafc56e78495175e76c635", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997516, "uuid": "881503a9-6808-4f5f-ab44-b39a6a135814", "comment": "Malware payload (Mirai)", "value": "80573e39a378ca57bc1e17c9b5dda1ca7b7907bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997516, "uuid": "f8f18834-c59b-466e-a9c9-7435c4c217f6", "comment": "Malware payload (Mirai)", "value": "3495be4c88279c689f65a744cc07873275e3d92ca3cd1ec1536454274788eb1649d6ed196f401b6c6e289ed4ec217c10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997516, "uuid": "0a88004d-5540-4139-81ed-3b5cb5e79bde", "value": "T1BC243B569A414E13C4C22BBABA9F424533339B74D3FB73069D286FB43B8765E0E67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997516, "uuid": "70d76e76-2caa-4c4e-8181-8bfd3abd42c8", "value": "6144:I7aDiH/2LXgha26kgovOjpaG2ATiyVUhAI8ZBJfhQHxXM/91qz/:Qa+H/eXlkgo2jpaLATiyVUqIeBJfh0c0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768997516, "uuid": "bea859a7-2801-48ec-9ce1-acc08d28bdde", "value": 216539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768997516, "uuid": "e51ad7b0-9f42-4e59-b083-2da10a12a61d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997516, "uuid": "b4bc3565-1017-425d-a1cc-734c594d7b68", "value": "goon.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb829652-f718-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769034685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034685, "uuid": "15962bdf-9783-4c2d-a4e9-7785d4d421ce", "comment": "Malware payload", "value": "3651a5e97a8f13aa4a50616ec8488eb2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034685, "uuid": "e83bd264-4427-44d0-aebc-aa978ef4ea5f", "comment": "Malware payload", "value": "10d80a08e4d90e32213746ab214b61840a1ee9691adbe78f6b90d9c8b470707c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034685, "uuid": "cec4686b-d55f-441c-8599-2372f7e7c5a5", "comment": "Malware payload", "value": "8f1349232a9b451efc329f249ee30be5e21f31dc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034685, "uuid": "26c352b2-6f04-4045-83b7-8807f78d567c", "comment": "Malware payload", "value": "4f347c20ab73b079c6a6a421824bf5925a7543deaf497baa56a8ac061f9f004de323e649722a946b3bcceff879569544", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034685, "uuid": "d125d33d-180a-48d3-b5f8-acd92aa66a83", "value": "T15BB012A43409F4008C3A444CA0FC927040C480922B7AD54AE575820D0807D0530B4D00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034685, "uuid": "05286b55-fe65-42cd-981c-b555ce47fe20", "value": "3:GRFbdolLCDdNDM4A2jERQGw1vGE9XLyO:SbSluBNA4gQBIaXOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034685, "uuid": "2fa8a2f4-6c16-4760-bf11-eef0f5c57f9f", "value": 93, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034685, "uuid": "9305dedc-05cb-4376-a0ca-0dbb779e8c2d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034685, "uuid": "8ab45bf8-1d97-4f3d-aa4a-ceaa0bf4ae01", "value": "fernisafuckingddosbossfuckkrebsandshitlabs.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885b335b-f6a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768986415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986415, "uuid": "09d4a1cd-ecd9-4b9b-8159-af960918c6ed", "comment": "Malware payload (Mirai)", "value": "62cc1b325ead182a638878b2bb8fe425", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986415, "uuid": "36d59d28-141d-4289-8f03-43daa8c31405", "comment": "Malware payload (Mirai)", "value": "10dce218e09b7a67f92b1aac738de427172936788b2d16326667ea9481dde903", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986415, "uuid": "7ebc45ba-0d77-4c8a-945e-fb876a7405ee", "comment": "Malware payload (Mirai)", "value": "217887e9329f1a97a51f8b1d2637b24c55e3535f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986415, "uuid": "93aa2a56-d6a5-475b-a6b4-9896b146678a", "comment": "Malware payload (Mirai)", "value": "ad999be29ed5889fcb8f3f07df9a0697918e849043fdd7a5d22decfbb4618100ef10c01fbc1ff70e0149e07e8776be0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986415, "uuid": "e39af528-a65e-482b-99bd-364b18aa61eb", "value": "T1C3C35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986415, "uuid": "08458a04-478c-4e39-a5ab-f7a29ec37209", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiyww:VoRNjmj1VGFVrRiyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768986415, "uuid": "4f3ad7c8-b583-4003-be16-cc4fc40b5081", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768986415, "uuid": "750250d9-0b0b-48d6-8fd5-dc4cb9122ec2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986415, "uuid": "8bb26793-9704-4f51-9d9b-088f355a828d", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af139921-f699-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768980037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980037, "uuid": "1c37c16e-19e3-4d22-a0ee-033b509f73f9", "comment": "Malware payload", "value": "c28a655a2921de94472ba022abda5a11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980037, "uuid": "1c4e5e5c-8cfd-4846-979b-5598fdd28a57", "comment": "Malware payload", "value": "115ee188d3c16f19d9a117696bbca43211a7debd7be89a9abdc71f04d1f07a65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980037, "uuid": "a3203060-edbb-4fbc-a510-731e5c4540c5", "comment": "Malware payload", "value": "0810475d91b36e313ca8acc4aa617f9546a5f503", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980037, "uuid": "64f325d9-3a0a-4988-bd05-05a8b73499cd", "comment": "Malware payload", "value": "30ea4b09f984ee6dbaaa88e00289cd86fdbb19a346987dc04ccb28e5f3a5534a88b99b01a7997def9ef8eeef472d4741", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980037, "uuid": "e84a71c0-b5f5-495d-8335-de5687e0707d", "value": "T1ADD733E46AF81CFDF503D3B25EB9A444E88A7B70F818ED09A2A6FA060073F49575D41D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980037, "uuid": "7952adb8-0c03-4ccd-b222-462247073024", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980037, "uuid": "d8cd40ed-3240-442a-964e-d41c8e108368", "value": "1572864:IinxsSuUYpyhC0v5DUVIgIwpw7TE+oRG5o+h:IjSuUYpWB9gI0mjo05o+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980037, "uuid": "abfb2274-1c83-40c4-9c3d-e59f626bed6e", "value": 63215788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980037, "uuid": "a4364253-574b-4bab-993a-0f898660db24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980037, "uuid": "44d18382-cbfd-4224-9108-509cd1469afe", "value": "LINEwinSet_znnx_NjXS_202601018.111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c8b9f0-f6b4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768991423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768991423, "uuid": "a9f49952-e6fa-4597-84d8-debf6ff83800", "comment": "Malware payload (Mirai)", "value": "852dfb39560f30a51c0a5738c1e4bddc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768991423, "uuid": "c87c72a3-b4a2-435a-b099-6471fc03d15b", "comment": "Malware payload (Mirai)", "value": "122412e873bd547ed39286ce1c650a2568fa2166c917aece208c823c4c04cd18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768991423, "uuid": "ceb42a11-3f77-40e8-aabd-18bf411bc59c", "comment": "Malware payload (Mirai)", "value": "da78f90e2536d03abfb03820d74385889a89d511", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768991423, "uuid": "a72f541b-16f1-4eb1-a6e9-b4f8f138a799", "comment": "Malware payload (Mirai)", "value": "59d50bc1ba9b407bedcba696d33bf938251e3553e854cc89f49b3c9bb241af86296999e02d441a745b2f6ac326814791", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768991423, "uuid": "05a04eb8-c0b8-4d0f-a0ca-6761df9aeda2", "value": "T1EDD3CF32E0086DA0DD2116B4347659BC0340DEB40BD59243EFBEE5AE28B7DA57DEDB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768991423, "uuid": "51606a28-dd58-47b4-85fa-b9633e8be77e", "value": "3072:kNulV+GOAc3YSmDEjdX/VuHVv3WDRGGRhaUNZkP0ZKa:yulo2ubIVv3sXL5NZmOKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768991423, "uuid": "d702924c-1ff4-4852-906c-3b63e9a7d40d", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768991423, "uuid": "269b7c67-ae61-4bc5-8b03-2a72e8bb6054", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768991423, "uuid": "44887b13-6600-4a8f-b517-8736884bed30", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf1c4bd-f6d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769005426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005426, "uuid": "726959dd-d90f-47e2-87fe-c3295f6af267", "comment": "Malware payload (Mirai)", "value": "036206014f57726e2606b7f030cb19d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005426, "uuid": "587de8d4-0527-42b1-90db-0844194ac17c", "comment": "Malware payload (Mirai)", "value": "1263a13ad59d9d864514f0e0b0c8992ab79ca07fb8f86f9bdcec473700d284ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005426, "uuid": "af697751-b282-4240-9d56-7fd5557f43c9", "comment": "Malware payload (Mirai)", "value": "aae8e75e967c00396322d4d2b973b7115b04be92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005426, "uuid": "5eb6586e-049b-4960-955d-8ffdb39c99a8", "comment": "Malware payload (Mirai)", "value": "835ba66065587255bc17445b9ded39155e819d09b554b494e10929da2f02f70f11e42c50720c9d16d57236b14bca89fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005426, "uuid": "bed3f86b-9095-4dc0-9483-826e729f4e52", "value": "T1B263E996F991DB11C6D196BAFE0E51CD731307B8E3EE73139D146B242B8B86B0E3A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005426, "uuid": "fb3f7c19-4c9c-4d84-b6af-1b0f025b1a07", "value": "1536:H9nW1xEfNAEYwzsyK0wsuS3k8mRMRrSglbffMXiLDrX71um57wL6YET2bVR:aEfNAEYwzX3kMDNDrX71um5EL6jT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769005426, "uuid": "393b91e7-e927-4378-a5c4-45c4bb09d6ae", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769005426, "uuid": "ed19ad9d-dc68-4ded-a2ec-d337b8c9e435", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005426, "uuid": "af72613f-525f-4586-adca-35e8c4c2ff7b", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e31c4236-f6a3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768984419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984419, "uuid": "5417aabd-7a59-4915-82fe-8c20e8603598", "comment": "Malware payload (Mirai)", "value": "b7e40a411f3c95581b82a0bd718c107c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984419, "uuid": "77a97531-16bf-4e77-bd63-63d8c2337c51", "comment": "Malware payload (Mirai)", "value": "140a32f9588875b6e899c3aeb5bc8febacb2a8dbde360f336d1f5133952600af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984419, "uuid": "9a32bf0f-3c6a-4d9b-9fd4-11b62a49e358", "comment": "Malware payload (Mirai)", "value": "429f03db285bcec81aedfa8dab3f922958b08845", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984419, "uuid": "ffa1aff0-1f0d-41f7-b97f-2314582924e6", "comment": "Malware payload (Mirai)", "value": "2c6812cf2f85d489119cb4cfb99ce62621beb91a2920b3e026447eb14a48ab2c8cc64831da90bbab3576df4b1fb428e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984419, "uuid": "18ba32ea-3992-4dbf-9c7a-a4d0a04d559a", "value": "T110B3399DFA8BC1F5E85704709076B7FFC732E8145061CA4ADBAAEF31C933441962A369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984419, "uuid": "bfa456ad-2cbd-43a0-a9cd-09c81dce741d", "value": "1536:1kgY0xrx37/IGvbUkxNqlHgoklWJWySeYDH3gbhB7raQw0X:CZ0dxXRVR5vDH3ChLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768984419, "uuid": "208c7819-ae02-4ae7-97a8-b4bee2ffa69f", "value": 110028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768984419, "uuid": "85d351ae-ce1e-4b62-a7f5-7a2d8a74d4ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984419, "uuid": "0f8967ef-188f-4e32-8193-97a71c9fe9de", "value": "Orbt.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7079a33d-f6eb-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1769015151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769015151, "uuid": "1cfe7ff7-b823-4bc6-a1b3-df6477feedbc", "comment": "Malware payload (ConnectWise)", "value": "d85c7f5c92a85b87b730f258e566c9ed", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769015151, "uuid": "2fd7e62e-9772-459d-a805-58cbf411c4ad", "comment": "Malware payload (ConnectWise)", "value": "145731dbf63faf8c9f47f31278a8c89553f659649f6234e9665b01970cdfb0c5", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769015151, "uuid": "444a7f13-3af1-42a2-b1e4-2a35248c1468", "comment": "Malware payload (ConnectWise)", "value": "1169693e137c13602c0c75fab17c5b97b58ab43f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769015151, "uuid": "16876a98-cc31-4a89-b92e-4c9bb8018901", "comment": "Malware payload (ConnectWise)", "value": "478a0fd3e383b3b2e5f7e6c0c8eed04fd0cbee46cadcd5db0fab57664e217cbaeabaa23b22171ea9c280235c0dbdfa5e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769015151, "uuid": "b2b20ed0-049b-4f07-bbf2-5d0bcc1b5d92", "value": "T177A6237127F88429F1A75B39EE3A89E229387C64DA26C05F17B43D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769015151, "uuid": "da445e96-96c3-464f-a221-e745b3ea71f4", "value": "196608:tKaLNkbgHi4QUKaLNkbgRKaLNkbgjKaLNkbg:BWgHiHKWg1Wg7Wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769015151, "uuid": "0290787d-d480-45e1-b978-67d42848bec3", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769015151, "uuid": "a796664f-c30f-4b24-840d-a76c28d8d2b8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769015151, "uuid": "4d85fec9-170c-4b01-b5e8-b4ea34e59b1d", "value": "Bid2026InvitePdf4553.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a75a1a-f6dc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769008610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769008610, "uuid": "d7c38820-51b7-4e3a-a9af-a618b700fd54", "comment": "Malware payload (Mirai)", "value": "c105c9b15c162c7a8ed0f15de82cca6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769008610, "uuid": "7d6b14a1-c7e4-4a5b-8eec-541547dfec3d", "comment": "Malware payload (Mirai)", "value": "14df9e89e70e45852c1a544d7f3e14e174980a5af700984745166a609e7af3b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769008610, "uuid": "98d8c764-1003-4fac-9811-97d5de2e2837", "comment": "Malware payload (Mirai)", "value": "0f4d86c15e65a77f8629e593e2b8b35f3e718c78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769008610, "uuid": "16e34800-272c-48ff-962a-27b8df4c1952", "comment": "Malware payload (Mirai)", "value": "9a975a5974019e6ddb80cf266bf274bae6d1dc577b75ac7a81ec973f77a98e8ad0e668518f1be71da893fa09b52696cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769008610, "uuid": "3e8ccb25-7c75-4cc4-b759-9682d233557e", "value": "T1BF04881D6E228F6EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769008610, "uuid": "0f3cd5ce-bfe8-41b9-bad1-fe383ea3ba9c", "value": "3072:jg57RM7LHZwbq1YSBan1yvbysxr1uGS9I:jglRM7LHZ0Bqyy1BS9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769008610, "uuid": "ebe2d4d5-8518-4446-9669-979e30745c1a", "value": 173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769008610, "uuid": "a8f15d4d-4b7b-46c5-8bb0-2b04d78808e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769008610, "uuid": "c29591a9-2feb-40ea-970e-7e358c68a04a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08035110-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034732, "uuid": "3878bfc9-78f0-4d92-bd68-8f0dfd42c1a0", "comment": "Malware payload (Mirai)", "value": "44f20463f2f8fd5ac5189e86dbc024a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034732, "uuid": "ad287f7a-a095-4d73-80bb-710cbea8f037", "comment": "Malware payload (Mirai)", "value": "155a361e94b6bb078a0032b2bf24f0e862390fe0f23202f9c15407a875b56a73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034732, "uuid": "cb6aad3f-1581-4da7-8e35-cf39858460c7", "comment": "Malware payload (Mirai)", "value": "aa2a21d83cd5c711b35ccc222f51fbb0271e46ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034732, "uuid": "a3c2bd79-4548-44a4-a8e0-654a61c651ca", "comment": "Malware payload (Mirai)", "value": "16e09c83bf8a603e7ca7d13f6c77f933bdc350f9951c1c7a10c16dbb2e5d41897fb8de7c40eae202a8e145b087583d22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034732, "uuid": "5a4012be-056a-465d-8739-d168890f69f3", "value": "T17A042945EA404B13C0D627B9F6DF42463333AB9497EB73069528AFB43F8679E4F12A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034732, "uuid": "5e4db025-346b-47c3-88d4-0efa07d59d79", "value": "3072:OLe6vhfZQIvuCeeuaMuTuRez43IVILqZQy38YhTfYo+M/RgDlplLn:ee6vheIv1ruaMuTuReErLq738+x+M/Ro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034732, "uuid": "d0fcef7d-e24a-417f-8e6d-8006b8a85b67", "value": 181474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034732, "uuid": "2c3c4653-75fb-4fc9-abcc-5aaab5fd22f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034732, "uuid": "545fdfc6-09db-4087-abe2-d4bf8c3fac1c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4b8fc5-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Ngioweb)", "timestamp": 1768998637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998637, "uuid": "0131289d-4bb2-4354-bd5c-5633cced951c", "comment": "Malware payload (Ngioweb)", "value": "5080304f77bd1fd8738d06889d342b32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998637, "uuid": "c06f653d-6de8-4676-a31b-6d2d299e82a0", "comment": "Malware payload (Ngioweb)", "value": "15e146a2bd207c6733e053661759d899cb35fe89f7886834bc49f1293dfb6f6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998637, "uuid": "87501b2e-3de8-47ba-81d1-25b14aec561a", "comment": "Malware payload (Ngioweb)", "value": "d6a805adfc551c5304d82159bee87b74d3b63c29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998637, "uuid": "24fa05f8-ac14-4d67-a7ce-785007053a84", "comment": "Malware payload (Ngioweb)", "value": "e2722cb4dd024d5bcd6b678654d110e878aa3f79c87517b596ad105132778eace705916798cd42b52ad042cef2c1da51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998637, "uuid": "98d6e9dd-ac78-4a69-9917-142481df31ec", "value": "T1947308A5F480DB72C6D5257AFA4E428C73630B78D3D932028D15AF3527EB9670F3A906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998637, "uuid": "c3ab068c-ef0f-4c74-a988-8d636ff059d9", "value": "1536:fzyRI40guVjpJom4Cefy6SSuMIC+5x/PS/4zNnTDpCUxZKO1QZONlO+KOZ9+qIr:fzye40guVNJom4LfyrS859S/CNTDP0WK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998637, "uuid": "fed5e93a-a6dc-438e-87c1-17622b76b439", "value": 79268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998637, "uuid": "7fa61563-066e-4c53-b940-9f6fb93e6559", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998637, "uuid": "b0bd363e-5ffc-4501-b560-aa636b513a0c", "value": "plasma.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff140fe7-f69c-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1768981460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981460, "uuid": "ed787cdd-820b-419f-8105-63a5d1ea43a5", "comment": "Malware payload (NetSupport)", "value": "d60e21a0a247de4acc756304bde52aab", "object_relation": "md5", "Tag": [ { "name": "45-61-148-43", "colour": "#BCAF9E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981460, "uuid": "5a1ae083-d4d4-430a-9b6e-63298f5d02f5", "comment": "Malware payload (NetSupport)", "value": "15e2af6e562edf3a86287b415948810032f631d38f0fc52f131c7f2a61873108", "object_relation": "sha256", "Tag": [ { "name": "45-61-148-43", "colour": "#BCAF9E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981460, "uuid": "7d49b254-f169-4515-b00c-4070cc069ecb", "comment": "Malware payload (NetSupport)", "value": "2df73b6a3f5d9807b39d6d4824b75053749ed8d5", "object_relation": "sha1", "Tag": [ { "name": "45-61-148-43", "colour": "#BCAF9E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981460, "uuid": "8aae4eef-6a84-4f4b-be17-2116d5471456", "comment": "Malware payload (NetSupport)", "value": "35b9a4db2049590c7d5b19c6f283996527c8b8dcb362633ce14494af06d077716af48ea32f15d780f5c0f5131ce53884", "object_relation": "sha3-384", "Tag": [ { "name": "45-61-148-43", "colour": "#BCAF9E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981460, "uuid": "f4cc2e45-5b6c-4687-a4df-f65b007b0ff9", "value": "T12272D0419BCF3A13C0980EFD4AF207058667D4032D6F5BCC1B4079165D9E7AA2E6792F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981460, "uuid": "b80447c0-e6bd-45b3-9105-8c90d6d69bc9", "value": "384:IDSsNjzI0WQMYWfY5QGVOihKxz8h58KAcLxAvEDXHbYlPl8X:e35vWQMYV5QG5kw8UxzD3QNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981460, "uuid": "5d69e6fa-1b38-4d51-ba94-f73ba5dd6f0c", "value": 16673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981460, "uuid": "c7f2650c-5447-4c07-94df-a304345fe2f0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981460, "uuid": "9ec87728-e5de-4677-b914-dba51f91b9d5", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea45d9b4-f6bb-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1768994739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768994739, "uuid": "f9301eac-37f6-487e-b1f2-b1a7988a6bd2", "comment": "Malware payload (SalatStealer)", "value": "1e5ca6d7ad833efab864c01b4f61cf02", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768994739, "uuid": "63fa7b0b-7b8f-4cc9-86ed-db701b957b60", "comment": "Malware payload (SalatStealer)", "value": "161c80bdff3ed5e231a89f2741a5f01c346520e829f6992e44000e9aa64d11c1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768994739, "uuid": "80d23523-6a68-4607-b48b-df8923c3bb60", "comment": "Malware payload (SalatStealer)", "value": "0456519fe91827f82226afeeccde22ef018d1b43", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768994739, "uuid": "e1f52765-8700-4f4f-87ac-1a287c9a8946", "comment": "Malware payload (SalatStealer)", "value": "a9ce5299657044696bcffd5b177c3513914a1b0473d8774c596768bd23319152a8dac97b817baf60b92ef32714876241", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768994739, "uuid": "35118f80-96ca-4ee6-b115-236211b58c74", "value": "T127E53335BB059982FA589372AD2D967B991033D04844BD726EBC7543AB77C8362CBF0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768994739, "uuid": "6fe3834b-3843-4b18-a99a-405eb4158966", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768994739, "uuid": "f65faad9-7e29-447a-805f-4beb18aca015", "value": "98304:ATJS4cMPPc8PBzWnTyvu1eu11X/NG0RgObnz:ATJqKPTPER/VRgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768994739, "uuid": "0cd5a397-a8a6-4d7c-8050-cd59c0bd5f3c", "value": 3296768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768994739, "uuid": "94a04e50-fd95-44f2-9e3d-29e20b0855a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768994739, "uuid": "9e1e2ba4-d23f-4118-bacd-0b5f8841c5bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "190984e0-f6a0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768982792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982792, "uuid": "92a60fd6-eb55-4b36-aa75-b8677b34a523", "comment": "Malware payload (Mirai)", "value": "17f93177f5733902d6cb04a9ce1e4996", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982792, "uuid": "02f0e388-fe34-44db-945d-57dff3add743", "comment": "Malware payload (Mirai)", "value": "1814fe9a5d6f9e23f5da4b3e43828d008c24639df2d0f84318f03dd0e5e0a008", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982792, "uuid": "0fdba3d3-beec-4141-b394-b903704e6099", "comment": "Malware payload (Mirai)", "value": "46e167e6b9b2062777300eea406e2611227ab6c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982792, "uuid": "08e518c3-8b93-44a3-9c7a-dd5230e58404", "comment": "Malware payload (Mirai)", "value": "2b03c694e5dc1ac83bbc29a9addfb3ff76a82d48dce38992cfcb3a42c86636d0a72babc981e3d9f98b432d15ca07acbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982792, "uuid": "f6eb4118-1137-4355-9146-f17d771d1966", "value": "T1FE33F221675FBBEAD4702C3756EC6F0B992E87EDFD6A55072040863010FBA6F34A9847", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982792, "uuid": "ee5a7d74-7d3c-483b-904c-9c58fc1f1dc3", "value": "1536:EI0+pRQDklL1DLk2KEWMyzeQOS8EPAUnn8N0bXTuCr8WsxKADZzXLY:o+fQDaLEjMyiKPB8eLTug4hDZzXLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768982792, "uuid": "79eac150-c219-4f28-8975-b37f6e00efc2", "value": 53656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768982792, "uuid": "4fcc9278-4519-4366-9aa9-490584bebc03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982792, "uuid": "67a9f6bf-e2b1-417c-9661-8e8301e2ec35", "value": "ub8ehJSePAfc9FYqZIT6.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c815e0d2-f6cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769003272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003272, "uuid": "87244ae3-0674-4fcd-a586-39522b2b5e88", "comment": "Malware payload (Mirai)", "value": "d2f758f76729284232de5f12fbecb06f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003272, "uuid": "978daa41-69b3-40c9-8706-5df4ba8958fd", "comment": "Malware payload (Mirai)", "value": "184b8c9a378eaaa2bae82035f11e4097a5763e1467334eebde29a10036715774", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003272, "uuid": "bc30a0da-848c-4110-a536-c760ad89a222", "comment": "Malware payload (Mirai)", "value": "0b69f54cb6639dce8168e11f78aef8c66a591a76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003272, "uuid": "e8850731-fa30-4ccb-a8e3-b5e6c400f57d", "comment": "Malware payload (Mirai)", "value": "6af5bd40997e3ec39a8844158b0dc16c35bea4f8767941c6210e118d38ac9698d54c6a81b8a504973e6247671c113d52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003272, "uuid": "6065d062-7a5a-4619-b1e1-964fb7093c32", "value": "T1C4A3098ABCC5C712C6E061B6BB1F51DE371643B8E3EA7103CD18AB29675B9570E3B250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003272, "uuid": "04964ca3-4c3d-4cfb-ba96-621c092ddcb3", "value": "1536:zDhuC+Oot/54I/AjTg6704RA69Rd8Lrq7FTfsBHl8vQHnJ2T2bVR:zFT+3tT8TPK69Rd8fqpTfU8vQHJ2T2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769003272, "uuid": "cf67e46b-17c5-4152-9aae-d8387ff08831", "value": 99540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769003272, "uuid": "f1edd1ac-2e49-4129-addb-84b334bbc190", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003272, "uuid": "f2834b8e-6609-43b4-8225-0014ac044f8f", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8138d9-f71f-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1769037637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769037637, "uuid": "f23b9733-bf05-470f-929f-2187a3f77cc9", "comment": "Malware payload (RedLineStealer)", "value": "dddc14c3a1bc942e3219b311b3c688fc", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769037637, "uuid": "914312a8-5754-45f2-a518-1e951844dee3", "comment": "Malware payload (RedLineStealer)", "value": "191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769037637, "uuid": "e771d499-0f81-4481-8b2d-ee12a9f350ad", "comment": "Malware payload (RedLineStealer)", "value": "017b79496bacd9cec9eaa8e4461611675f0f6e3f", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769037637, "uuid": "0473d6af-3633-4dc6-8b5f-7fb2cffd5f1f", "comment": "Malware payload (RedLineStealer)", "value": "abbc94978b5adc99a42439eca1b2002623588055d89365720c6163d281ceb8b7d5afe2f7c4af3f2f9392797bfe8f2bba", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769037637, "uuid": "6e8fc653-f09f-4a19-b2e5-aad6ad7cdcd6", "value": "T11FF5F113B2CBA03EE45D0B3B0572E17894FB6E556523AD168AE48C9FFF250601E3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769037637, "uuid": "266b5e91-fe7e-4afe-bf64-0c70dae2ea00", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769037637, "uuid": "c6bcd0a0-f0a1-4c41-a133-bc9c5fc5e9b4", "value": "49152:1+MRdOHlNrOToziVHPPNLxeJLBZ9FMXX2Sa55NLuQdOibFJfZmgTxo+a7yO:1ryrziVtLSFZRSmaQdNJRTamO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769037637, "uuid": "d49b5b51-c050-42af-9d71-e7ae2a8bb098", "value": 3483865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769037637, "uuid": "846364f8-7d5f-4caa-85e8-8d438235a2eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769037637, "uuid": "92796107-2334-4ec2-9a07-5bd4f56de2b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7033699a-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034907, "uuid": "e0084f1f-0209-40de-b819-e031c6dabd86", "comment": "Malware payload (Mirai)", "value": "81481c6021e66ba88893311b8d294d36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034907, "uuid": "f0027622-bf6b-41d5-8b0a-e3466bdb842b", "comment": "Malware payload (Mirai)", "value": "1a5a9c16ffb10732468c63adce73c8d97117a701b17646bd6b18c868ccf3911d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034907, "uuid": "78df210f-b792-4494-b8c0-fd6c609842eb", "comment": "Malware payload (Mirai)", "value": "4e42ec28bfa7b38dea3f9b6312dff2acf9971298", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034907, "uuid": "1430cc80-1592-48f7-97a5-70a85c96e3ff", "comment": "Malware payload (Mirai)", "value": "211e92b67bf672cc7fe8debe9ee7f3b3ab54b57c858a138632e9f08f08a22f552870e03416581a45d323025582b37159", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034907, "uuid": "512f187b-67cd-43c6-9f7d-c55521fdde23", "value": "T13BC3BE36C428BED4C0914534B4B5AD361B71B2C442531EBB2EE9C5B91087EB4FA0AFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034907, "uuid": "d75a4b87-1e3f-4cb5-9eb0-6157d3391b5e", "value": "3072:Eo6ZpEKYxvrHyMQ5+xe53L1X3hJKz9EqTMaz6:E7ZWNHUlLlhEHMaz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034907, "uuid": "82e3e63b-fc35-45c0-8150-90b8e8b942c2", "value": 124428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034907, "uuid": "c3ed7c0e-b02d-4b14-84c0-d2b156c9c781", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034907, "uuid": "80e2620b-52a4-48a0-8ec3-c1916f9bafcf", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4452a5ad-f6aa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768987159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987159, "uuid": "10b3d65b-4cdd-44e2-8ab2-8f7b00b89282", "comment": "Malware payload (Mirai)", "value": "e15cf704789560029e1cf8dd9f7bd2d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987159, "uuid": "6c87020c-8d3c-4fff-9843-7a3dd1b6469c", "comment": "Malware payload (Mirai)", "value": "1a8229bbb021a7323c31f6afa07664eb33cfbfd0d89ada0801b5f9f607a7459a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987159, "uuid": "5c083320-f2fe-4cfc-8b72-8cf5f0414e8e", "comment": "Malware payload (Mirai)", "value": "4d1416cc2eb87d66bd2e91b68d19b7695ddb1766", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987159, "uuid": "57602348-0d63-4fbe-a6d7-7a8f2c151eca", "comment": "Malware payload (Mirai)", "value": "bf7bb35caca3c85784adc67b884422400efbb01480a15cba6ee6b932e7e6cadb33a424b1f06751569b2ee67dfb459a34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987159, "uuid": "49239a79-cdd4-49c1-ba5e-f2a7c96c6ea6", "value": "T1E4A34985FA83C2F6E81704306062B73FC731CDA580B9DA59DB9A9E35CA37541C7263B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987159, "uuid": "e0e8b4e1-d90e-4423-889b-78830de51dc6", "value": "1536:/+xr9S54MRhvQ3jfHxRa36iZJvaAH4AWkSjIyIK:/+xrMmuQTHxk6iZJ94tjjII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768987159, "uuid": "adc0e93a-084e-4572-8263-fce212aa3d55", "value": 97768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768987159, "uuid": "5138fe4c-34ba-4731-89af-b5b077b3dcb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987159, "uuid": "af0cf9bb-2811-427b-bee2-ea616672e32e", "value": "ub8ehJSePAfc9FYqZIT6.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c8239b-f6a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768984748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984748, "uuid": "da0516da-fa7b-440e-8f49-fcf7ec20af39", "comment": "Malware payload (Mirai)", "value": "ba219db0d5caa440c2bc37d48cf28796", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984748, "uuid": "88ea7e42-24c3-4478-9d3e-75b99446ddff", "comment": "Malware payload (Mirai)", "value": "1b006631bebae3f724055e4d835abea40399bfcc2a517d235731527db9904a5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984748, "uuid": "77dc8b80-d8e4-4780-83c5-c17c622b10ff", "comment": "Malware payload (Mirai)", "value": "4cc6362e774d2bc345f4858f397d77831bad5a50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984748, "uuid": "b7701aab-f8e0-4069-ba66-7036ebf1b694", "comment": "Malware payload (Mirai)", "value": "fb08f06ad2322dd76e68cb7ca389cafe93175676e5046d99cd37b490e5f8483ba5e68ae13ba0680f1a1eba7aa8f696ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984748, "uuid": "1b313300-4062-451a-842d-63db76c61da2", "value": "T12823022490FE4DB9C7E1E9383AA0937037D10B4777E7CBF5B6A52A50D606BDAA3051B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984748, "uuid": "1b695f81-c3cf-4645-9758-d600263645cc", "value": "768:CW0VVC57RgvvDr9vqPchF3hzV/AYqoTi3ZtlFkFaFrheFpnnE4mq4uVcqgw09l:BNgvvP9iPchF3hz7EzLhenEK4u+qgw0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768984748, "uuid": "30fb0597-89b4-4cc4-b16d-f5d9dfcf43f1", "value": 48140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768984748, "uuid": "2f880601-313a-44a7-9fb1-1d7492030373", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984748, "uuid": "c75d3c28-6843-4454-9541-c4b8d87d1f30", "value": "ub8ehJSePAfc9FYqZIT6.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d725809-f6aa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768987175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987175, "uuid": "6e9378e1-22ed-4feb-8376-b489b2d2bbf5", "comment": "Malware payload", "value": "21157bae78c922ca8e674a3f59b7ca22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Ring_-2", "colour": "#2110AB", "exportable": true, "hide_tag": false }, { "name": "SMM", "colour": "#0F412F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987175, "uuid": "734939a9-cd29-4c64-ad6c-5efddbc79a8d", "comment": "Malware payload", "value": "1bb55c9f08f46ca63d8c388ee79153e4e4e6820b66c638332d83cb8482ef663d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Ring_-2", "colour": "#2110AB", "exportable": true, "hide_tag": false }, { "name": "SMM", "colour": "#0F412F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987175, "uuid": "618426fe-df89-4405-9c14-f465035c4d50", "comment": "Malware payload", "value": "3413419ab0fc53d3f4c6156599f2c306a04e985b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Ring_-2", "colour": "#2110AB", "exportable": true, "hide_tag": false }, { "name": "SMM", "colour": "#0F412F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987175, "uuid": "0e5176d8-df5f-4cc5-a3ab-c4e4e39ef6ad", "comment": "Malware payload", "value": "3bb457c1a3da26e5cbcfbae1ebe38bfb781d6491e454c8063f47bb1d6f25eb53f64ec66948edce7a30dd16fdc3318a2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Ring_-2", "colour": "#2110AB", "exportable": true, "hide_tag": false }, { "name": "SMM", "colour": "#0F412F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987175, "uuid": "1f828444-1efb-43a8-9f4f-b0f51e696d70", "value": "T157541990F545FDF5ECCA8BB410D2230993A9F0819B1EEF2F6520FE3C055EA98997354A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987175, "uuid": "c8c9ce79-9882-4613-b3fd-3e2340edc63a", "value": "3c527ccb0eb6ee6338832387cc346c0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987175, "uuid": "3933c62f-c352-4adc-a66a-fa464abac5df", "value": "6144:yAmA2S+RKnkb2RuH2RKVuniEMHyYiv7mogOKnAq3AuS:CCvkSIWQBwXmBb3dS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768987175, "uuid": "830a6cf6-39c9-46b5-b932-f1c0226d7b8f", "value": 303909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768987175, "uuid": "0b41dd4f-80e4-4693-bdc2-f103a6a0e85f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987175, "uuid": "9dacb38e-a697-48ad-bdb4-a46514356e6a", "value": "elevation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e9c71e-f688-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768972506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768972506, "uuid": "dffdcf60-cc3a-4fc5-9507-e3b989867c63", "comment": "Malware payload", "value": "be5a2003e0fa32ab38d93b65f9af27b3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768972506, "uuid": "47440607-628a-4daa-941d-b59b396ec7f8", "comment": "Malware payload", "value": "1c3412c43fa35374aa9e91d2428aaac17fa1f58093555170e041fc2a5baac0aa", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768972506, "uuid": "203ba311-32eb-4d40-bcf1-a00643d3806b", "comment": "Malware payload", "value": "e693f39976529dd20596534de57f09fa20d01cc9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768972506, "uuid": "59e776db-3720-4316-a64a-cafb7b916bb8", "comment": "Malware payload", "value": "072307a2c206e3ac0d1e09d2131c46913ca50905283ae085e85d4e7c212073339e3534a1dcf9f04a95d3ccfbef7eda33", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768972506, "uuid": "94f0102d-db44-4c55-bfce-83268c9e6afa", "value": "T171B6334CAE41815AC37883B522207617CC85D9780DC1A7F63B2F468A4B4D3ADEB5AF77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768972506, "uuid": "ce258b9c-4f76-4dd2-a37a-6fa0c08b57c2", "value": "b58258e2297dcb3863be03d7366a04b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768972506, "uuid": "f104aadd-fe01-4ea1-bd37-9032cdb7a21e", "value": "196608:CB/j5r6HR+9Q8MczDhOEZGhAU8PmxCvrmWeOOmO67WRchuPK5kcg:CBL0x+lMcz/ZqUFmWzMJchZCcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768972506, "uuid": "b1aee228-f2bb-4d63-8688-bdcadd066da5", "value": 10695184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768972506, "uuid": "5a36f8ca-3b1d-4e7c-8fc4-ec3705a91013", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768972506, "uuid": "0ce1f292-bc8b-490b-adc5-cd633a819dec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d92011-f718-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769034702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034702, "uuid": "44ce064d-d626-4d97-9f9e-42e091d8a0cc", "comment": "Malware payload", "value": "1256137bbe7469325e41315fe872a07a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034702, "uuid": "e82676b1-be24-459b-bf33-10d7c46ff8b1", "comment": "Malware payload", "value": "1c36270fe8152caa0bd0d75e24ecc614b3606698ce415a95173be995b930fcc1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034702, "uuid": "f7eda30e-44f3-4ca7-b9cd-38ab286861ac", "comment": "Malware payload", "value": "899ecb9f8c6e67e6be56441527d4223a42669821", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034702, "uuid": "01cf3b28-768b-49be-b0b5-830eb9025898", "comment": "Malware payload", "value": "15c46c5d90064b9817075b37e643da7410ede1baeb4f1f33e2fa405bbb9847ef69ce29c79f4a7bfd6c7085995d726bf0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034702, "uuid": "72dcbc65-ccba-428d-a112-4e17a038b75c", "value": "T1BD01F9EF92FD8823451FB48FBA728149448FD49765E22E93A8701C3B448F8C82105E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034702, "uuid": "f6988231-b9c6-4d9d-8ce7-e2d489e63f05", "value": "12:BSpEUVH1EOUDJOq3/s5Yd+9ZrTuEFeZsKp6ZBM1EKjlLbrSpEUVH1EOUDJX:Yp1HyNJOq3/s2YrTuEFeZN6ZBM3l/+pI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034702, "uuid": "ba8290bd-f2e2-4cbd-8f62-5b4196931538", "value": 744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034702, "uuid": "f1b80037-1c5e-4d0a-bbae-5b19905407a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034702, "uuid": "f352c219-b50b-4750-b2f0-244a15acec17", "value": "react.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01ed539-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768998615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998615, "uuid": "a6d9ee5b-3239-4f59-a9f3-68437819bd3b", "comment": "Malware payload (Mirai)", "value": "fe2763e288a9b5f7a2b245db3dc5d815", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998615, "uuid": "3f6449d7-5daf-495e-9814-b96709237f7c", "comment": "Malware payload (Mirai)", "value": "1d107d5591bd1020d747772ed5a693664b2ecd9892716d755c30e7493bb460c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998615, "uuid": "6565d2a0-2172-482e-b4c1-0affba34e097", "comment": "Malware payload (Mirai)", "value": "dd41875a02d51363263aa796e56492c4635ec252", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998615, "uuid": "b90153ba-e5cd-4648-8a5a-11d7f4cc54b1", "comment": "Malware payload (Mirai)", "value": "f16d44b8cdf12e1942c540522ba8f51715c81b4f2a02a9d717a1f580307348f49fd2d588f76960a4d24d78af363bbb25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998615, "uuid": "df72fcb4-3066-4cda-9bae-0b2f75652891", "value": "T157730795F480DB72C6D1267AFB4E528C73230F78D2D932028D15AF3467EB95A4F3A906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998615, "uuid": "ba3718cf-ef1b-4a56-88c3-f92110280379", "value": "1536:+O7STUxuP24oAZfe1Ag/Iw7T6duriiTOX7MYE78M2iIGqQ0LeONlO+KOZDQIIr:+kSTUUP24lZf6Aa7T4vXQ8DiIbKWXKge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998615, "uuid": "6ab05afe-98d6-4246-9be3-6724a534813c", "value": 79112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998615, "uuid": "264ebd09-0cb6-4af5-8bea-9abea6fb82d4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998615, "uuid": "e4e5b22a-3ace-4585-91d1-a78dc7f5bc3c", "value": "life5.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e24544-f6d2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769004441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004441, "uuid": "e8e1da19-f99c-4d19-b4d7-ec22bcba9eb1", "comment": "Malware payload (Mirai)", "value": "42186e6de3af91477341caea0adf4bed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004441, "uuid": "60136e58-d3de-4f8e-829b-95870ecd9715", "comment": "Malware payload (Mirai)", "value": "1d15221a0cf5866dc137cf9bc678e1213aa0a985e7e5501e7244a790b4586bcb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004441, "uuid": "40118c9f-b237-44f3-a2c5-32324b42b99e", "comment": "Malware payload (Mirai)", "value": "57e6313daa5c38e8e9d47e9ac53d532317c640fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004441, "uuid": "5986d2ed-9c4f-49f0-b464-2c2fa939fead", "comment": "Malware payload (Mirai)", "value": "6a4c07bcef830a7ad4c075392acfceaf9dd980e5df86370ac38a99b0a4b43c7d161252bafa1aae0af6ece04f8cf1a13c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004441, "uuid": "80b677db-ca8d-49d4-bff2-7d295904d02d", "value": "T1E853F885B991C612CAC4627BFE0E42DD771743E8E2EE73039918AF24379B81B0E7B550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004441, "uuid": "223d81b0-94f2-4d47-9f5a-78f4a541b9f3", "value": "768:tE+uZv2+23Xn12zhy4C9ueUyI+JX0+ShF4RWYa4Xa+6ms5355SqlcNk8NeIvmT2P:QI3X10yJX0+SrBh5zpwkrIvmT2bVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769004441, "uuid": "cc39d8a2-1cc2-4bf8-bbd5-efafb4989678", "value": 62676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769004441, "uuid": "e2034bc9-ac45-4c6b-8c20-a2ec6bdb7ab4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004441, "uuid": "d2205471-6cf5-4698-83f0-3e327af9c8a7", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac195ef-f6cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769003008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003008, "uuid": "cb00bb9a-6adc-4044-a250-f11bb4ced848", "comment": "Malware payload (Mirai)", "value": "cd003b7ba234be59e9da3258bacd0f58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003008, "uuid": "67186c01-2180-4887-a13a-03025da0138d", "comment": "Malware payload (Mirai)", "value": "1d55bf49b2581c6e5c0b06904efd125a5523c7e9eb758ae38bedf3723dcde6fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003008, "uuid": "48a8f218-e03d-4859-925c-d152e8623531", "comment": "Malware payload (Mirai)", "value": "4a591c63a5920aea74560bdb41a873e6fb0fe99f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003008, "uuid": "45d8c70f-e111-4c40-964e-ebd2a2fd100e", "comment": "Malware payload (Mirai)", "value": "7705322d2b9436f06f9af77610ff5f53bc398321ed070a6ae0fceda78c4ac5410f4d17302134be374dfec62362f4f83a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003008, "uuid": "3364ea26-3555-4ea4-b681-6a393ac71f84", "value": "T18A937D12CDA499E8F03AAE3010BADB7B4717F505990B6CF73C46C6255017E88F5EABB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003008, "uuid": "da129cfa-faf5-4310-abcc-b2e1f176682e", "value": "1536:Ww4kq2V5El+IBn37GM0L2Cxt/JYjKZNjLjc6aCqsYJGT2bVR:Ww/qSu+IBnrGM9+TYKA6aHXsT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769003008, "uuid": "e8d3e090-b17d-4873-a9b1-6a88feb6c3cb", "value": 95440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769003008, "uuid": "74a0979c-d32f-469e-9ebc-09ac86037b06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003008, "uuid": "34b6234e-9e76-4bbd-950d-5b77452b9da4", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369ccde0-f69c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768981124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981124, "uuid": "abde1414-788e-46d4-a6ef-f43b6d87a86c", "comment": "Malware payload (Mirai)", "value": "64a1aaaec5c0f950ea106d891713c82f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981124, "uuid": "ac50955e-98bb-47a5-bb50-9bd5c83cb904", "comment": "Malware payload (Mirai)", "value": "1e8c417a832a5f59d9e4f3543c3afd54bfdfdad610bb7027f0ec60705b11e3ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981124, "uuid": "69fa1465-f775-4900-bf69-0f12876e176a", "comment": "Malware payload (Mirai)", "value": "cac5132ec7392adf0fd85bfdc119f10caff59b7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981124, "uuid": "f827c65e-bd6a-4207-8cb6-ded4a7c2b56b", "comment": "Malware payload (Mirai)", "value": "331bbcb927580629f80e6113bc6bb87c8f39cfd141fb85c53e278c1211341d3f01b6528cab2b378c331c8b7e5d8a1124", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981124, "uuid": "bb099978-787e-422c-84f7-d782f0a9da3b", "value": "T18C04865D6F229F7DFAB8823497B38D20975923E623D1D684D2ACD2001F2025E645FBF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981124, "uuid": "267caa81-008e-4e73-b411-005d41b55c14", "value": "3072:62e+V4VslZ3rWwJeBlrR3brunzP4uXgwG8wgxkEtQBNtZrMCNWNLgvEyWzSMOk/F:6Cv3rWwJeBlrR3brunzP4uXgwG8wgxku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981124, "uuid": "2f219843-54bf-4ef5-a6bb-33332f8149c5", "value": 174060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981124, "uuid": "60c2c94f-9ba2-45f9-b55e-a166d1d3e98e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981124, "uuid": "be4a943f-0bca-42ea-b3e6-d116012e7098", "value": "ub8ehJSePAfc9FYqZIT6.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bac1ff7-f6ac-11f0-a129-42010a9c0007", "comment": "Malware payload (Babadeda)", "timestamp": 1768987923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987923, "uuid": "0e958458-13f4-4211-bf39-d526738cb5da", "comment": "Malware payload (Babadeda)", "value": "2efc68103bb4c20903611eb83dd7c393", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987923, "uuid": "35ad64ae-dac8-48b8-b02a-cc4a0c7c798c", "comment": "Malware payload (Babadeda)", "value": "1f1fb029233f92304e7df029cb69c35ebbc26d7e79ed609298c9ea27f312b222", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987923, "uuid": "97467653-fe36-4f62-bbf8-94baa07f56e0", "comment": "Malware payload (Babadeda)", "value": "393a92ce6cae06b1d792d14243326c703e6024fc", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987923, "uuid": "5abb8b1c-bbb1-45a1-bdc5-90ad5e802815", "comment": "Malware payload (Babadeda)", "value": "fb3ba229e413ec85d1b0e108d56aaf9298fc6a623a03ea0c7e1d016626bba7e2513c1f4dbb7809ecc961c44ef2e4eee8", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987923, "uuid": "677494cc-37b0-434e-ba9e-21593e177997", "value": "T10C25F2C2B084D2F1FD784D366037147A47336E3FE688B85A9388B60316F65D24F7A55A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987923, "uuid": "bf172dc3-0ca5-4375-b631-ee26ec607056", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987923, "uuid": "94ce0b35-46f3-49ae-8db6-7ba0e0121095", "value": "24576:+cvkTs2nz7+itUtSQnNSDqQi07BVBRfft9Kp:ZvkTjf+iOMU+i0/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768987923, "uuid": "635ac0c9-5583-4820-b6a9-81dae48cbcab", "value": 1040928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768987923, "uuid": "a8ab8099-e90d-434c-bb01-a2ca35a42408", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987923, "uuid": "8b3506aa-ace5-46f5-8b4e-31902147e316", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ffece2-f6ac-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1768988078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988078, "uuid": "6437a582-8aa2-4d92-8ec0-38a3325fd378", "comment": "Malware payload (DonutLoader)", "value": "75a7f0b2bee92b643e6fe9ffafa3b24c", "object_relation": "md5", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988078, "uuid": "58ac0ca6-3706-4f48-92ee-54b2a7a3c836", "comment": "Malware payload (DonutLoader)", "value": "20b22d9191c7a767d35b1d3426f79d243503a385a042575c26ca4534de4c6a7a", "object_relation": "sha256", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988078, "uuid": "36f184e9-7f2a-4361-a310-92f9cd7cb571", "comment": "Malware payload (DonutLoader)", "value": "4a325f734f25345e9e258a7e48ae6ae58efa15b8", "object_relation": "sha1", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988078, "uuid": "642a3fb1-ef5d-4769-ab29-49d1664c357d", "comment": "Malware payload (DonutLoader)", "value": "10f339255edf5966abfd8878689dfc6fe83d6a02a12545a4b2eaf092975449032daa5fb01c341db6eb62eb6ce868ff2a", "object_relation": "sha3-384", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988078, "uuid": "e14797fc-7194-4b41-897d-d2c55e2ad921", "value": "T1565423868EB33B917DE0D8B2036DE62274DCF5F879F467D064E766A01263DD0A0BE056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988078, "uuid": "0d12d8ed-abe7-4f23-8c42-0fb257899c9c", "value": "6144:vz8SsbhFCJ+RJlhRezbOFQv74XMzrifLhv9ZUNF7IU5HzRqxXGd9J5:78tzCJ+RJl3e+KvUSriNFZkT3z5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768988078, "uuid": "597634ff-a513-4739-998a-79579eb1a768", "value": 306088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768988078, "uuid": "cbe48f1e-e624-4d2b-9b61-c21bd71bd0a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988078, "uuid": "6dff11f3-eba4-40bb-bfdf-9e285cade38e", "value": "emjio.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f80c03-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034964, "uuid": "3f84d790-7243-4258-8661-d126946cf9b1", "comment": "Malware payload (Mirai)", "value": "e598322bccdfd258585dddb0af2a78fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034964, "uuid": "c40ff28a-1662-4976-a0fc-5e5cd0c815df", "comment": "Malware payload (Mirai)", "value": "20e2f507d4aad6dc3dd99afade57f387bb13ea00b9dc9a41b9ee8c50a28db38a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034964, "uuid": "2202e7c0-f4b9-4877-8495-1fa84d0556bd", "comment": "Malware payload (Mirai)", "value": "b6e14f5988dd89872da737b7cf21a1771a99a150", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034964, "uuid": "68bebbc0-9e8d-4cc4-9269-accafa6f68ac", "comment": "Malware payload (Mirai)", "value": "f37db64aff17a36f01104ea7bd0204125500a971b1e9473511c456d61a4de5bee25cc9ed29adc6bb5d9189564768046c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034964, "uuid": "313d7ee1-8129-4743-b169-4f31d1245a48", "value": "T106640287FB21BC1FCA010BB125DB0B8976BCD65B82CB9091B2D0C95F35BA185B7A11C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034964, "uuid": "e07f4787-bcbb-4b14-adf9-a2f8ab1703a8", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xiooQ33Q:p3lOYoaja8xzx/0wsxzSi9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034964, "uuid": "32a37b53-e5de-4057-86b6-724193a38509", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034964, "uuid": "da743dea-9156-4052-9fc7-142eb7d49b9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034964, "uuid": "bbd45652-1245-415b-a773-92f643052941", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc5eb190-f6eb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769015386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769015386, "uuid": "aa3ba1ff-b154-48fb-b12a-33146fb28834", "comment": "Malware payload (Mirai)", "value": "a8ae839ffba2199bd7ab638e9d977fa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769015386, "uuid": "2646fe21-022f-41d2-aa2a-aa4f303b8ee4", "comment": "Malware payload (Mirai)", "value": "21a037258778f11dabfeb0f8bca9cea4b5d706818a2a4c9250dc53babbd4f0b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769015386, "uuid": "c33af4d0-e14a-473f-beff-98968a836abb", "comment": "Malware payload (Mirai)", "value": "3314e141c273e01c54a96e6377e1515d49194c06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769015386, "uuid": "5632f2af-2d03-4252-8b70-67470b2ceb91", "comment": "Malware payload (Mirai)", "value": "df7b8afc60939ba0eedafa8082c7818840736f826eaa8d8df3c8b4d39188ee6942b8925a31e91dc92dd25b62198c424c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769015386, "uuid": "4b84cdd6-3442-44c4-b396-bebe83c38853", "value": "T134934B02B3180A47D1A34DB03A3F1BD1C3BFA5D121E4F689692E9B8596B5D336486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769015386, "uuid": "145e75ea-5c83-4f93-8555-a38014e7851a", "value": "1536:wrTRtMgxWLtLcDcTD+rdiYRQpPixbbUZrvoxnH7OGdpKTq8kJ+unHxpeECO7Hnjv:awoWLt9T1Y2i6wpg2+2xgM/Tr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769015386, "uuid": "8040541a-5942-4193-af83-3f97649ea970", "value": 92064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769015386, "uuid": "e4eb6ab1-1d48-4fac-8580-9df829b88219", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769015386, "uuid": "2cab8d9a-f35d-451c-a86f-dc3cada8d0bd", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e1f936-f6d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769006870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006870, "uuid": "ba9f74fe-7b3e-4fd5-9f96-e2385e5ef689", "comment": "Malware payload (Mirai)", "value": "f77610621fda050e5c924db0d2f53bf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006870, "uuid": "28911cde-35a4-4e08-a3c1-5c9e22474b7d", "comment": "Malware payload (Mirai)", "value": "2242cdf9cc9223c38c71a4bb87fdd7f0c43fb63b04ad0738d169cb6d23cca9fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006870, "uuid": "902953ed-4645-4170-84ce-e0e8e93eb827", "comment": "Malware payload (Mirai)", "value": "749a3845ba426819f42a3aff46d236a4753100a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006870, "uuid": "c3b8aaa2-79b9-4aa5-9a20-6f4cf4bec41e", "comment": "Malware payload (Mirai)", "value": "efc3007bccd78f95ccb9b3b19456017e41dcfe077a028e1464b96f5f44bb130c52c03a6dcc1c6c1295a6f44f221e878e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006870, "uuid": "e7159fc9-14a9-4e1e-9034-c11fc24da431", "value": "T1BF73022B518F0AB3D0F99D3370177B34AE79F013D8E52B05F942A045E61DDB26244A7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006870, "uuid": "d0738f6b-7f16-4cec-ae7b-67894a5fbcf8", "value": "1536:LOlDJ9nqHLw+ZQeuFvQfPbYGiNw7VI/rW0wvnEJ3gzE94e/ohf2TorY:Spn40+ZsvaTYbeO/VwP/zE99/ohOTSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769006870, "uuid": "4a993886-b7ef-4aa5-a618-eccc92f35ec0", "value": 74740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769006870, "uuid": "61a716e6-ae2a-4955-8185-dc96a706c4e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006870, "uuid": "d0cdc3c8-3746-4790-b2c9-c910488123b3", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a43169-f666-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768958149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768958149, "uuid": "74fa796c-d5da-4475-953e-38a253ac216a", "comment": "Malware payload (Mirai)", "value": "fbcc0401434cf8e5d6796f0fc04b8c21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768958149, "uuid": "1646ed6f-0da6-4d75-b1c7-ee436ea68044", "comment": "Malware payload (Mirai)", "value": "2461f883f45ddb4f8348d48156e356f833f1bdda5ca70620b7fbfe6503e02395", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768958149, "uuid": "cefdeb8e-e3a5-40c7-af2a-034d684fd23c", "comment": "Malware payload (Mirai)", "value": "2acf20b744ca4b5d614d5c714cf5fe601a2750e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768958149, "uuid": "ffe103b7-6bbe-4b3d-9cf0-d9eb30a59729", "comment": "Malware payload (Mirai)", "value": "d0356ae6aef688d35fa884908096ffc5622a9438ecfee455227d322fd815ba2cc03c140ccb19761a975fb711a44fc677", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768958149, "uuid": "2054262b-c2fc-4ce8-ab74-f1b331575aa9", "value": "T17B042945EA404B13C0D627B9F6DF42453333AB9497EB73069528AFB43F8679E4F22A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768958149, "uuid": "7039a34d-4d8b-49cc-a6f6-2ac3e014c597", "value": "3072:OLe6vhN1QIruCee+asuTuRebU7IVILsZQy38YhTfYo+M/Rvs1tlLn:ee6vhQIr1r+asuTuReAvLs738+x+M/RO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768958149, "uuid": "53d240b4-e8d5-411b-8897-6c66e7b33091", "value": 181474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768958149, "uuid": "3ea56d9a-c607-4bff-9d3a-90e8a7498d92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768958149, "uuid": "fdab7bb5-bbb6-4c52-a56b-9c53910c34b4", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76fd0c10-f69c-11f0-a129-42010a9c0007", "comment": "Malware payload (SimpleHelp)", "timestamp": 1768981232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981232, "uuid": "1e15eea6-1bdd-4761-8717-3e164db40ad7", "comment": "Malware payload (SimpleHelp)", "value": "7d537688a3dc5b895d30ed3b616ff040", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981232, "uuid": "6fd5b691-f5ff-4fb9-bf7a-bf26fbdd2d3b", "comment": "Malware payload (SimpleHelp)", "value": "24dbb6f05f2ac986b571780e97b5db0c1637cfec75d1b260a94fef2439694a7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981232, "uuid": "52179445-67fd-41bc-8678-2705a3cf3e08", "comment": "Malware payload (SimpleHelp)", "value": "e5c27a0a8a18950cae4e6a8f5c159e8d07c0bcff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981232, "uuid": "8033d42a-d61a-4fb6-b37e-8f35559ef46f", "comment": "Malware payload (SimpleHelp)", "value": "66e825ac33e83562e6a5c2253fb2060ae9c89991449c38b518a3e425506ca7aae2699477df070ea865364a0f471e575b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981232, "uuid": "c1f7d784-f674-4759-80d1-c46d29f15d15", "value": "T1C0863335F2F694F5DA7BE13586924102D370B0A80374B3D327B0896A9FB27D66A3E741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981232, "uuid": "bb23778a-3860-43b7-9df7-3c684cfd5f3c", "value": "8e73f0b1ba8e9ea271385585fb4d5c02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981232, "uuid": "5d5a9e1d-966d-456c-b142-1a4f0a729370", "value": "196608:sRB/opbZoXeEJWg15Q3auUNgCINS2mTtPVEJT4:+tolZoSUFNgCMOhVok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981232, "uuid": "22042ba3-488f-4fee-b3b5-692bbe5cbfc9", "value": 8323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981232, "uuid": "9ec3b3fd-99ab-41c2-b66c-965d6442dab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981232, "uuid": "47cbf449-e4fe-4235-bf6f-20d364b47ffa", "value": "Remote Access-windows64-offline.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745e523a-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034914, "uuid": "c63ae807-e681-4de5-8416-3a0f972c09de", "comment": "Malware payload (Mirai)", "value": "7283aa53153022dc6cc3aa56c1e5432c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034914, "uuid": "0ef68b54-8139-4152-990b-1e5bd3311251", "comment": "Malware payload (Mirai)", "value": "25054ebfc19fb9e809a05136cc1e1e603e7ef21192eba6dd52dbce28eede7b53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034914, "uuid": "e42e8826-0fba-4436-bfc7-bfef3809078f", "comment": "Malware payload (Mirai)", "value": "0dc04d137cda5e0590af56bab6d970b2c4be3714", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034914, "uuid": "6e0c95f5-4d22-4073-8503-5f88d6a3e6c0", "comment": "Malware payload (Mirai)", "value": "1da4cfbab4d3bd5af7b9e404545eb74714cf7f45239829c5d14780b640530400edee61495969e1200c59442092934938", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034914, "uuid": "bfc2fe34-7e2d-463b-99c7-bf5e1f6d5fb3", "value": "T17BC39E87F74B24A1C46206F007C75BAD6B93A112CF5FE4E3BC1DB53B9A7A0DA1916381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034914, "uuid": "5d596e8e-b90e-44a1-95e1-2c49f872c1a2", "value": "3072:lwNXdFURs6E0kyn/xWXJXreKYDozZgqq:lgesXm+JXsA9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034914, "uuid": "934c5960-8307-4edb-a2b7-5c8c4ab5f134", "value": 124956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034914, "uuid": "5f5e333e-d1cc-4f36-89fe-7efcd33a1a5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034914, "uuid": "31bfd380-c6e8-4f63-835e-3cffb969e73b", "value": "titanjr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c596bf-f6cf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769003273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003273, "uuid": "38757793-7ce2-4fc7-a9e3-45cf6e304b22", "comment": "Malware payload", "value": "7e26f9bd1650374470f5932b5b8c14e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003273, "uuid": "6590a70c-2565-48c3-bef9-476aad5570f8", "comment": "Malware payload", "value": "264b0041c792a90669aac76cddb844c02e58bd9ab6e21454a36f21a74f4c42de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003273, "uuid": "70a78fbd-c17c-4e80-a3d0-964477076bf7", "comment": "Malware payload", "value": "875a1aca533d21fa905f750d4efa1e2bc452a005", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003273, "uuid": "eeb395b2-f257-4be4-8cbf-7daea8312c98", "comment": "Malware payload", "value": "0d9503b2355c3794b22aee012145e2efd9ca0b13d585229bfceae38842724babe2af4cac618875380e588e1aca14fad2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003273, "uuid": "e9a6775a-55ad-45bc-aa5d-7504441c7ddb", "value": "T172F26C746F1F7C81D2C3E3BE6E85479120BF30F4AB5A81B56F03065DE5D3EA989A1121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003273, "uuid": "d72f3f37-0106-479b-84ee-4eaee3b6908b", "value": "768:MBR39e5A47FbR0KUgX1L5TuQD9QFWvjN7en:o6RuKUmLRrmYvon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769003273, "uuid": "ec859337-c625-4043-b83f-a4c72392c464", "value": 35935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769003273, "uuid": "ad440c42-2e07-48f2-aaea-79a0dbb871a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003273, "uuid": "2588fbc4-1781-497e-ba6a-902ad83df816", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b52265b-f71a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769035194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769035194, "uuid": "689157e3-1bbe-44c9-92b6-4da301181c37", "comment": "Malware payload", "value": "d434a2c216b0346ecc466bb792509c87", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769035194, "uuid": "59969fcd-218b-465d-ac3a-817de6767d52", "comment": "Malware payload", "value": "265c206b96681a366798236f5982aaaf4d21ac39ca86db21847ca2a8f4432dd6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769035194, "uuid": "c248209e-28ea-49da-9c2d-956f0f5c0b8f", "comment": "Malware payload", "value": "ee5c01852cf7d992cc77805d537b6e003912cff7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769035194, "uuid": "2863cb31-3801-4a63-a927-c53b86ef3b14", "comment": "Malware payload", "value": "280c8488884cf7a6bd19ac6fedf2ebbf6a6a2265d7fd0dce716ba06e0254b802c3704ce5db79ba87ee00d1903d6d0170", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769035194, "uuid": "4cfc6cf8-7e23-4b8f-a1c8-83f2ee095940", "value": "T1FFB4C58336DB0CEAEE932B3C51D76336AB36FE608B3A4B6B5114C2311C135D16E6A754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769035194, "uuid": "e631e058-404f-428a-ae69-5103eb4c968c", "value": "4c785070d31918effde68a86f76fb27b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769035194, "uuid": "cdeb4ff5-61fb-487c-83ac-83400a36d98e", "value": "6144:wBSbnvsgOFgHit/EOU0cK66x0d07dRzdIe2C6SdBHUWq+9yN86IpKIGl9AvXZq2K:wBSIeit/EnKTbHTSjafJkJ++DnrQBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769035194, "uuid": "3c986481-793d-4e13-98b6-95281dc86858", "value": 502376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769035194, "uuid": "014c347c-5e81-45c9-b2d7-f081c5be5299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769035194, "uuid": "0d12b2fe-84b8-478b-aa25-5863b8bfe142", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71188542-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034909, "uuid": "07e74fb0-7ac1-491f-8599-8d98b68cec33", "comment": "Malware payload (Mirai)", "value": "38be01cefdd675da872bdec83e566b74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034909, "uuid": "f49f45b6-ff1e-4b3f-9f94-4d44132550a6", "comment": "Malware payload (Mirai)", "value": "269c7e600d41cd03b27026d9ea50021b37c36fbf457b44d0f1870180be7ff434", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034909, "uuid": "95126ca8-fbc1-4051-9439-ec366f9464ad", "comment": "Malware payload (Mirai)", "value": "0ad1b5d60862802d314d783490b4597f0f95c3a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034909, "uuid": "95df4698-311d-4c17-ba6e-c852c9f5fa34", "comment": "Malware payload (Mirai)", "value": "f7dc37585e14b6d1bcdf1e9d9c74634f3f783d83d13b34e8b088e4110c36eb081e78caa753170b7d3289d5bed25276b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034909, "uuid": "34c5f2d5-026f-4f48-9967-7ac5c937e5b7", "value": "T1EE344B45FA418A13C4D617BAF5AF014A3332A795D3DB730699246FB43B877AF0D63A02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034909, "uuid": "316c0431-fe7c-4b8b-9e4d-7050439cab94", "value": "6144:JC+6eu/qr6dE42avffpkM0nRb7T0LMfalM/91hIR:Jjaa6+42avffpkMcpcLnC/NC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034909, "uuid": "d3823b1e-f1c8-47ac-ac57-f873048635af", "value": 235445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034909, "uuid": "0b5bd1e0-c22a-4ec1-95d6-3428f22b27c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034909, "uuid": "289562c8-4d0d-4e62-b30b-a42087298149", "value": "4rm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0be9eac-f6e2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769011366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769011366, "uuid": "fa2ff034-d9cc-46f1-bc97-7b4f7dbfa272", "comment": "Malware payload (Mirai)", "value": "be95f629aa71d8f79c0773469e1a0e25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769011366, "uuid": "b7fcc70f-f25c-4d0e-88da-4d5fcb44c491", "comment": "Malware payload (Mirai)", "value": "27968814839edb77bd46fe35bb64115b75985e9069a045b86f1dd73ade0d2de6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769011366, "uuid": "1e9a61af-365e-4fcb-a6d8-1d434c2f10c9", "comment": "Malware payload (Mirai)", "value": "dabee9a4f78f121440cbdb6a278a318a8b4475d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769011366, "uuid": "f52501f5-fcde-4989-9073-02f7b7b734ca", "comment": "Malware payload (Mirai)", "value": "3b261f430f1f5b9f744c2df58a0704db3dd661c8b981d0874bfd2272dd49f86e51938c216185cf70342666ccf92615c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769011366, "uuid": "6b1408f3-5441-4a38-b904-467c1c10c676", "value": "T10513F1F7427FB170C87BF47688486948D9B92C036C692F9E4DD572DBF9B29840139D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769011366, "uuid": "183f03f2-eb61-4940-9ee1-8b2b8b7536b6", "value": "768:y/oKd/38fWybwPiEM/LavbGAqoMZWqWBfb5SwC/Ay6osn9wFJPKMMEg7Aw2Ya5x9:a1h3wXb0WaqoMZOyd9/SwTPKMMrAFYOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769011366, "uuid": "759f5199-e7c8-48e1-839f-4ef75339bd82", "value": 44460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769011366, "uuid": "ac638774-5bc0-4a8d-ba7a-89a87a75ae1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769011366, "uuid": "3bf3c779-0af0-499a-8272-6db5afe524f0", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111f3bd5-f6a3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768984067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984067, "uuid": "6589ce44-726e-481a-afef-e05c1c21be07", "comment": "Malware payload (Mirai)", "value": "11c927eb32646ba8d30fbeb51dc49bd4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984067, "uuid": "f838e77e-d3ac-4171-ac58-8480f4a55669", "comment": "Malware payload (Mirai)", "value": "29260694bcc0cfa5b7d8115ea7c815932819d1b89d455cee81dd05df14000a02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984067, "uuid": "88344249-e373-4ad5-8590-a312b2875121", "comment": "Malware payload (Mirai)", "value": "a30defa921aaef14c1264291b43164f253b3025e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984067, "uuid": "5924272a-1f28-484d-93d7-a7a890ba27c0", "comment": "Malware payload (Mirai)", "value": "a86b1b6b43de0e0828999e40da5e29113a9738c137ed847437e6e6dcb0370f991a2253b7529b7b45925d6896a4d32c2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984067, "uuid": "8b1a6bba-7f3f-4632-9e72-a77dcb537cae", "value": "T196E23A9BBA92883FC9D04336BAAE116D3302F398D1DB3B07DD198B5532DB54A9C5F940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984067, "uuid": "8c42a15c-f0ea-440c-8fe4-6e4a0fc58e5a", "value": "768:x3e/LDSH37TtcD27JCYc/FN4bVDt8YzA1FmR6moS:NeUPCwJCrT4pp8Po", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768984067, "uuid": "7acb2e0a-f256-4075-9880-da6214429de2", "value": 34096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768984067, "uuid": "1eed6323-d1d3-4bbd-b6aa-f9e3965d7f13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984067, "uuid": "01e91601-680f-4bb9-814f-6b262833f548", "value": "ub8ehJSePAfc9FYqZIT6.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83083a6f-f6d2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769004445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004445, "uuid": "8d6af55b-0688-4f20-ae15-33c1345a0605", "comment": "Malware payload (Mirai)", "value": "eccd11dcac91e6688ee3ad4a009c602b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004445, "uuid": "5dd19bbc-2e7a-40e2-9a65-84c9f368488b", "comment": "Malware payload (Mirai)", "value": "295fc8ce12111491b301fd223c9e74c6bd63322d7ce8ba6d631fe71617aeeda7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004445, "uuid": "2db9af3c-4bb4-48ab-bdc5-fe8af27108e0", "comment": "Malware payload (Mirai)", "value": "ba8c3592f3dee35965ac0beb599f4c0e375af6f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004445, "uuid": "8d23e309-94c1-4480-8416-dcad597ad24a", "comment": "Malware payload (Mirai)", "value": "9533bd1fd4c06d10665eaae48c1ac098701025501c23457de44d988d10ed2d38e548b3d9514479b95f9df9c1175428a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004445, "uuid": "63b2e7ba-3224-48cb-860c-1f3de356a7ff", "value": "T182C3C64B6E529F7DF32C82358BB78B35A749238533F0C185E26CE9515D6038E682FB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004445, "uuid": "24dc6755-0aec-46c5-b0f3-57d2a7a47409", "value": "1536:3JbO56gEDbNDbrDbgjP4Ct8c22A0NfeAAnjeSzDCLzSYZ2uX0T2bVRu:3U5tBVt8c22A0NWAAnKsCLb0uX0T2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769004445, "uuid": "ea259941-a040-46ba-b887-d9ce9d5c6118", "value": 120480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769004445, "uuid": "bb70b0c5-17ee-4fd2-abdc-910a9e95dd6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004445, "uuid": "10e0bc18-7d8e-4c6d-8b67-b0c322561855", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6b68f44-f718-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034677, "uuid": "94c67c8e-98c9-4794-8b02-d6ec54a6530a", "comment": "Malware payload (Mirai)", "value": "59676f55f53bc659a7fb77163b44921f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034677, "uuid": "9743fd74-b4a7-41d3-8ddf-eb0ba01bf31c", "comment": "Malware payload (Mirai)", "value": "29b6123081797194ac182fe0a3e1ce06492bf8faf259e500932b8e121997c0f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034677, "uuid": "5aebddf2-8f48-42c4-bb42-7c21a6656518", "comment": "Malware payload (Mirai)", "value": "3d74be7bd0feea9b6b87c33744cea7206093eb6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034677, "uuid": "8a31f471-0b47-413b-a37e-9944c362aa13", "comment": "Malware payload (Mirai)", "value": "4528864187856b582c9ff48099f3acf6109a382ada2c8c0031d816eef62f33d15ee796556adeb643dd67e8bcc1b435f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034677, "uuid": "ca462785-f2a2-4d3a-9634-d1a47c4550cc", "value": "T10C934913EA264F56C54661F471FA8E384B23FC2A8CA71DF6A525EDE99143DCCB2053B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034677, "uuid": "b620da0f-9b9c-4d51-9858-94992d8a718b", "value": "1536:KS0jixens9h+rcu65yZKHbnvpcqMGCOjfMDc/E+B:KJjixFhxvygHNcqMGlEDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034677, "uuid": "bb71ea8b-9abe-4f8b-99d8-a6c1260af0b1", "value": 89388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034677, "uuid": "d959aef6-24dc-40dc-b863-bd4d14a535dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034677, "uuid": "d0d601c0-9625-481b-ae4d-3cb6b5eb4f19", "value": "titanjr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b261db-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768998631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998631, "uuid": "a9f2f58d-0ae8-4967-a88d-af53f06e722a", "comment": "Malware payload (Mirai)", "value": "a6b53a6c0fa74aee3a67ba5271c1a84f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998631, "uuid": "7c3650bb-f86d-440a-986a-984ae7331b23", "comment": "Malware payload (Mirai)", "value": "29c65d795000dd7ada14a77ddd620c445ea6f3113cc3c4b1f5bf032a45e4b778", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998631, "uuid": "824a1f2b-af52-4191-8cc9-6450bd06dd5a", "comment": "Malware payload (Mirai)", "value": "f51433015247a8d748ba0bbc04b3e47f5c78efc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998631, "uuid": "0f57beb3-335f-4348-9415-df5b2dec4ccf", "comment": "Malware payload (Mirai)", "value": "1d907b833a462ca9be0f5b0704a45a3ad206bcf249ae0d62cc1f028387db0fe321e50b7ed8810447b773829020f38d97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998631, "uuid": "b2bb2e61-a058-490a-ba11-c1e50e5c825a", "value": "T1B6730795F880DF71C6D5257AFA5E528833630B78C3DA32068D14AB3527F796B0F3A906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998631, "uuid": "5a39cfe4-15cf-45d7-bd60-e30a80441a7a", "value": "1536:YVk+7IOdia0QYZ/4s3H1S+mxmfPVGrZ9H7zYtuOGD+FH8jUzDy7aG51To8X8RLMv:Yy+7IOdiaaZgs3jRP81tKGQ1zDypDzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998631, "uuid": "f254c2e5-752f-4548-a6e9-922538f50457", "value": 75176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998631, "uuid": "f996387c-5071-4a2f-b5f5-34db7ad71f16", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998631, "uuid": "6021f6ee-7ece-40ff-b884-b7019452df96", "value": "life.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073d043c-f6d2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769004237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004237, "uuid": "278f0288-e181-4057-9b43-06fd6185b3f6", "comment": "Malware payload (Mirai)", "value": "73ef0e69936b45abf9c6ee0008518177", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004237, "uuid": "360971db-b85d-4387-92db-89b47b9fc77d", "comment": "Malware payload (Mirai)", "value": "2a27c75c3377e5cddc90bccf1b609a13651e8b4dd31c8f9bc3be82fba283f5b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004237, "uuid": "e0c8978a-2732-43b2-b777-81eafbff1e27", "comment": "Malware payload (Mirai)", "value": "15b9ac66dbe9457268a2cface03cb759f8d0e31c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004237, "uuid": "b86339f0-e408-4487-87bf-3972e014128c", "comment": "Malware payload (Mirai)", "value": "a38083a36f3fb22bf7aafe3877c53fa24ef1444e8def1332f4b5b2d84bf333649dad94f3b5cdc187e1e04fc59c937528", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004237, "uuid": "96ae02d4-13e3-4451-921b-f929788a1f9a", "value": "T1E6932951FD825613C6D122BBFA6E428D3B2653E8E2EA7203DD205F2177C681F0D77A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004237, "uuid": "ea8a5eb5-411c-40bc-9476-b0bf512aced8", "value": "1536:FWKfB7ByQgaFrrjwg3ZxOb7uf2wOUM9ASbqiO2C/mRrEqyXvrt:oKfB7Zr7C7sOUM95oqMrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769004237, "uuid": "def3cacd-3965-4df9-b34e-d640c1121c75", "value": 95864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769004237, "uuid": "49aebedb-e919-4dd9-b361-e3f7f87871ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004237, "uuid": "79bc52be-decb-4364-82f6-4f3f9097c853", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9eb624-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768998632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998632, "uuid": "ba38bf4b-2adb-44fd-a19a-a8cc25a583ce", "comment": "Malware payload (Mirai)", "value": "2a20bd905f83c4da90d4eb715ec3267a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998632, "uuid": "7be1fb46-404a-4aff-aed4-cfd13e5439f1", "comment": "Malware payload (Mirai)", "value": "2ae8bff3b08cba6580b4bad451bea43507dee30d4848c9dc31786513c25d00fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998632, "uuid": "5eabbc89-2222-40fa-ae06-757fcf480255", "comment": "Malware payload (Mirai)", "value": "cbb314940f479371a8fbb4a4eabc6a074894d606", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998632, "uuid": "540ab382-a218-4371-a7ad-a1add989ef41", "comment": "Malware payload (Mirai)", "value": "a31c3c53b48e896054f001efa3334851ce1c114d8447a7d6c9c2435444fc387f52e789e5337c16c20adfcb5427d655b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998632, "uuid": "99f0b5b1-b7de-482f-a413-3a15c93eed4a", "value": "T144634A42F69290FDC48BC178879BD166FA337C4953207EBF6B85BA311E36E21170A761", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998632, "uuid": "31988d63-6133-4a5f-935c-7a58593960c5", "value": "768:0LwdQm94/WUuulhRkEQjVJiRZv2mEI5yAFnY1UI9CfJUoAYYvfw/OPRC1MF7+ZZ7:PW//uuMMRZ++yPwf5AYYvfw/FZZbbor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998632, "uuid": "5fa45c9e-774d-47c2-ad4f-749d376373ef", "value": 71840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998632, "uuid": "83b5f3d7-3166-47ee-a79f-78393f3b1f8f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998632, "uuid": "2b230ce0-7bfc-44ea-841f-641439445539", "value": "sos.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d1972b-f709-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769028067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769028067, "uuid": "5592075f-8a69-431b-b935-04fd0a06dff0", "comment": "Malware payload", "value": "49b220f01699efc9e894489eef1e2567", "object_relation": "md5", "Tag": [ { "name": "Andariel", "colour": "#0DCC38", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TigerRAT", "colour": "#BD8FAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769028067, "uuid": "2b693447-efd9-4958-910c-9b9fc27a4f72", "comment": "Malware payload", "value": "2af120fb9ded079cb66e15c4b8aadcfdca9ead82d91e083f950605cc28babc82", "object_relation": "sha256", "Tag": [ { "name": "Andariel", "colour": "#0DCC38", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TigerRAT", "colour": "#BD8FAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769028067, "uuid": "e6e8697f-ebbf-4678-b440-8a4b9a8f087f", "comment": "Malware payload", "value": "22d5ec803370b42f39b4830c4e32dc4c1018bf53", "object_relation": "sha1", "Tag": [ { "name": "Andariel", "colour": "#0DCC38", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TigerRAT", "colour": "#BD8FAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769028067, "uuid": "533a190d-bb89-4288-9548-add177c7cff7", "comment": "Malware payload", "value": "e9b8e942b17e8711c1955da401291c62b72709c94b2c89de8081bb5e8c5a728dc34f01a5921ca7b9c28aa527b74765cf", "object_relation": "sha3-384", "Tag": [ { "name": "Andariel", "colour": "#0DCC38", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TigerRAT", "colour": "#BD8FAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769028067, "uuid": "7f8ec5d7-eb46-41fa-aa91-4c80979e11f4", "value": "T1D766D51ADB7A00C0D5B6C035866A992EFC717859A77457D387014B3B9F22BE4EEBE700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769028067, "uuid": "398b4ebe-1b34-4926-8e92-d0e4fafba9b6", "value": "6392c103c53c7d469edccc98eb2ff26d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769028067, "uuid": "93a0816f-b6b0-4bcb-b425-3c324c0b2e0d", "value": "49152:ZkluNr/7z67ur5niAfjvbZIo1bvo9vJD4yNM1mbjkFBNV5raK4XBpu4i1BVez0dn:ClsPZIKe0RpvdJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769028067, "uuid": "9f36aa5d-f499-4065-9bf9-9acd9235ea80", "value": 6659584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769028067, "uuid": "2b708174-fbf2-469a-905c-b3a8ae5b5ed7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769028067, "uuid": "ce5b9e4c-b4ae-43e2-8f10-4857518feaff", "value": "2af120fb9ded079cb66e15c4b8aadcfdca9ead82d91e083f950605cc28babc82.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcfdfe1e-f6e9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769014474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769014474, "uuid": "a69334f8-ed85-42b5-ae75-c02c8cb44cf8", "comment": "Malware payload (Mirai)", "value": "bb088094e6a7092f3fa943e9b0ae4b7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769014474, "uuid": "d5dc5225-3b17-4a12-9a4f-e65e1931a2e6", "comment": "Malware payload (Mirai)", "value": "2b21950bef913b69b7e064a2873e9f434babff9e219457ee2e45e98496016ba6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769014474, "uuid": "fde4d96b-0fe9-40e6-80a1-21e92d9a4424", "comment": "Malware payload (Mirai)", "value": "92f09e59343182b2845c32e8f3003dcafa58b4b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769014474, "uuid": "f572c3e7-8b04-4c24-a6fc-ef1b75096257", "comment": "Malware payload (Mirai)", "value": "5cdaf5eb3f2e393af574ad1ddb83a9dba838e49598c7e758e7f9039cb5c330fd8de8508ac757c056124b8b6d3f917b02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769014474, "uuid": "efe87bd9-f104-4bb1-85a5-69c1cc6d1a7e", "value": "T15B833882F64B80F6D047483000A7F73FCB32D6654161D62EEFA9DF36EE63542A116A99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769014474, "uuid": "ebd65d37-251a-4678-96bd-a18ab297f8fa", "value": "1536:VzZR6hGiihasIoY2cVwx8KDJAOZIzWwiMJDvnnkgfauVNCg:TR6hGiiha3oY9Vwx86J9bXMJDvnkgTCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769014474, "uuid": "cb841ef6-f30e-4c66-99e3-2e37622b1af6", "value": 87472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769014474, "uuid": "5f7509c8-e846-4d9c-ab8e-1c6088c93f07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769014474, "uuid": "cfdc50f4-23ec-40ee-b9fc-711c471ad3d0", "value": "x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b76254-f6aa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768987273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987273, "uuid": "2c604571-8388-40b0-af3b-470c487b21d7", "comment": "Malware payload", "value": "dc8f1f2b676f64df8d18caa52b86376e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VM", "colour": "#D403DB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987273, "uuid": "d46a4ba1-577c-4579-8d96-e0acd1d1f028", "comment": "Malware payload", "value": "2bc45f0d6a68a12ce6dd190b40500892b34627aaf5429e02c49b7003e32a0a30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VM", "colour": "#D403DB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987273, "uuid": "c63e0863-3e44-4918-b759-24bede8bc20d", "comment": "Malware payload", "value": "d71f52abedf2dbb7f117ae42a28839fe363fd98a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VM", "colour": "#D403DB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987273, "uuid": "d3790615-4bdf-4aa5-bb06-88d39abf93ee", "comment": "Malware payload", "value": "74a5db8d888a77780041a29e056415b2cd2f0a665947c44179e8028046e7e8161754df04cd4f12cd113ca9daabd43af8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VM", "colour": "#D403DB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987273, "uuid": "7a84d1cf-a78a-4ce7-9379-910131fb0503", "value": "T178C51A436AC71DEAC9D66BB4A1D31335B778FC608B2A5E3F6A04CA350D536C4AD1EB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987273, "uuid": "60285545-80de-467b-971a-b2f718b88838", "value": "d0ef68ed4d748468e68ac3c7dfb39e67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987273, "uuid": "b3dd797e-c9b1-4608-a345-f338b17ae58b", "value": "49152:WZUOs+LDVlJpXN71HQWBPTvG+RfmH1cvK99g/Fm5:WJJpXN71HQWBPTvG+RfmHN99g/Fm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768987273, "uuid": "60a1696e-44a7-4aab-9eb9-c5df2adfdffb", "value": 2700584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768987273, "uuid": "f9e999af-59ce-4007-9372-79c49fd7a4fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987273, "uuid": "d5e4a016-4f4f-49c1-88ca-213124442c7e", "value": "vm_hijacker_minimal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e985f050-f718-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769034681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034681, "uuid": "0c908eaf-699e-4d85-a747-58249133f17a", "comment": "Malware payload", "value": "b1ca6a478d635a695c09b1940c84da39", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034681, "uuid": "5f72450e-21b9-41ae-a263-def3260bafc6", "comment": "Malware payload", "value": "2d30a676418067e897f1b9989d059ca80f1baa9a95ef0d74fad3cab8021ae45c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034681, "uuid": "0547c728-bcaf-483c-81d3-28cfef0c33a9", "comment": "Malware payload", "value": "f1b22cdca01e14245fd35102c38af677abfa6362", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034681, "uuid": "3921ac3f-ddf3-4443-aead-fd8a5a5f5648", "comment": "Malware payload", "value": "27804feee00ab42a50207e2beef5b0a74e43e4149cc46e7cc6b2629488d21dfd594b73e41f2d4e09849a8889ce670af2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034681, "uuid": "c5d8dcc1-da93-40a6-a66b-dcd7b90daacf", "value": "T1CD617E8520424BB02C7D8F23A3AD4678B583E4F65CDF7F05E5EEA9E888ACD56F051742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034681, "uuid": "b7055512-fde9-461f-a116-aa73a673c2d8", "value": "24:ItahrhisahChBahdhPahqhlTahIhosahAhNahBLhBnJah/hfLahYhD1LahPLhPNy:ie/UL1JqjJOFLyJXN3ML2hY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034681, "uuid": "e157f464-66dc-4f8d-98c3-02eb32759204", "value": 3284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034681, "uuid": "02e370b7-24c0-4cb6-a8bb-f4e3d621a5c1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034681, "uuid": "491437a5-ffe7-4a1c-834c-3eb26944532e", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a611de-f6d2-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1769004639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004639, "uuid": "374870ad-d012-445c-b0fc-ab4b8186cce0", "comment": "Malware payload (Formbook)", "value": "f2c2de76f9e8252b4a81ab415658fa66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004639, "uuid": "29754e4a-af04-4958-8e51-d6fda0b946d9", "comment": "Malware payload (Formbook)", "value": "2d4c71cd33490c59fd5ff3a129625d70450e4792565c269c42306f72cbc8fd41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004639, "uuid": "3cdfd812-7c11-4e17-9e65-7b9279bbed91", "comment": "Malware payload (Formbook)", "value": "bafbe9e651d5c8976dcda18057b0fc0ac4513047", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004639, "uuid": "cabe6db5-3344-4711-a377-a9587dfa79d3", "comment": "Malware payload (Formbook)", "value": "211ab04ba36d558c24a36a913f428bb8e2d355af0684e4b3f2c0b3e3c577dc8a3827fb22ce80a40e5bb816dcab3f7ffd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004639, "uuid": "bfb47fef-8794-4947-b3cb-d45ba4864499", "value": "T145F336887EDEF86243522037692FB05BA53E4CC0FA4C8891D3E6D899F874714D6B7978", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004639, "uuid": "1a0cb736-2598-43ce-9337-0df37b97877c", "value": "1536:f+a7Gj1RNwsPgwzF7UP1luMIqf8t6RAWRP6JCPj5Ya/oaLgaWbOHEekDSetnZeMR:KHqe7I1/aqJV/tgbyHH0fSM0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769004639, "uuid": "85d97599-935c-4269-9b95-9f0892b1961d", "value": 172743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769004639, "uuid": "ea0f884d-b03d-4211-a18a-f8619a322ec9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004639, "uuid": "60d42d0c-1b0e-4cd3-b751-392c153a9b3e", "value": "VesselSpecificationDetails.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec41f431-f718-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034686, "uuid": "0a01e9de-6774-4000-aa01-3efad4051808", "comment": "Malware payload (Mirai)", "value": "74d9740766ac0cae92b549e7f0d2c193", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034686, "uuid": "8cb270a4-1d35-42de-857a-7209164acc9e", "comment": "Malware payload (Mirai)", "value": "2d85d3ce39bb2f43187d9a51a531c9cf607e0adeedc17933285490c325ac1e7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034686, "uuid": "a614a9b6-aea5-42d3-b3dc-8e26f66e847c", "comment": "Malware payload (Mirai)", "value": "a1083619041d8b2decdf8e2a06c7e62ac4334801", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034686, "uuid": "17fa2b0d-2741-4275-a6ec-1c74a039154b", "comment": "Malware payload (Mirai)", "value": "6b6e79e3a9750a6632b5e8aa8538a332b2dcf3f255f2dbdd0326aa42b4ad2e1a0b12aec2f38ef696b4bd4cd54dce5afd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034686, "uuid": "a87a6901-3ee6-4de8-bae1-3c3a1f97664d", "value": "T1A063B60E6E219FBCFB5C873447B78E20A65833A626E1D245E15CED015EB034E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034686, "uuid": "4613937f-7c47-4167-ad48-57fe3b63f3e5", "value": "1536:i1xZeojGvZuKrgFrmWRTBKH0toHMXqbZwxmviFlJpEpvsi6KF:i1xZeojGvZu9FrfRTBKH0toHMCOupvsu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034686, "uuid": "00a42192-b4e1-4a8a-8607-fde63c8f747a", "value": 67808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034686, "uuid": "f8b60c6b-525e-47ef-8f79-eb5ec862ba6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034686, "uuid": "bec4ac6e-74f0-4e17-a60f-6f25da5f5d31", "value": "StormStresser.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f972ad17-f671-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768962982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768962982, "uuid": "8d9fc1c5-99bb-43dd-9f8e-eb3289af3538", "comment": "Malware payload (Mirai)", "value": "ad21ddda48d96b990a44509d20c2e91f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768962982, "uuid": "de0be9fe-4b50-4e13-8bf0-ad4351f07d7a", "comment": "Malware payload (Mirai)", "value": "2e07b9360bbfd8561b8fc5e63042e0c46f4e8691c1dfe30e87afd7ff46f68523", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768962982, "uuid": "f7e18f0d-fc1e-4a82-a50b-0410dc56b492", "comment": "Malware payload (Mirai)", "value": "aed4cea2f7a2febb30354fd6f52acbcef000d774", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768962982, "uuid": "4034ed21-366c-46c1-9dfc-5bac6428d61c", "comment": "Malware payload (Mirai)", "value": "ca31127fc126b9e53b277553ed15657d462704c4624de413f1233a26cc6133e5254888bbee551aa28d0b1c8598982442", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768962982, "uuid": "a58b9d65-58c8-40ba-ada9-038367b175e3", "value": "T172D3BED7768B4811C42203F05BD79F8E3EA372119E4BC9EB2D0D627E28795CBD946782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768962982, "uuid": "37d58db4-68cb-47dc-a93b-678f6594fbdb", "value": "1536:okLQn9ypSg0CTV8L9mQFQukvsouIhZixjolg0DTOxzf6gSPnj/LWl:o99ypSgamsQd0Yh4xkbDTxgSPnjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768962982, "uuid": "ff2e4275-4bcd-47ca-a59f-741e02cf3331", "value": 132480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768962982, "uuid": "39b58a1f-ebed-4cd9-9fdd-f2fab055172d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768962982, "uuid": "6562d20c-ea21-4cd6-a338-559332dc6203", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2940252-f6ac-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768988177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988177, "uuid": "f04c05ae-8968-4f79-b092-07eac0d44370", "comment": "Malware payload (Mirai)", "value": "c4db78cd93f7c9f38d4fd25b25418bc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988177, "uuid": "95357f10-064c-460f-9aed-8dec26c2be19", "comment": "Malware payload (Mirai)", "value": "2e876dc9380e2021b4d01e0146fdd21e038983dc6f187966e7028f6fb6106f5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988177, "uuid": "eafb19ac-3f85-4bb8-b02e-4ed877fab78e", "comment": "Malware payload (Mirai)", "value": "b42d711003bdc22f913877be11e2bb0973dde85e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988177, "uuid": "7f84cb0c-e71a-4138-94e0-c07e83f63a41", "comment": "Malware payload (Mirai)", "value": "e70665dcd8638ec145ea0c5c323f852ecfd6bac61559a42d5c90a238a93f3c7c9076b419e127e5e286478927d5b19a17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988177, "uuid": "d4f91aaf-1e5f-4706-b795-68041a52eb54", "value": "T13BB2D06965D96822C2B4947DCEFFC1CB07722735B0CB70BA3A64423CB74781961F896E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988177, "uuid": "5298e140-a11c-4827-a64a-fcd3f79aa4bd", "value": "384:AHG0xQN+GY3TjU/C4SF6ce3+l4IDWdQnzqW8a8la8HHM3y0+fHm2vB02qhymdGUa:AHxiNY3TY0DDYQnzqDnlaeH/04nva2qg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768988177, "uuid": "d225571a-59bd-426a-bf48-3243219eaf70", "value": 23944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768988177, "uuid": "b626e3ed-ac90-4fb8-8eef-45c212e317e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988177, "uuid": "d5fbc4d7-21f7-4f29-850c-bcb07677be64", "value": "sdxkzX_UXA229x.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75513cb-f69a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980561, "uuid": "1e24a0d1-73c2-4768-89b4-58f9f07ab0c6", "comment": "Malware payload (Mirai)", "value": "8366ca8f9e244de655c7ec48ab73b9f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980561, "uuid": "7a79e57a-8238-4b46-8ae6-f13d3c259c2e", "comment": "Malware payload (Mirai)", "value": "2e97b806c426ac28a8782964bfcac48e93955635b70c12ac283d3f717ef12b70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980561, "uuid": "2463a03d-3910-4f0f-834e-af6de426806d", "comment": "Malware payload (Mirai)", "value": "9e50c2418c4870804d45db4be526096871327b15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980561, "uuid": "1382b676-1e44-4dd6-af0b-52360960e4b3", "comment": "Malware payload (Mirai)", "value": "ca0545f62f13838150088dbdc0ecbb2a949e4366035f06269f655909c0e3fc33f017eb8c72e6391cb61ac4f17e556eab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980561, "uuid": "0e0542ff-f829-40e7-b568-180a0335ebb1", "value": "T10543017BC26AE039C8B6623D24EA0794F693B95135125E6F4C1378F9DD7EDA83100BD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980561, "uuid": "7450285a-6989-4d96-8b78-10b76321ec27", "value": "1536:graHi2m/T6nJBEozue+OGUn5OiF9wIKMlk:g4iZGnjvue+i9F9JKOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980561, "uuid": "c1cfc1ba-bcff-4e0d-a406-1a759e65c349", "value": 57984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980561, "uuid": "3487aae1-09ab-436d-95cc-b3d73aca53b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980561, "uuid": "4cdca977-9940-41ae-a5a8-40eccc9bebf7", "value": "Orbt.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03cb954f-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034725, "uuid": "c849d354-65b5-4b38-84f2-c6d51087006a", "comment": "Malware payload (Mirai)", "value": "ff47437199d97f9349a5064c26405b88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034725, "uuid": "810bdb68-c85d-437c-9628-5a5c31c86532", "comment": "Malware payload (Mirai)", "value": "2f3cfe5b368c6f39b329d6b72be6dfdf90458f42f21bc30ca32c811b8b74ffc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034725, "uuid": "f5e5afb2-66a8-416d-8259-b53343c22fb2", "comment": "Malware payload (Mirai)", "value": "55ba148379127daf561361f1b8ae300199bd8add", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034725, "uuid": "90c80451-6623-408f-9af1-a3e3de76e9e8", "comment": "Malware payload (Mirai)", "value": "76d94ecd674f59f1afb1f5a66b0169a3ee6ac0eeec58e56ca4c35a3387aa361b5a3198a44c7c0c3f1b1e0aecd6e7b56b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034725, "uuid": "c672ce70-2ede-40c9-b983-1688b62a9dc2", "value": "T11F04881D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034725, "uuid": "f94e1537-ce1c-41a1-b81f-1d00c9bffd2e", "value": "3072:jg57RW7LHZwbq1YSBan1yvbysxr1uGSZI:jglRW7LHZ0Bqyy1BSZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034725, "uuid": "b4ca1a32-ddff-4f9c-96c7-59b97b0aa53a", "value": 173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034725, "uuid": "22922c97-09f1-4e13-ad14-768b7b24b92e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034725, "uuid": "acadf009-cb76-40de-a079-57749ae7fbb6", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ae8533-f69b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980714, "uuid": "986787da-1779-45ae-ac8e-c0d54e1c8458", "comment": "Malware payload (Mirai)", "value": "85b203e104f24d9372a1c695af7581a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980714, "uuid": "a83f2e85-ab6b-43d8-b56f-3ca1ab40342e", "comment": "Malware payload (Mirai)", "value": "2fda4a4cb3f07146a3441f3a1a78289fd29492bb8022ad13ca94af648e2f5d33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980714, "uuid": "1d2b33a0-5ab5-44b8-9f98-8b0c0ff441a0", "comment": "Malware payload (Mirai)", "value": "156a442bb997380bbe0f0a6b598d21a1e7efe06a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980714, "uuid": "2af370bc-0745-476e-b81a-357927aa4208", "comment": "Malware payload (Mirai)", "value": "73088c66781b63d74d806b95a8aa5547b1bfa750142a4ad216e9a23fa49ebf37d127334fefedb6689aa8d8cdf596e1fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980714, "uuid": "e3ee04a9-d8ec-4184-ab1a-77037b472639", "value": "T12C33FA61F3F8162FC470A27480B73B037D966EAA4A70EA5F7E650DDAD9422C457227E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980714, "uuid": "a9586e68-8d5d-4fee-896f-c610ddf8a0a9", "value": "1536:ZZFoAxwGklBNB1a3PXn3XlA+6q4X0I1nSHdTFfRqGauG:Z/YlBNB1a3PXn3XSqFgngTBLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980714, "uuid": "fd5362fb-7154-494e-9f15-c8add0b3d00d", "value": 52168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980714, "uuid": "445f35e8-06e5-4400-86d4-004ec8d43aba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980714, "uuid": "7dec52ba-2e0b-4483-810d-f45753eb4511", "value": "Orbt.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b145fb-f69c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768981417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981417, "uuid": "60cf1220-30e7-4a6c-9e48-3b5e71b013a3", "comment": "Malware payload (Mirai)", "value": "d54f43efa15556f57edb839073a2ba7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981417, "uuid": "ae9bab1e-5b7c-4574-9949-b68db0f73338", "comment": "Malware payload (Mirai)", "value": "314e09169fd54d47e714b19ea4f0761489793efd1169e404614fb8e0bf5a81a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981417, "uuid": "d9f42b6f-169a-4f89-aeca-5c4a178f1dae", "comment": "Malware payload (Mirai)", "value": "57b638e26d09d66b2dd8e9d5802f9107f17a98b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981417, "uuid": "a9eab37c-253a-43df-83f7-4323264eca27", "comment": "Malware payload (Mirai)", "value": "6ddccf87c0ef4c5a40421288872d5c46c374d9200ee329dd0c2b15036c61095023078515ca8c23bdf4b3f63f04576e87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981417, "uuid": "85946e19-6ffc-4543-8c1f-1ec21472e1cc", "value": "T1C0835C22BA391D27C0C9A47B22F34765F2F5478A24B8CA1E7D621D8EFF24550224B7F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981417, "uuid": "c8f8b5d7-9ee0-4bdf-9898-ddb0f91c062a", "value": "1536:07vuyAJsSAsTgf0cUCK3hpb0Bz3gt/L+j5wWIEXvRetaJwbZnDI:WGyOJkK3h50pgJ+dgE1wbZnDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981417, "uuid": "f5f025d5-eeff-49a1-b19f-450c0c2a0b83", "value": 86096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981417, "uuid": "9c751477-d6ca-4e0f-8e19-d94adce65ccf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981417, "uuid": "29c44c87-76c2-44d4-b430-263fe5581381", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ba1c60-f6e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769010272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010272, "uuid": "1766d8e5-2859-472c-85af-99b6b035bd64", "comment": "Malware payload (Mirai)", "value": "55e15a8af110ae6a40bc4f50aee38baf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010272, "uuid": "c15d78f2-0c2d-451b-afce-c3c8b62073bb", "comment": "Malware payload (Mirai)", "value": "31f8fa7aa1d924ecd3453607b4c6f48db5def0d683325163f1a04613fbd6ea33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010272, "uuid": "15203187-5846-40ea-8deb-363d0578810c", "comment": "Malware payload (Mirai)", "value": "8359460b543eb33091c2868ca3c09a97ec58aee3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010272, "uuid": "d4b50998-cc95-4155-bb3a-f1d9a6d8b3d9", "comment": "Malware payload (Mirai)", "value": "d364e57f68812cd0f4f5f36161980b03453addf90b6369330d174aa9c030f445ea07af495cec78b3ffb7295006bef754", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010272, "uuid": "ce0480a1-1992-41f9-b7d5-edb214e249ce", "value": "T1E1737CC6F643D0F4FC570470207BE7375A32E1FA1129EA43D7A89A72EC56602E616B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010272, "uuid": "1ca57771-c840-466a-a718-54cbb992cf46", "value": "1536:wp6kfm+q4sX4YFAO+PxV9T8x/ReOSpwPH5oyhg35f9kfzM4NSNTQ1SP1:wAkfm+q4S4YFl+5V18pPyye3h9uIv71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769010272, "uuid": "84b73c68-79ee-4d7e-a4b9-5320a6623822", "value": 79280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769010272, "uuid": "02e4d710-529c-4c07-88f2-3a94e2bbd725", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010272, "uuid": "cdc77f27-ff32-4d1b-9677-4311a31b785a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392b9069-f6ab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768987570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987570, "uuid": "9a9c7b00-8b76-4d50-904f-6702954e36f5", "comment": "Malware payload (Mirai)", "value": "b0381a74b506c50232668c827fd707a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987570, "uuid": "e745932b-56cc-40f7-b45e-da8e36c7d11f", "comment": "Malware payload (Mirai)", "value": "336a746f6be5c835eb03aa9805e3f5c96d4d1657a59389b1c2a9a53b112dc005", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987570, "uuid": "36627105-1657-470b-b966-96e498f65996", "comment": "Malware payload (Mirai)", "value": "47e74bf91f40d021f2f2e228cf937b4357ec1c79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987570, "uuid": "eab5e7d4-d1d8-415b-a9e0-1fa3c8ea1a8a", "comment": "Malware payload (Mirai)", "value": "a496e680abb6bfa8eff96e904ff0c7b555799aa8f499ac25cb819d6dbd0e789b9ae30430e6836c27e5d4c13e08d02f62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987570, "uuid": "90279afc-0ff7-4811-97f6-aea06af10bf8", "value": "T14253029C5E0440FAE565FB372BE142661DB3DB05B2918529F60CDF63DEDA888FD12D80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987570, "uuid": "41f07163-e3bd-481a-a860-364705c88cba", "value": "1536:y7MtCNJyFVvzBSuPqUM+sxtaT//eyHOtPV2VJun:y7M1FVbPdsjYneygP4VQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768987570, "uuid": "783f2ac4-1f81-4bf8-b8e4-3a0c0ddbfdd8", "value": 61388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768987570, "uuid": "47f84a79-3e5a-4162-b5c1-a2a2e1735430", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987570, "uuid": "74282171-05d9-4619-ae87-82b320bc2b69", "value": "Orbt.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b77cf4-f6a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768983323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983323, "uuid": "7504eb23-49d3-4945-8842-abc8355396ce", "comment": "Malware payload (Mirai)", "value": "0c7fe1e2da705becb57a276eee0d8e1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983323, "uuid": "92bac3a5-2050-4e17-b92d-e9c7bf559394", "comment": "Malware payload (Mirai)", "value": "347cde962a3104949d8196da65703933defe92282a48b41e35b94c516e24eef8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983323, "uuid": "29c4f81f-0a46-4814-a56f-f08c629dff3a", "comment": "Malware payload (Mirai)", "value": "7794e132bc0dfb67b7be983872a468fad187b075", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983323, "uuid": "d3d97e09-ac48-4c91-a7e0-93c9e5c1ad0f", "comment": "Malware payload (Mirai)", "value": "8aaab9058a35dd0978507835b75fb8ecd5dd74f567e08295b5e589a26d4169f7fecd440fe2713943adce1f561dda1c60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983323, "uuid": "c134b767-5620-4d60-a84e-9aeabd39c320", "value": "T153144911FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983323, "uuid": "1fd985dc-53f9-4821-969d-621940440c36", "value": "3072:ty5+GoCEggi4NerYqltSwJpH6+cYstkyYUat:o5H5BT48rYq1wjY2/JY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768983323, "uuid": "96eac256-bb8f-4628-9af0-7af735bc8b8e", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768983323, "uuid": "606ac2c2-741b-4a33-961f-4ef21184a142", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983323, "uuid": "806c6838-3f53-48fa-a1e4-3c2fcc6d7b57", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f57c780-f6a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768985540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985540, "uuid": "2580fbff-c37c-4398-9339-79c5800e21ab", "comment": "Malware payload (Mirai)", "value": "6c5c7f93a2ab2eac3c8117d44e60e724", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985540, "uuid": "3269e671-3de1-4613-a3f2-f0bf396f730d", "comment": "Malware payload (Mirai)", "value": "34ce4e93e9cf76541a5418c3abd328f2c372ab719d0c3254d65dc46d2477f5d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985540, "uuid": "ffdab01a-bc76-4fb0-a2da-0c09a4461372", "comment": "Malware payload (Mirai)", "value": "7bd5cc463f891b0f43243f49a379b472341eb6ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985540, "uuid": "9d0da6fa-329c-4378-95bb-117085c5cb86", "comment": "Malware payload (Mirai)", "value": "d3f86bbb2080cf68af356307e24dc087dc9f1e5f860618b362a735440006b2364884d1cd24428be5323b2010e6f5f7f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985540, "uuid": "8b09f748-86f5-4303-b896-e872a178ca2e", "value": "T14AA3E80E6E119FBDFBA8833107B74E20B69833D63BE1C685D15DE6015E6024E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985540, "uuid": "76af528e-9bad-4a2a-960b-959951377c16", "value": "3072:mJ7ASRNfr1eA8xjxNGzmyeijLqihe/wbZnOZt:mCANT198dxNGSAfqP/wROj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768985540, "uuid": "94addde0-f75f-4fce-9242-6e25b56c37e5", "value": 105148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768985540, "uuid": "c22b148d-ccef-4688-98d0-11959e805f83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985540, "uuid": "74806477-5ccf-4f65-9540-0a35dd6ef3fd", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d617e0d-f700-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769024246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769024246, "uuid": "aa41e7f2-ba67-4ccc-9a51-67b01c9c3e09", "comment": "Malware payload", "value": "ad3d582792e1ef822d02801dfa069da2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769024246, "uuid": "d4e24f18-b5c9-4985-80ba-a1111c630fac", "comment": "Malware payload", "value": "34da9c17d2186b4c26c40506f279a517f1dcc230ead7e7199c1d343dbf3fcacb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769024246, "uuid": "81ac2fd0-abf0-4068-a848-ba0ef7136e98", "comment": "Malware payload", "value": "3a8b80ac547f4aec038cb6972392645774cf0d0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769024246, "uuid": "48824a6e-7cb6-49b9-adff-f691b122c93f", "comment": "Malware payload", "value": "ed32fb1021cc431ae38a8477ef44811d2a524669413952f140d1c80ca12fceb523481ea59658f990f0c67124114e80b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769024246, "uuid": "32d1039f-59db-4be3-9ab2-a198ace56132", "value": "T1FAB519036D9049E9C45E933588B692A2B775BC040B3233D32F917A773E767D09D3AB68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769024246, "uuid": "d48af33c-0902-4b2e-b7a4-bb4942c9b2e9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769024246, "uuid": "4fc2b8bd-7b8b-40fb-8f8e-db792b697e35", "value": "49152:CGItZyII4M36lJQmsYXiCsdAENAwK8T67t5w01MC:C3yKUDAwK8T67t5w01MC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769024246, "uuid": "f9a355d7-190a-49e5-803b-9843c4c68a0c", "value": 2304216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769024246, "uuid": "ec0605e2-9eac-4000-9f8d-4ac8992b90b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769024246, "uuid": "41a4aeb0-8a5c-4ab9-ba3a-300adc3d1a3e", "value": "G\u0430l\u0430xis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52307b08-f6a1-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1768983317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983317, "uuid": "192217df-102e-4ad9-b6c6-f468023c9b4f", "comment": "Malware payload (CobaltStrike)", "value": "c71c102f70e213978d08bbe5b5fd42d4", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983317, "uuid": "bc23dfc3-535a-4d34-9f11-34c9f297b624", "comment": "Malware payload (CobaltStrike)", "value": "35866f4d8ff40416a153f252a7c9d4fc919337f51189e6ddbccac18e3d757920", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983317, "uuid": "9534ebe0-b7f3-471d-9c99-e097e1928259", "comment": "Malware payload (CobaltStrike)", "value": "c609aa7230b3b569472524fea7262c6f89e0bc69", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983317, "uuid": "1394ca1b-d5b6-4bb6-a381-bb040be8b51f", "comment": "Malware payload (CobaltStrike)", "value": "104806709eec5c74352b22c9f2f7d6b77de6e5e9b9e91a6b2607bc0873d94156550530578d9651774c52d437cc4b1c7d", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983317, "uuid": "09c05791-1b18-41f5-a61f-b84229d6f979", "value": "T19B92DA3FE31368E9C106D57845FF7732DCB13DB385A6971E2724D2B42E106A42EAAA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983317, "uuid": "a35077f5-89c4-48a6-90be-f2984e95ca0c", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983317, "uuid": "b9b82df3-f7be-41ec-97fd-903bba5869e6", "value": "192:UV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2R3c6siWF8qa1Dojjgi:GqaCF31cix+Dc4zjsMDFF46gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768983317, "uuid": "7b0b41f6-e3ac-4b04-a1db-3284448c7a40", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768983317, "uuid": "087e71f4-584e-4f8d-a678-4c6827a2d611", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983317, "uuid": "9ff512b2-9536-40f9-883f-6b652a2928ee", "value": "35866f4d8ff40416a153f252a7c9d4fc919337f51189e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51209c90-f6d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769006938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006938, "uuid": "46cbb9f9-cf76-49e6-a249-d8c079a2d01f", "comment": "Malware payload (Mirai)", "value": "bb939efffa59bf1ddae86a2fe2999101", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006938, "uuid": "7ee35083-cf9f-4e2d-b613-d1ad4fe40305", "comment": "Malware payload (Mirai)", "value": "358a799509c37a49699abb3bba3bb8a663fa73673e12c2a1eb970f89b13e00a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006938, "uuid": "5e5dd2ef-5aaf-48a1-ad5c-04a438a2b87c", "comment": "Malware payload (Mirai)", "value": "5d984f01851320785646d3f3eb67bf393d2a2969", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006938, "uuid": "8c59d392-727d-4ded-a927-557c4ba3b9f5", "comment": "Malware payload (Mirai)", "value": "2fafa941df93bcde6cfc7825db6a560067afc7ccde3d298eae673cdd10bd38ff60d83653b181277cebf018eacd64225d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006938, "uuid": "5ca550a9-612b-4516-9a1d-61005b8ed4d3", "value": "T147F33C47B7208FB1C368D67009B3CB67A6E6269216E19985E76DCD107A3075C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006938, "uuid": "bfb7c0c6-91ea-48a8-b784-79ebbaa101a4", "value": "3072:o3VJgzikZXyrNo/tqTHmnsHgCtEUQW0l/1wLxpvEcJz3nmfau:oFJMZBtqCnFCtE1R1WpvDQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769006938, "uuid": "29fbefc3-c271-443f-9003-c6a0b2b3bb60", "value": 166944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769006938, "uuid": "c097096d-2221-4cd2-8505-fdb43a8fd126", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006938, "uuid": "68976e0a-d3ba-42d1-bffa-082f5051d5ca", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c47254-f6e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769013766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769013766, "uuid": "00828b71-acf1-4501-b7d0-1867cbbb4a8a", "comment": "Malware payload", "value": "bb7a4ef3b365e2cddcaa523c03819dbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769013766, "uuid": "ccef6e3a-a8dd-4ba2-9461-e14304024564", "comment": "Malware payload", "value": "35d754c1126d28bf2ece6a68db5fb683abf5fbe7632eaf3ae38c600d8f5db1e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769013766, "uuid": "36c96bb5-b3c4-4693-a0ce-c5c640ed3eac", "comment": "Malware payload", "value": "65a9527f482d0418cc868cab7b04ff1c7c30160c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769013766, "uuid": "062e3c9e-6abe-48fc-b584-c41b9bf3572b", "comment": "Malware payload", "value": "946e10f2758f2cd10204088db2a2b245afba9107ef840b6b676ace2ea2eafcf6bce0b58018c7ab2156c444454e00343e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769013766, "uuid": "f2f6e0c1-a2e1-41d6-a3fc-5f6666bfb633", "value": "T10573C70AFF640FB7EC2FDD3715A90A09258C651B12E97B3A7534C828FA5B50B49E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769013766, "uuid": "e5872412-ed64-4c93-b227-5a3cbc0d668c", "value": "1536:7VkWBDXh7eHOcyxX00ELrAH1KKRxzzlLLkhbGeuEwyZgyH9H:7VkWfrxX0dLrAHoKPpkjwyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769013766, "uuid": "3bb7156a-556d-4838-98d5-879e6106a334", "value": 80360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769013766, "uuid": "ac9f6b48-90d1-47d2-b060-d7b23141c6b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769013766, "uuid": "befcbc7e-6ce4-47c3-b734-13bc45449ea3", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cddedad6-f6a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768986102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986102, "uuid": "809f3904-8d21-4ac2-bd81-fdadc653ea3a", "comment": "Malware payload (Mirai)", "value": "6aec83774adba1a26a183e606c2e05ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986102, "uuid": "dbc8ad51-4ac0-4138-9394-2ae25228392f", "comment": "Malware payload (Mirai)", "value": "35f0d329cf4a51b2be2f1b37df23a306536394ff5863d58ed067172e68112e72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986102, "uuid": "79c21642-993c-4f2b-a508-1376e23a3fb8", "comment": "Malware payload (Mirai)", "value": "b9dc75f4e02c59cfe21ebdf86877b4ee468706aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986102, "uuid": "186d0216-e451-4f6b-805e-da76dc8fe456", "comment": "Malware payload (Mirai)", "value": "6f95f1118105250e83f7e2166914ea28c3884173c02d3703efd7263db12a88566d38a914c97c91345c53d8b6dcb6f509", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986102, "uuid": "c016d2d0-a63f-4e6d-b869-d0d535cfdd64", "value": "T174B3AF87B2907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986102, "uuid": "bd9b1811-4739-418d-92d5-d91fd3771e1e", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHzp8rSR:t3SrlGWnKTU83AQB5A5Liy36fVUSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768986102, "uuid": "db5e58b0-6ea2-491c-832f-14fb655459de", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768986102, "uuid": "23c3793b-286e-42e8-a6fa-d6be23d29d69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986102, "uuid": "35a8a0d2-f188-4b98-be76-2d3e726111b8", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d02473e-f697-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1768978987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768978987, "uuid": "54173d19-1b88-47b4-813c-125baa0e81dc", "comment": "Malware payload (XWorm)", "value": "0855a28c1c0ab5a9e5bea78cc99e052e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768978987, "uuid": "ef496063-e39f-4d8c-a66a-b27f8258d28a", "comment": "Malware payload (XWorm)", "value": "3716c515929ba48afbc09a0f97ea788c69c47f6037a2b203f1c165faff10f78c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768978987, "uuid": "0b0f45c6-c510-4e8a-b06d-bc144fe9463c", "comment": "Malware payload (XWorm)", "value": "fe1835d92241f2768cf7e34eab77d1a79c6e1ed0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768978987, "uuid": "e24757cd-0dd6-4cf6-a5f2-46f45aa93603", "comment": "Malware payload (XWorm)", "value": "3a8081ced749e266e8d9add6d9a8e19947714247f96eaddcab00e2919d22ed976dcbc488ffc40ed6918121ae829ea359", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768978987, "uuid": "4406ca8c-4331-42b0-9654-86bc42dbd733", "value": "T1BA72E8268B159FF00AAE7251788B6D1695520B00A7343A1E7D8FE9DC3B3B271CFD14E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768978987, "uuid": "06f83fb4-ac9c-40cb-8cec-f36a7fae7e13", "value": "384:KsvEW3/90Q9thX46mSqkvh/jkcGlvex7SW0KeYRSTHNKc6IPlIAkBqN:KsF3/90u140Yvex7SW0KeYRSTHNKfIP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768978987, "uuid": "834921cd-35fe-4b97-88ee-527f500c40a0", "value": 17423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768978987, "uuid": "0ef2e805-13b9-470b-a34b-296a26fdc2cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768978987, "uuid": "c6ced98f-4a98-4908-9125-8c6c113645ad", "value": "Bl_copy_awb_parkinglist_commerical_Inv_documents_20_01_2026_0000000000000000000000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fb9f8d2-f6a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768983689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983689, "uuid": "a9ec2576-88d7-43c3-8f41-e7909191a303", "comment": "Malware payload (Mirai)", "value": "44b6daa7db02b43e08af53dce86b9b8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983689, "uuid": "526b0c99-30e2-423f-b45d-4b951b801f1d", "comment": "Malware payload (Mirai)", "value": "3734539a36002c46c32c722cfec367cf61184fb898f09d49b650306c5dfa2b0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983689, "uuid": "a9c80584-6da6-4378-b4ae-396a54aed445", "comment": "Malware payload (Mirai)", "value": "31e18438a606bb0fa09bf9350ffad6187af0a25d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983689, "uuid": "8d62c6d4-9c16-4766-9757-d294749f6dbe", "comment": "Malware payload (Mirai)", "value": "8aa9a61da543efab7476704f583838675df3c8250262644a77a218aea4f98ce0636172e293b39e19b2f682a13f568080", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983689, "uuid": "05d8c5b2-6eff-4abd-af4d-d6f7ec31276e", "value": "T1E4D32905734C0847D2673EF43A3F27D197AFDA8222A4EA41254F9A8E9172E730589EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983689, "uuid": "bd2c2978-674d-4a05-8511-3e9742b3070e", "value": "1536:iuaEuILt9xzKrd6VsKUWvAMgiZHbBT2hOXxW6qJOCvVz8INly:ifEuILt9xK66KAMU+4F8IDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768983689, "uuid": "913bf16f-08ef-4d53-9968-0bc5c41ca164", "value": 131412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768983689, "uuid": "301292cf-b593-4ee8-9303-9277ed270178", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983689, "uuid": "57e258f1-c0a3-474b-bf05-cb73ffce8376", "value": "ub8ehJSePAfc9FYqZIT6.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360c2d51-f6db-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1769008181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769008181, "uuid": "81e99dca-7386-4d8d-832d-563da11e9b9e", "comment": "Malware payload (XWorm)", "value": "70e5121f4025aec517945ea2fbdbaa97", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769008181, "uuid": "a503025c-4733-45c8-920d-8e189c59bb4d", "comment": "Malware payload (XWorm)", "value": "3768c32a3502eb25fc0b0198ceb5953635d6def683ce281bb8289b01f656e5b4", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769008181, "uuid": "87570426-fcc0-4878-918c-be979ab88a2c", "comment": "Malware payload (XWorm)", "value": "b1085d24141ee0beacc5b87f9930477fd275e4e2", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769008181, "uuid": "e597c489-197c-48d2-ba2d-8cdde075b47f", "comment": "Malware payload (XWorm)", "value": "158860ea2879cf4f5b97bc0b923c5254b878e1c93080dde3e237c665d4f00f926c7e43a9171d17d79d0769bec4d700ed", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769008181, "uuid": "1a8d7a1d-1311-4547-9a7d-2476d4f37a50", "value": "T1ED72D821CA09EFF0467E6292684F6C1A59121B11EA34374D798FF89C3B3A261DFC14E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769008181, "uuid": "bbb9bb26-d19d-4943-a130-27702b318961", "value": "192:KvgawOZUIeUF6j5FZmfpAYGDbjloeWDG5+ivF4MQ8P718+RwZAzE4liMcnI4imL1:KYx1H35FZ2i3Jo+Vvu78u63lid2ON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769008181, "uuid": "9539777c-42d7-48ec-9a00-46f746a7c09f", "value": 17532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769008181, "uuid": "99144c21-ea34-4ce4-8838-c947a6d4ef41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769008181, "uuid": "e2077dcb-75a2-41cd-aeec-2a2d38b960df", "value": "awb_DHL_shipping_document_bl_inv_packing_commerical_docs_21_01_202600000000000000000000000000000000000000000000000000000000000000000000000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fdb65a7-f6ac-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768988065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988065, "uuid": "902b9dbb-41ce-4840-bcf2-0d2b9d702c91", "comment": "Malware payload", "value": "c08d04309e30e4a6d105965c685f32f3", "object_relation": "md5", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988065, "uuid": "95b05496-175c-4286-97f4-e45c4d620256", "comment": "Malware payload", "value": "37ccbe99ab2c211811b2fbb677362d2256d2d72ac161200b7837119016a0f38d", "object_relation": "sha256", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988065, "uuid": "ac2a693e-3bbd-42a6-adb9-54b6104c476f", "comment": "Malware payload", "value": "0f82c32f5347cb94d9ed314fe128f5bcce491f24", "object_relation": "sha1", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988065, "uuid": "7161e265-5653-4905-b998-59ac4805164d", "comment": "Malware payload", "value": "c5ed9d5bc0b72d1159faa1d1269349ca34f9b3cb9a906a7ca75238b4a27fdd1dc951b3e512f7ceb36e6198e73df21cc7", "object_relation": "sha3-384", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988065, "uuid": "f7d7a6e4-a184-48b1-9d1d-3df7c86c8c87", "value": "T118362278145339D1D0E80830059BF4BDBFE129E224B2AFE45ECD9B84A2BE67DF565C09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988065, "uuid": "5ecf1fe6-4d66-4b22-8804-ff979318353c", "value": "98304:4bltgXe2ti82GqrvTHY4Cc6AZ+gCnBMd+Vioq:4ltT2tUGqlCNEVQBfEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768988065, "uuid": "6ee41144-ffde-4ada-b95c-501856e11791", "value": 5346652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768988065, "uuid": "ebc644de-9016-408f-9e34-f71b4248c835", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988065, "uuid": "56e9b705-0928-443b-b34a-400ca44eb323", "value": "ADa.tmp.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f46cfdf-f69d-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1768981514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981514, "uuid": "770c6342-7fa6-4795-b1c4-c9bac67c18f2", "comment": "Malware payload (CobaltStrike)", "value": "78fffe470a646d90ef4114af3fc0dab8", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981514, "uuid": "e275e546-3aab-4ab5-b5fb-4c7b22c1cae4", "comment": "Malware payload (CobaltStrike)", "value": "380bf83a03a091014a386b48f80e4fd1ee6a5c5c481dd640b47018afe910a3a1", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981514, "uuid": "5652663d-9a10-4886-8451-eaa2dc6c77c7", "comment": "Malware payload (CobaltStrike)", "value": "2262ee22dc415582131b5786fcec7c851af047e8", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981514, "uuid": "f81eece0-bcd3-4f35-8f4b-6c4f167ac763", "comment": "Malware payload (CobaltStrike)", "value": "ad072ccc6ee2f20fa499df55c5bef3d87abfae0b8bd5d809a4117eafd1c9ba38532d93317a5f0d84680094409b144fe1", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981514, "uuid": "4d08c13f-3110-40cd-99e2-d32587a267e0", "value": "T15F92DB3FE31368E9C506D57845FF3732DCB13DB385A6972E2724D2B42E106A46EAE610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981514, "uuid": "42edffd6-a83a-44a9-9c93-1075bd815f88", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981514, "uuid": "e74b5951-9e77-4919-be04-419b08bfdc4d", "value": "192:SV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2D6O9vJp2WF8qa1Dojjgi:cqaCF31cix+Dc4zjwrvXHFF46gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981514, "uuid": "83f48319-7cd0-499e-9d34-4ef8106deefc", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981514, "uuid": "7c475c5c-ff95-4e6a-a1b5-bc07235a4adf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981514, "uuid": "b0d63ef1-ebc7-4eca-93fb-ca494435ee02", "value": "380bf83a03a091014a386b48f80e4fd1ee6a5c5c481dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e796bf3f-f6e3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769011915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769011915, "uuid": "eee445ea-1c2d-4193-8813-cb1dca4cd105", "comment": "Malware payload (Mirai)", "value": "f4dcb9aad09cb87243fd03bb3e2e8962", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769011915, "uuid": "4f35b1f6-08f3-428f-adc8-e829abec9adc", "comment": "Malware payload (Mirai)", "value": "38c6454f99aa5919b25bbde629e1ec7434dbec8d2f40f3b65b48e1b821551720", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769011915, "uuid": "d55f2018-6bdc-45aa-ac4b-9ba838842405", "comment": "Malware payload (Mirai)", "value": "4acea0992df2f32e52093ad86dec03a8f3e522ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769011915, "uuid": "7b0df2be-b646-49cd-a658-b97b105b0639", "comment": "Malware payload (Mirai)", "value": "8487df920d6c50c6fd6c150edc31ac02da760234d1656b577645d57c98978daa645df3e35907e2d9c5905ca9a905d2e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769011915, "uuid": "4dd7c23d-3b94-4127-9ad5-e13e1be288e8", "value": "T198C3C81E6E229FBDF759823047F78E25975833C627E1C585E2ACD6102E6034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769011915, "uuid": "2bfc1abb-cf42-4fad-902d-6916d43317c6", "value": "1536:5eVxVNOugg1gILI7hvk3+y0/c2CL4x6zAX0/bGAPQxeOFTxMkQFI:kVNjgDd/c74x6zAGGAIvMkQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769011915, "uuid": "75328f14-ebf7-4731-890e-14737bc74929", "value": 118220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769011915, "uuid": "3703ae39-7699-40d7-bcb5-ff7743fdc636", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769011915, "uuid": "3e68469e-3631-4be9-b194-6fd4d8e5bb37", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f227fbb2-f718-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769034696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034696, "uuid": "99f27526-02ba-4cb5-a76e-c2e73227b4c1", "comment": "Malware payload", "value": "fa362e0e53d5d4fc582455cff2219061", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034696, "uuid": "7e190d4d-03f4-4d1b-91a9-1d8ba20ece42", "comment": "Malware payload", "value": "38d7165e0c560a6b3eded745678a8a2a458ed2ef55b004fa8b8186814aa2d13e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034696, "uuid": "6d104b28-b3af-4ea0-9e5c-9ee5d35a679f", "comment": "Malware payload", "value": "4fba1e93fce97ded5968925d520293995092e905", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034696, "uuid": "87437e0f-c011-44bf-ba50-ea0b38870117", "comment": "Malware payload", "value": "1485789d4c3b2019c8096b3abb2722dd6a666985518a08d3de1eaad482185f54c3b21ebda0a9b19bb463d0d3a98c042f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034696, "uuid": "f999d895-c77c-4bb7-96b5-79c3aaa9ef85", "value": "T1CCF0E1EC65F66543DA29DE04B0E6812C9402D2CA3DF3CE95E83C09307CC71003918B6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034696, "uuid": "32de6a11-7dc6-4db7-90ff-4d6ccfab3e9a", "value": "12:3J3UUYNUU7ALKVNUUP0LKBNUU5eTtgNUUifyNUUAj4NUUcseNUUuOmNUUWzNUUSv:3J3uKKVyt1RNsR0sv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034696, "uuid": "6770ba4f-1ca8-4376-9e8c-351dfabf47d1", "value": 591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034696, "uuid": "9d5dd7f5-c776-46ac-8db6-010d788941ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034696, "uuid": "61009ac2-17ea-40fe-8833-8b5c5ba5c77a", "value": "ll.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ceef3f-f6cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769003006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003006, "uuid": "b1d07050-6881-4fe9-b66d-d95bccdab742", "comment": "Malware payload (Mirai)", "value": "f6eb85c311ae7f18e7d01298dd7117e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003006, "uuid": "8ef224bd-b2fb-47cd-89a8-de7d11ad7e46", "comment": "Malware payload (Mirai)", "value": "38e9524151f59eff66e820f99eec5956ebb84585280169045b5a40676124fd60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003006, "uuid": "b64b185c-4fad-49b4-acba-912fb49b7906", "comment": "Malware payload (Mirai)", "value": "9eedbbad4de9dcfc8a596ec2f63ee88f99e3cc13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003006, "uuid": "023396ab-4024-4343-90d6-5c4dbf502472", "comment": "Malware payload (Mirai)", "value": "d2a7d82b7c5139749b0ecb860445db87056ddf1f98b44a3b5c4d6540e7ebebde611f570ecf4d881e972242d5465c2945", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003006, "uuid": "f9cbcca8-12df-4d91-8ffa-9543c06a6de8", "value": "T1C5A34A0273654147F7EB0DB1283FBBF193AFD5A121A0A2C5695AEB4F8131E32154AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003006, "uuid": "297a14b9-fabf-428f-9b98-b22a3c5e3469", "value": "1536:deooH3OB6RCA6T0krLYIHiv2oOxfGVmvUg4aiAtQlaencnLMcVsFtHE4K1zdpquY:aOB2WhxfGgvdfhdpBS9J/7+T2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769003006, "uuid": "43e1257f-7b2d-4e85-8e2e-e957c78b3852", "value": 99640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769003006, "uuid": "cc2b4454-7ee0-42aa-8e6f-f15d881564e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003006, "uuid": "629511d2-8d77-4723-b2d4-5b96a48e1ef8", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2172fa-f6a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768985805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985805, "uuid": "d60c322a-9091-44d1-a1a0-1ac4aff89013", "comment": "Malware payload (Mirai)", "value": "e3092a373c0abcd89836faf67753ef48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985805, "uuid": "781ffd36-becf-49ce-89ac-0f651612f20b", "comment": "Malware payload (Mirai)", "value": "38f5e2dcbc7636ea968e7765c2ec2b8e9ace6faae5f3c067a32cbd7e151c2e21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985805, "uuid": "b0d931c8-260c-48c1-88d0-fd58110a7797", "comment": "Malware payload (Mirai)", "value": "b87ccf6e9393b479ca2fa57bcab1cd2f7b79d1d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985805, "uuid": "48b7f9da-3759-494e-8fea-055c679d66b5", "comment": "Malware payload (Mirai)", "value": "b30a67589051a4034dafa8c70598358a72ce01b40c6eca8e02684ce853b8ea3c22bd78f626f46ffa0a96a35b0ac39847", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985805, "uuid": "2d26eeae-b481-4ee5-9a7d-657e69142b53", "value": "T11733F1BE391B2724E864A6B9B6B08F045C6587CE951ABE58704EBCC79C494713CCBAC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985805, "uuid": "2a53146f-38a1-4a5c-ab18-32cf5184a41c", "value": "768:2e+q02Pd+7cj0hRbMSk+oYQN5Wu6Odr1AMXuVoyWzkWQ5P9CBJgGlzDpbuR1JQ:2V2Pk7cjanLPuXdr1f+4+5PUVJuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768985805, "uuid": "75d87a31-ca69-4429-b7d1-40667b3cef8f", "value": 52880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768985805, "uuid": "fef4919f-b3d7-4fff-bbf2-e1044a751f78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985805, "uuid": "151bff97-a168-4e3a-9aad-a5f72660cf30", "value": "ub8ehJSePAfc9FYqZIT6.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538b0648-f669-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768959268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768959268, "uuid": "6fe57c13-6c30-4d20-bcfb-200eed2c0fd7", "comment": "Malware payload (Mirai)", "value": "8ad3a463ebac28f8c70bbe97cf086224", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768959268, "uuid": "3bc145fc-6e8c-4a1e-ab9d-f26068b432a1", "comment": "Malware payload (Mirai)", "value": "398897f7c84071459c645495bc5957eb0df96f843c4b0f5fc981cf9abafa41f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768959268, "uuid": "581df358-4462-4efd-9afa-f0374cdb72f1", "comment": "Malware payload (Mirai)", "value": "31bf8249329461438c7ee1230512a582826aa50a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768959268, "uuid": "07d9bc59-0a32-4340-b447-c6b5dcf3a210", "comment": "Malware payload (Mirai)", "value": "96d538b18f8d16ff07e61bb38dd14a8e2a5fa33df82a6234b37d12731151561807e27c67cdf2747c8ca905dd064a129b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768959268, "uuid": "13534de2-476f-452a-bb3d-6019f2e7942b", "value": "T17C93A50E6E218F7DF76D863547B78E35979923D727D0C644E16CE6001E6038EA81FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768959268, "uuid": "2f4c3910-4eb2-47a9-9272-ade3f6c579a7", "value": "1536:0Liww5KRGi2qGj5sAqNfOGcBax4QH7xCyeggOj8svQ2W3B6moM58EQo:0Liwww4iwMx4KdqggOj8+Q2E6mt8ro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768959268, "uuid": "03967c9b-7f58-4466-9f98-8fd9f2525ae9", "value": 96736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768959268, "uuid": "9d53cf08-8a38-41d6-963c-2e91eeb4ee89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768959268, "uuid": "2fe0c8dc-3460-4464-9926-01af635d7ca0", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc78af01-f6a3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768984381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984381, "uuid": "4c220815-4365-48eb-90da-b8117d95c860", "comment": "Malware payload (Mirai)", "value": "53e0a05d45d17cf13803e81aadf6b326", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984381, "uuid": "b1e8cd97-4664-4535-b495-6511394fb312", "comment": "Malware payload (Mirai)", "value": "3aca404aad07d2f41b0572148b28433b7b752a77e1fd5fed7bbdc67824e75b12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984381, "uuid": "f8ebb4a4-ae53-458a-95f5-92dcaef8271b", "comment": "Malware payload (Mirai)", "value": "1ea15eb21e37c6bf637f50dd05cb950cc44968af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984381, "uuid": "a9245554-579d-476f-88a6-51bde4125cda", "comment": "Malware payload (Mirai)", "value": "556bbda00ebebfec7e8d544ea108f720898dec69da56d76294c4755730dfeb8148f772c777587e0d14fef86e9623ae1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984381, "uuid": "74cb1ef6-22ab-4782-9200-ffc3c5f09dbe", "value": "T1CB23F24BD4740380D229497B503F791F1C66B1387DB088662AC966BE99E7FB3A53CD2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984381, "uuid": "bb1d3321-a04b-4115-85df-fbf559eeaebf", "value": "768:I2TY7XorLdkTJOU+qLQVNsXI734SjvqZhu3NjSWi88ZKRm/nJYdYaD9xuUI35oVM:3YsSTDTILXKuVXdROJfaxAp5o3nouy8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768984381, "uuid": "5e22ce5b-5d44-41c7-8f6b-624a10f9d78a", "value": 45784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768984381, "uuid": "e982e510-8218-4c61-9a1e-162c979fb4a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984381, "uuid": "6aab7513-7aeb-4c46-8676-3ca587585b2a", "value": "Orbt.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f59fc3-f6ac-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768988264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988264, "uuid": "3492f5b7-c0a7-4c9e-94d2-ed9dbc68b68d", "comment": "Malware payload (Mirai)", "value": "62a31749af8f7607d0527362d0608204", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988264, "uuid": "1a234f86-75b4-437c-8bfd-d476f3665cce", "comment": "Malware payload (Mirai)", "value": "3aeacb115f3c46344e9b3a7795af15b3b989126d8b2755d577e01eb06c5c57f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988264, "uuid": "e7bca9df-582d-48a9-9efe-441d7f5b8070", "comment": "Malware payload (Mirai)", "value": "168bde933299ff74a039efd6e4f70adbb0d19d64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988264, "uuid": "d8121430-9693-4a1b-895e-69fc479ff72d", "comment": "Malware payload (Mirai)", "value": "b05dd5aa7040b0fd01fbb6bbe9aa6a3325648c2aada5d26027a31fce420b15e291fe1545cd4b3e7007471186df221ce3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988264, "uuid": "04517848-c3e4-4cd9-953d-68392242f3f7", "value": "T17663E8567C914B2AC2E023BABEAF459E332173E8C1CB7217CD9057167B8691F1D63B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988264, "uuid": "8729c391-0220-4154-95e9-28f8a0cff318", "value": "1536:w7aiImGLtRmMF6HuISEcXUYDltEZ+08guzA2r/UeI4NRr56IqvtlCOp/btU5TPmO:w7aiOguztZRZyVlTph8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768988264, "uuid": "f959c977-bf81-4b4e-b51b-cfb5d85ccd19", "value": 66996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768988264, "uuid": "1967f4f4-f4e1-44d3-bfed-e1187ec4d4b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988264, "uuid": "88cf05ae-1e2d-4252-80c3-840c2fe0c064", "value": "sdxkzX_UXA229x.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e8ce66-f6d1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769003963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003963, "uuid": "56e16705-42be-434e-b35f-84c56cf8bf11", "comment": "Malware payload (Mirai)", "value": "7683a863ae4ae3b623606a6d6a232c93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003963, "uuid": "9582918f-27b4-4b9c-88b7-cf664585a25d", "comment": "Malware payload (Mirai)", "value": "3c4697891ad492001f880868fe557f2b1b4627ec60a2058e6ffa57bd5934243c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003963, "uuid": "44663d36-d378-4528-a7b2-9746a0598739", "comment": "Malware payload (Mirai)", "value": "efc59c2408565626259bb89130f9575eae00de61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003963, "uuid": "6a33bb38-ca28-43f6-94b7-b9e879f9d170", "comment": "Malware payload (Mirai)", "value": "ffcffd3edca4e30ec4fac58a39b31e00654bbd3cc834b2912c3a1595be47d07a344115a4fff09daad54bc0cffa45d434", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003963, "uuid": "07f8a0d3-c799-4d7c-88ff-6487c6d0001e", "value": "T1A9A34BD7F401CEBEF80ADB7B44570A0AB635E3E106831B276757B963ED321951862EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003963, "uuid": "4e87542b-d5bf-4c8d-8dbe-df7f16c4d26f", "value": "3072:WtQIMfjbhxIbhhTykLVGSyYYZmdCu3IKDMqez:FezykRGSyYYZm4u9Mqez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769003963, "uuid": "6c4a6635-ae90-45e1-baeb-2c7d1807ca0f", "value": 100888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769003963, "uuid": "354398e9-a380-4b47-bcfd-33619abe1e1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003963, "uuid": "1b158844-fc2a-4af9-8aea-6c20b53a8aaf", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177d1638-f71a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769035188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769035188, "uuid": "7cd9ba72-5b66-4e9d-baff-b478527ebbb1", "comment": "Malware payload", "value": "456f2588e7790fb14fb0fd0ae9f0ac3c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769035188, "uuid": "dea2d31d-8f94-4c7b-89cb-9a4fd91f6629", "comment": "Malware payload", "value": "3c5a05002285a08e318b47a50023a8a784c94333a423d73d12178391624f395b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769035188, "uuid": "6e652b82-52f1-4039-af1b-ff9a8a8a86d5", "comment": "Malware payload", "value": "aead464ad6f544d4460d08edfa992719c67077bc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769035188, "uuid": "56eb0c26-5073-4dfe-9ae7-a957c8b80b24", "comment": "Malware payload", "value": "7baefec1dacc0873534cc0b69d6faa1dbe3d67a121868d329278ee716499b2dee00e60d392d5b109778fe70c8459b39d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769035188, "uuid": "5cb16360-ae45-4f4d-a951-249341db4738", "value": "T1746484257FA58E10D481287ECA7F3609CB16E0F125026347370AFAA15D05ADEEE6D3DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769035188, "uuid": "bf6127e4-1011-4951-ad88-aab1701d54cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769035188, "uuid": "029ed38c-d97b-4c07-b278-3be8bc5f4d16", "value": "6144:afKjtV1n+geKyiVdePt38rueUmg6fxKYskqbxPf5xP:EOtV1nzyYgI8YCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769035188, "uuid": "5a5ee456-8604-49e8-97c7-c13756acdb88", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769035188, "uuid": "bbb35a0d-bcd6-4f34-92e4-08b53cd7f9bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769035188, "uuid": "da446622-c5e3-4a36-93ad-5be3b86f4628", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06357127-f70c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769029146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769029146, "uuid": "0e75e228-dfa2-4f58-b151-0ccc99ec820f", "comment": "Malware payload", "value": "9a4dcce25a87819585aa0a1dd16186c8", "object_relation": "md5", "Tag": [ { "name": "Deadlock", "colour": "#DE941D", "exportable": true, "hide_tag": false }, { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769029146, "uuid": "4c49b958-611f-46da-84f2-870741069b95", "comment": "Malware payload", "value": "3cd5703d285ed2753434f14f8da933010ecfdc1e5009d0e438188aaf85501612", "object_relation": "sha256", "Tag": [ { "name": "Deadlock", "colour": "#DE941D", "exportable": true, "hide_tag": false }, { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769029146, "uuid": "665a7568-bad8-4c74-b2d4-944bc477beb1", "comment": "Malware payload", "value": "45f7f7e87d18fbe71745a0cc170ae08571c2ba0d", "object_relation": "sha1", "Tag": [ { "name": "Deadlock", "colour": "#DE941D", "exportable": true, "hide_tag": false }, { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769029146, "uuid": "19df0bae-0a61-4776-802d-14d073aba87a", "comment": "Malware payload", "value": "22025dd8c284157d8b0ba42c461953b0a5762a70b3408939dffcda749d70c77f81cd78c30809299cf2428ea4cd891baa", "object_relation": "sha3-384", "Tag": [ { "name": "Deadlock", "colour": "#DE941D", "exportable": true, "hide_tag": false }, { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769029146, "uuid": "c6c1fde7-2449-452e-8c3c-81332f319c29", "value": "T180245A42FDC65DF5D9CB0CBC242E633AC62999015736C593E7A01E01D8FFF62B9A910A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769029146, "uuid": "d5508e09-1603-44dc-87e1-fb26c51185d7", "value": "7daa8819b66d832b25b4ae23099d46e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769029146, "uuid": "4bb48c39-9e00-48a8-8625-986ea96078ba", "value": "6144:KnL48u9ybRiDKCnlSTlqe70G+p9O1MZmm:KpkhpnlCP70jcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769029146, "uuid": "c93aa6b0-9b3d-4068-8d06-1e5bbb82a088", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769029146, "uuid": "b84788c4-991c-4988-996d-f9ffba940f4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769029146, "uuid": "f2743be2-8953-4191-ade4-0b2cc99cfe36", "value": "3cd5703d285ed2753434f14f8da933010ecfdc1e5009d0e438188aaf85501612.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f9e442-f6a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768983478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983478, "uuid": "bc24f5fb-4082-4bdc-b22e-f1cacc110eda", "comment": "Malware payload (Mirai)", "value": "ce23ade4d3afa7795ae2844ab3dcef90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983478, "uuid": "7d6eb81c-e506-4131-93be-9168fa365697", "comment": "Malware payload (Mirai)", "value": "3d96445a69b421d72c41b69465f75caeb20734288e94ffe9918057d558f4aefd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983478, "uuid": "1a481a2f-7a03-4b2f-bb33-641e50ac8811", "comment": "Malware payload (Mirai)", "value": "c59e62e946fac9086ddc21ced72c70b970e6221f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983478, "uuid": "fb405df5-92eb-4669-8960-c6fbff230995", "comment": "Malware payload (Mirai)", "value": "7f0c3ca8ef827950a40ac305207834813af1ba86284fd7efce6acf5d6473f0e6a73f251071bff472ab1a62831136dff9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983478, "uuid": "d4374c95-56c3-4d48-9b0a-e35aea647e0f", "value": "T108E23A9BBA92883FC9D04376BAAE116D3302F398D1DB3B07DD198B5532CB54A9C5F940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983478, "uuid": "211fbdec-874f-4d90-b779-434055dea053", "value": "768:x3e/LDSH37TtcD27JPYc/FN4bVDt8YzA1FmR6moS:NeUPCwJPrT4pp8Po", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768983478, "uuid": "1a951c6d-8997-4229-9bb3-c3625254761d", "value": 34096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768983478, "uuid": "e5cfd7f0-bea5-4ce6-b993-c7c3859e6ba2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983478, "uuid": "9b756d89-d803-46a5-b256-4c2c93617c4c", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a30f5b-f719-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769034730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034730, "uuid": "73d8d06d-fa7b-4751-8017-0313bbeb8eb4", "comment": "Malware payload", "value": "6298339e4a0a36328d4426cd82b3f013", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034730, "uuid": "86c079e7-0571-4d5b-a1b0-f744e5bfa5cf", "comment": "Malware payload", "value": "3d9b7e615ba9ae046dc6c535d3d7fd6c1f23af253651bec59c4bb4fa6cb464b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034730, "uuid": "e0e3eb01-cdaf-4a8b-8ad6-6a6b29ad6e2d", "comment": "Malware payload", "value": "7807186be52288e85de025464d7bd37c8205ff1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034730, "uuid": "2023b98d-9f2d-4ab5-bcb4-dd91896ce8e1", "comment": "Malware payload", "value": "bbf28a7383991721bf2a892398547eaf147ae522fccf033aa797f595c1077ddd07bbc4c69888fc56150ed6925cdd5915", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034730, "uuid": "f89e0577-30cb-42e4-8543-34dac8348700", "value": "T1D6331985BD829A17C6D4533BFA5E43CD372A63ACE2EE3213DE155F1123CA42B097B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034730, "uuid": "9cca1899-ab1c-4277-a8e4-83445bd7caba", "value": "768:iP5GAh+0w0OOTXnOwENV5NWgK6r+K53x4zvOiITCRWyvbwC9pj0jmV:8Y0Uo1ENz7L53ezvjzdvx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034730, "uuid": "dda66002-9dc4-40d0-9d20-11c9d60a256c", "value": 54480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034730, "uuid": "fb1d833f-3f31-40b0-afce-b62095822ae7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034730, "uuid": "a927f700-dde3-4d76-9868-6662b60bacd3", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2d68a5-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768998635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998635, "uuid": "414bc410-c3a5-4db2-8273-c7d80efe44b0", "comment": "Malware payload (Gafgyt)", "value": "66a527254d7fab98d849f2224d5154a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998635, "uuid": "772d5fd8-95e4-4530-9b8d-3be3548204bb", "comment": "Malware payload (Gafgyt)", "value": "3e10466a152176eef2d156cd458479016a300859c3e50643e670bcb8cbcff62e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998635, "uuid": "1d369948-9bdd-4d19-96c2-3c33e61d6fec", "comment": "Malware payload (Gafgyt)", "value": "0ae547f84b46291554a80fd5b564185650e5f5cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998635, "uuid": "e61c53af-0d3b-4654-8937-6518a467e7d1", "comment": "Malware payload (Gafgyt)", "value": "62aba681096c4090a1320b4d4dfd69c06992fefce6c61a4fe0fa250d30505636bec5afdcbf0e8132cc7f5a4325fc6cf4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998635, "uuid": "6955fb76-5931-4e93-b04f-78cad91fd1a6", "value": "T17D737C80FBDFD1F2F5830670016BE77FD7759D018015DAA9EB0A3AA5BD72B12851A22C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998635, "uuid": "5bce9fe8-c80b-44e2-a228-9180887c8b6c", "value": "1536:yTZi2qKsHwhhTy/t+xkaWiTivZEQxporE:gQFQjT4t+qaW5LME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998635, "uuid": "511b9650-c641-4edc-a8ff-8e9df378ac37", "value": 75160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998635, "uuid": "6b0032d5-fa65-4596-ad10-56f844e170b9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998635, "uuid": "ad5e4e83-a269-4a94-8303-a965818be3f5", "value": "plasma.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7f4df0-f719-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769034899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034899, "uuid": "30cb9e93-41e8-4beb-9412-f05313b2b743", "comment": "Malware payload", "value": "24aa6f63746125bd2cc2e65314ba88ab", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034899, "uuid": "2197db26-e1bb-4ae4-8e7f-24130c7ded3c", "comment": "Malware payload", "value": "3e395e3055bec188bd0d904eace0862d2cd01eb810703a25e254e2de344fbc4e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034899, "uuid": "537e3c55-dc52-49fc-9523-ddc28ce02fd9", "comment": "Malware payload", "value": "6ceb54be3611ae12c567460e594ba18e72584022", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034899, "uuid": "1c965e3f-776d-4ed8-9c74-7731c368e943", "comment": "Malware payload", "value": "866c57a2cb36f2ff16826b193861e5cb5da5fa2e2296cf5491c789a52961aebb48563e5c8b2d78e1bdd1062ca72b8dc4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034899, "uuid": "6f6004d2-1976-49bc-bc25-f486e580ea2d", "value": "T192010CCE69913EA586348F28B9734528700D81E5FA634688D997083A8CE4B057558F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034899, "uuid": "b9b4b296-de19-4a71-8518-27ceae9e5a26", "value": "12:xVHDVHTSVHjIWNVHyeYVH6tVRKVHnSYVH4VYVHeVHpUVH3RVHTgOqXUn:WIqjtIOVr3TUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034899, "uuid": "3e9cc218-a6d5-4c7c-9ec8-938112013f2c", "value": 729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034899, "uuid": "ec5587cb-4253-4d65-869f-ef606062e0c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034899, "uuid": "30934a44-5899-4fef-97cc-b580a20ade9f", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392a0292-f6a7-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1768985852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985852, "uuid": "46baa3a8-0f6f-4165-81ff-f3ad440d8f94", "comment": "Malware payload (PhantomStealer)", "value": "73df60d90907cc134870a73d83889d91", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985852, "uuid": "cebf9724-9884-4b47-86b8-f6682cfa72be", "comment": "Malware payload (PhantomStealer)", "value": "3e4c84d1606995d10df25a09c9b31e68a028a3c10f4e226d316d8cb5fcbbb1ee", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985852, "uuid": "a6ad0c13-c632-4d34-bdb8-2f128ea54ae3", "comment": "Malware payload (PhantomStealer)", "value": "d25f3f40acdcf2fa2ed723b44d74b6875d7cbbb0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985852, "uuid": "00edd591-2e14-43cf-a320-b73ea1e8e7e1", "comment": "Malware payload (PhantomStealer)", "value": "eef1e4135261358b0a4d06990134084bfaedb5c94a86f2bac37b5a2394a54677d325b4eab4b0b9c4cd3f5a30c2661358", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985852, "uuid": "2d85e731-8851-4e2a-8624-bf954784d990", "value": "T1E963DEA2CDD949DEE56A3B7CA00495C41CDD8B0147448E0DC6E2A9CE9BF77E4722BD38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985852, "uuid": "234d1f9d-b3aa-478c-a3b9-725fa7dab7c0", "value": "384:UuiKyFcEYrSo1bkXAXkZUgVQ2cl6oXXU/VD/J/k0UBwT6Iix8oIQz0JqBEN0LHq2:IDB5KegqO3SmLBwMDZgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768985852, "uuid": "1be94f2b-5597-42c6-a9f4-155d8acbb6ef", "value": 71454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768985852, "uuid": "6d7a7be7-95a4-495d-a74e-5e70c7d94458", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985852, "uuid": "01629dc0-b769-4a40-bef2-fef05d79c010", "value": "nIeAoji 123.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f527440e-f719-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769035130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769035130, "uuid": "00be08f1-575c-4654-b7e8-1270e05e9ef2", "comment": "Malware payload", "value": "e856adff8219de7a207976763ce7a43b", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769035130, "uuid": "a8de2b91-af4f-4cf1-8430-a097161329e1", "comment": "Malware payload", "value": "3e881b363af7187b25159954d85d95467a3e64ff75b4083fa0a6908f59c62dad", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769035130, "uuid": "ca6e67b4-bb78-45b2-bd6b-72424c4d0ea7", "comment": "Malware payload", "value": "7ec3ca5dedb46350b3db8e6cd74b37b4e95700df", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769035130, "uuid": "71f0a11a-68b3-4973-8aff-3df51bc0b49e", "comment": "Malware payload", "value": "f80688809215b2bab4c82c4ad12a1d8678ddd57d23c043114eec91ec24387a7a28138f08e01208903328f4217bb6205d", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769035130, "uuid": "3a5d684e-3817-4453-b9dd-145e293bb916", "value": "T1CCF62332670B6B3AD83955B749A2A908943F6970701BC87399E00D5CFE79A5D3D2EF03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769035130, "uuid": "f11a7f7c-492c-4309-b271-13599bc75c90", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769035130, "uuid": "19e7b930-5939-44c0-b471-907e6793dd3b", "value": "393216:aDY23TkHF9rkSEtJsOPCldOU0ngm3fuujN6K1fKi:n2Al9rDEtmBOnr3X6K1fKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769035130, "uuid": "c9305305-c807-4ebb-9758-1371ca072560", "value": 16192157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769035130, "uuid": "662839db-c0f7-4455-9970-c2f3d4bb0b7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769035130, "uuid": "b9fd54d6-1e40-4c8d-afce-682526b4432b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53893925-f6bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768996204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996204, "uuid": "1cba54a4-d667-423e-9aba-4173135ab63f", "comment": "Malware payload (Mirai)", "value": "74c4d78d6178a087d6082239412591fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996204, "uuid": "cf77720c-cfd8-4467-baa8-39b52ba53055", "comment": "Malware payload (Mirai)", "value": "3e984bef22341c8444fe18d836ac38fb41eb2c27f1d499bc122dd06d01fd230a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996204, "uuid": "a43dd7c3-8c5b-4ed3-b852-4e6e36a10482", "comment": "Malware payload (Mirai)", "value": "25356f23152e5ece57a7e559ce164177efc3d36d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996204, "uuid": "8c2db93e-90d0-4e9e-b1ba-1563a5002330", "comment": "Malware payload (Mirai)", "value": "ad3e5590f179456a3cf28bd2122e0c764cfefe40d1564a61e83121c47f247075aa98396dc7a68b330a3a2789cd3f646c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996204, "uuid": "8270b963-df80-4065-962d-bea406874e1a", "value": "T14083F79278C29A16C6E423BBFA7E018D332567A8D2DF32179C212F1577C981F0DB7691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996204, "uuid": "02d5cb14-c67e-4dc1-826e-284ef5539495", "value": "1536:8sCvlPf6NDyL9Jb0+pHXlzPhha0xTElkn6ahWNr1UKW5fnHM35g7C:8sCvlPCuTxikn1hifWO36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768996204, "uuid": "ba2c3a8b-c62b-4d6f-8db2-4bbf9b212eda", "value": 82940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768996204, "uuid": "bc37fd55-cec7-4805-8eaf-cdb5c406968f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996204, "uuid": "e5373a71-e10c-46f5-9111-37bb1dc792ca", "value": "UnHAnaAW.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7935289f-f6de-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1769009582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769009582, "uuid": "8ec8bb99-aec4-4c50-bc0a-622f9f33f60f", "comment": "Malware payload (DonutLoader)", "value": "75d5560fef79382236849f74bcb5c826", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769009582, "uuid": "db610adb-c769-45e5-8e26-49429fda2adb", "comment": "Malware payload (DonutLoader)", "value": "3eddb698899eb7ed1e868dec9ce76097dc03109388e259117dd82fab00eb2677", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769009582, "uuid": "e49b2656-7341-4e83-bc25-efdbec73cb69", "comment": "Malware payload (DonutLoader)", "value": "21a9a97cb2e94795642be1bb2b830415f5b3021f", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769009582, "uuid": "ca8bc8df-7675-4c8e-9f8f-ca3efae5105e", "comment": "Malware payload (DonutLoader)", "value": "e84a4247145597c8431667f84bf3bc50be87abd14b18225f5c0ff2a4ef9b415314d6ab1942e610cd8600fa467b0a665b", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769009582, "uuid": "0da8c435-c2b5-4ea4-b72b-491820dd7e24", "value": "T13F670103F5A05034E4B73232A53E633E8D327E629B3685DB97846CD46FB42D1653A36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769009582, "uuid": "8ba4d20d-54c1-4145-b2e2-e3b585559170", "value": "d221b1dc8c3a08622f6512e7876527c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769009582, "uuid": "316a7faa-4ef0-4f01-9a0d-ded3c5599d38", "value": "786432:CoYEMjDcz0izBlrTc3Z39EaQ+/uAcgNzs+Z2MvJ4E1SZ+0Jm2s:CoYz40izBlr431CEcIXZ2M+EsZ+Gm2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769009582, "uuid": "66494c4d-7d62-46b0-9372-f5fecd4bda17", "value": 32631598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769009582, "uuid": "a00770a6-394e-4743-908f-fc2015f5e730", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769009582, "uuid": "5cb783d4-cc8a-4fe1-b453-d3f5247d524e", "value": "Chrome-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf8d091-f6ca-11f0-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1769001158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769001158, "uuid": "13d5e2ad-6c10-46a7-b909-2e69c9b5aeb8", "comment": "Malware payload (SantaStealer)", "value": "6233c2db5bd867b730b19a36df89ed96", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769001158, "uuid": "af490efc-93b5-4ed7-8b96-124e856f454b", "comment": "Malware payload (SantaStealer)", "value": "3f25afe7c666cd7b51c2343a58b93ee844da891df2372e66b75238fca8caf397", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769001158, "uuid": "f82839c8-571e-480c-a5aa-618184210579", "comment": "Malware payload (SantaStealer)", "value": "282260e54433f2831fc13663a7a8b7d08bd0cacf", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769001158, "uuid": "c7d22f0c-4162-48aa-b380-19fe4efddbaf", "comment": "Malware payload (SantaStealer)", "value": "c8c1a79e2c93318e9c663d65fb3587cca72ac0295d51757ba228dd4af71db7ebee1e00b89e8af4271549629e6afc2e02", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769001158, "uuid": "3a223f05-dc29-453b-81dd-e0cbf3896691", "value": "T1BA76D0CAD16B00D6CC067FF598142BC39B3056324A34046836ABBE595F779FAC11EEB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769001158, "uuid": "99a0fd22-8606-4497-bcbf-b1a2256e2f6b", "value": "09bf3c2c0d1e1c721043f5ca267758f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769001158, "uuid": "366ba0ea-32a4-46d0-84bf-45fd92ca6fed", "value": "24576:GdmqLhfjODCamuy3t5cWiOSrOtsdKZOXXQrfeKNw5M38hbcRtIKQjlPjpd4cvKXs:GM9e+6+N69k83XbIB/X/EZo8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769001158, "uuid": "f57da18b-0bc9-4b66-a910-162431e5d35f", "value": 7204864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769001158, "uuid": "04ae97f7-a50a-4d4e-ab28-6a412aff3296", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769001158, "uuid": "6cf6302a-22e4-4c78-9fd1-0977a85eabac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64797df6-f6c2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768997521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997521, "uuid": "0a98ca7f-63c4-4a39-a239-655c123b1d32", "comment": "Malware payload (Mirai)", "value": "e2864d8b3ff354dfd7f7f2df614b5c70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997521, "uuid": "09341174-a796-4b06-9780-cc5230520a2c", "comment": "Malware payload (Mirai)", "value": "3f66bb1bdbed64a55c27a7b3ed2c96800221bbefef8b2d1520a5487b812f1946", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997521, "uuid": "20852b7d-6be5-488e-8341-74557730f4e3", "comment": "Malware payload (Mirai)", "value": "2f5ba19bf8714d7321f28122d8c245abbb0b2a00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997521, "uuid": "bcae6bc5-2b56-4fe3-a61a-ec1a0e8ac2bc", "comment": "Malware payload (Mirai)", "value": "65930392dfb55ea14ef49d09956a11bb7bded4ba20f49c391d1eebdbb8c74936e863b88fae1a60ea5a5602e0dec68937", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997521, "uuid": "cf2889a4-3c3d-458d-86b6-76d263a596cc", "value": "T184C33B0673190E83D2665DF02E3F67D3C3ED9DE021B4FB8C1A1DB68991B1A361586EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997521, "uuid": "5addb280-09d9-4633-bc2c-46889682eae2", "value": "1536:ULDsyrPEk0GoeVwWcZ4CL0SVvLo7Ar8WoJNMmnOUrOLq8XFrNeF1xMjZ90OqLb0U:UX9oscuCLHtE7EwTRCTrNuvJIjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768997521, "uuid": "961bd399-55fa-4b0c-83cc-14f528da68e4", "value": 125024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768997521, "uuid": "38059bb4-85c1-4b2c-b838-d29dc0ecfc14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997521, "uuid": "54836118-3a16-4353-97cc-450a1566133e", "value": "goon.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d552ec-f6ad-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768988336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988336, "uuid": "08b64df2-14d6-49b6-9cef-c58f7d5e59fd", "comment": "Malware payload", "value": "9645a736c292b3d54ee17b05dd081994", "object_relation": "md5", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988336, "uuid": "3043a2b5-93e1-4c6f-a3de-6e92c3504954", "comment": "Malware payload", "value": "4009e682ecb9847b8750c64c6bd4ec9a3f4fd151cc7dc0b97009702793bb1209", "object_relation": "sha256", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988336, "uuid": "2040d39f-bcdc-41c6-905a-f49ae70333b2", "comment": "Malware payload", "value": "e548ccf570dec166205717b8a33511414d996423", "object_relation": "sha1", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988336, "uuid": "dc9f7c73-5179-4cd2-91ab-c9ee69b8c8fb", "comment": "Malware payload", "value": "a63ebbfefe8e3d022d4a625f7c922871ea11b69213e903a907eb5714f5c34221799e22ae218d4766a34d9b243f9c73f4", "object_relation": "sha3-384", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988336, "uuid": "d99cf03f-6dea-4fbc-baa6-75fb4761413e", "value": "T1AD6402AC74B1B95AF9D8037BC6C52CB6DB2CB540D7993D9BCE204046BD8320E5F6A871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988336, "uuid": "f3ba68bd-ffec-405e-8cff-e890c92fd979", "value": "768:mgdv8iYVfHsN/fqkegQ8sSWdP6cB9pYLvWq3keUYULxAL2phZR/8bj:uiYVO3qkeREyB4L1UxgG5EH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768988336, "uuid": "29ec90c8-f487-45d0-87dc-ff1fdc05d42a", "value": 313780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768988336, "uuid": "2a30fc2d-0c51-47ad-910c-5a4229cff48c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988336, "uuid": "c86d89a0-545d-454d-929d-5ff982bdd425", "value": "UpdateDriverSdk.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e7400cd-f6a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768984573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984573, "uuid": "71847b83-444a-42a4-ad13-4995b609af70", "comment": "Malware payload (Mirai)", "value": "ac146733e21ce306782b7d9d83989e17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984573, "uuid": "e853a86d-207d-48df-b79e-0921cf24f3a8", "comment": "Malware payload (Mirai)", "value": "4020f2e9dd8730b6f8062b100a6fab4d4a323ab716f9e2538a3e82f600f490bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984573, "uuid": "e4ab912a-0b54-4a58-b1b4-236be8a7c180", "comment": "Malware payload (Mirai)", "value": "8253f73e8e3d9c90e26ac01d3ee54048982d4e60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984573, "uuid": "74f4b47a-2569-419b-8839-f4ca42cf4ce2", "comment": "Malware payload (Mirai)", "value": "876676d89093af8ba619c5e6b19cc3c63f5a1ab3eca5e48bf54f258e98a3845d84d1148f7ad7b3ff72564c7756fe66e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984573, "uuid": "2826a014-4df1-4a6d-8bc6-fe4828359d9b", "value": "T143F33A46EA418E13C0D61776F69F42493323A764D3EB33069928BFB43F8679E0E67512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984573, "uuid": "1f69aeff-3aa7-4be6-8a2b-38786f446c88", "value": "3072:rLAJMFvENO17/wa72aTl1yLRlfaNZrm7VwbZnYS25R8M/9YtFRGtEi:rLqMF8NOFwa72aTl1sRkNRmpwRYS25yw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768984573, "uuid": "8fd63539-e331-472f-a774-d67e3954e683", "value": 165739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768984573, "uuid": "deebaae3-b6a0-44a8-8c74-48c1ccf23a8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984573, "uuid": "7321c1c4-46d4-4d40-9e74-5f71394edbb7", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4364bb55-f69b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980715, "uuid": "e3f17c52-752f-4c09-84dc-75f952b370f5", "comment": "Malware payload (Mirai)", "value": "2a1bc55ee69e89c8a632736bd408b4e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980715, "uuid": "873041e0-d902-40c2-b242-0640c1168e28", "comment": "Malware payload (Mirai)", "value": "40cb9b33a953cb7c415d91e8cc9e73053dffc060f213ca4c9ad233d9ae1d399d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980715, "uuid": "97c82852-1720-4c05-8719-4d22e9a3d304", "comment": "Malware payload (Mirai)", "value": "9baed7f3b6f20c5349f3920d6dce348452e37d84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980715, "uuid": "7505e18e-de83-4893-a065-fe1c036e0531", "comment": "Malware payload (Mirai)", "value": "b983618a565191286b5c7e5a6d67c3146a02cf4443b77b2661d600a2c132172a1d2e236f92e4d044476c49abf9d09312", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980715, "uuid": "49f22b22-8fa8-4ba2-bc2c-9a471147df8c", "value": "T14C03F1B2E2995E68D87BC33688CA728A0464834671605CA753CD547F6C23B714B6DAC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980715, "uuid": "abe9aaaa-1149-40b9-9d9e-d600de391320", "value": "768:f0ring4DeWeCDEgF+ZL/Qhf1kYeluOVzOxtmIatQDmqEx7Le/Gx6nbcuyD7UHQR+:fci+WJjF0DQfkBluIYSKmqV+Qnouy8H5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980715, "uuid": "dab1a349-c66f-4e51-b2f1-edd38c84057b", "value": 39940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980715, "uuid": "f0fab294-4e5c-43f4-8ce2-8cb7e6a2c0bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980715, "uuid": "6cd0b37a-e6fe-43e8-b70b-744c0e589fb8", "value": "ub8ehJSePAfc9FYqZIT6.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44014e1-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Ngioweb)", "timestamp": 1768998622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998622, "uuid": "4654cfdd-3f60-45b9-84c9-b85fbc58ce35", "comment": "Malware payload (Ngioweb)", "value": "8a62597e61b0f37fd264874aa59ba88b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998622, "uuid": "aebae9d4-970f-4291-9864-bbe02f44c9f1", "comment": "Malware payload (Ngioweb)", "value": "4108b76dac77939f935a6824a97ba769debe570ddb63481364bf74d59d43865e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998622, "uuid": "db7e6fab-7260-4ca2-869e-ebf59cb8fb1c", "comment": "Malware payload (Ngioweb)", "value": "c14ca1762046b8f26c397f7563f4cdcb9eb258ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998622, "uuid": "92101edf-a1b6-4424-b5b1-c37d87428ccb", "comment": "Malware payload (Ngioweb)", "value": "c2ff291dda5c53cf35421d540e344eff904f056b2ef53243bd35854e2a4d9fa435abfe6cb8af62254d1d43b59cabfbae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998622, "uuid": "05baf07c-9b0c-4d03-a87c-abac618aa7ae", "value": "T1C3B31A5DB4808B67C5C12236FA9F424833725B64FFDE37069918BF343BD76298E2A605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998622, "uuid": "e3b3ff69-05d6-4d1f-9c09-b86a0ee42d75", "value": "1536:i/p1/EtnoJPJmCcHbOiUNsV8qc60o6dk7MNwGIFKHVGZa4zONlO+KOZCyJIrODXI:iB1rPDiosE60o4koIwHYbWXKdy6OD0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998622, "uuid": "fa468746-9ae6-4f2d-9a11-a4d71f055172", "value": 116936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998622, "uuid": "a83c0b9e-1293-4dbe-a688-0effbb100642", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998622, "uuid": "0472af77-5399-4d49-b3d9-242f63647803", "value": "titan.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064bc658-f6c5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768998652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998652, "uuid": "2dcf0540-391b-4715-8aa1-0b74341e798b", "comment": "Malware payload", "value": "0ef4945c2e02da09f7aca4b5fed9ad7c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998652, "uuid": "61bb4146-3f0a-4ca2-8127-c99fdc07312f", "comment": "Malware payload", "value": "4139e15a5ea157971a3fbd925a78464699bb0a55cfde375ba7c54fde85b9dedd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998652, "uuid": "a8770def-1692-49b4-aa17-eb98e6b9b367", "comment": "Malware payload", "value": "4cf8f7861e57ff6e4baf6d01825fce5b20bdeda5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998652, "uuid": "f60007d1-7654-4f09-b96b-ca9544d352c6", "comment": "Malware payload", "value": "052e152558648a57361b591f75ff49733a743e8c74140fb955a4981b1e6b34e2e06e184855a42f48c2f673deda68be15", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998652, "uuid": "e6620dd9-da6d-407a-b85a-5850076adb33", "value": "T1B3014CAB113304732F6485E6D8578AA0F14273833841481FB4BEE795AF0CB94EB207BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998652, "uuid": "1a633956-f19d-4715-919b-ef43a49f5f5d", "value": "24:13++BXzjU35sRZ9ZsnDr3NoMfE9g/LYz+wy:13LXzQ35aDZqf3No6Yg/LYzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998652, "uuid": "c5ecf25d-9601-4d33-a5de-d9ff90ab3a68", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998652, "uuid": "c2614572-f3a6-482a-a29b-cc0f3fd5e704", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998652, "uuid": "5ed34656-1229-40d4-a4c9-410956df8546", "value": "loader.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa576cc-f6d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769006935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006935, "uuid": "3027de54-8c8a-4938-b15b-76c739cc393d", "comment": "Malware payload (Mirai)", "value": "19426b6ecdac36791c818bf81317fe9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006935, "uuid": "fd793545-42bb-4b2d-935f-d7da01cd8227", "comment": "Malware payload (Mirai)", "value": "413de6fa92eea42bf00006d111e92b7e67ea0ae48a05541190269d509928fd29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006935, "uuid": "c79e694d-3044-4c8d-ba14-c78f1ad7c952", "comment": "Malware payload (Mirai)", "value": "4687e2d12f7fceb155f668eb573905e74c555b11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006935, "uuid": "905785cf-0723-4004-aabf-bde170f31ab3", "comment": "Malware payload (Mirai)", "value": "c599b3a893a02cb6ccbcfd1f3a41eb5cb46753bb28c2ccd0c2e04c2d35ec456ec8b4901b498a3e5d6dc1aa7e13b33009", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006935, "uuid": "015e95b8-d29a-4acd-8a25-9ad7a2992ef2", "value": "T147D35C0A79D270FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937DE05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006935, "uuid": "1be0ba05-0c0e-4fd4-85a3-69113adce692", "value": "3072:lAFWsh8fkY6i3iP+9gK8JYYvk9d5dAl8tFEU84YT/:yssqf/3iPcgrerAl8fEtH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769006935, "uuid": "719160ef-944c-412d-9cdd-64bb297c0f0d", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769006935, "uuid": "bb285dfa-75d9-4aee-a7b1-e306f1aa9260", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006935, "uuid": "8c80974f-aeaf-475a-803d-fbbcb85d61f7", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b093074f-f667-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768958565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768958565, "uuid": "183be91e-152b-4653-ab86-3b2d810f6fe6", "comment": "Malware payload", "value": "9601283e3153779f5a7e845365fdd87d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "pluginjsupdate-com-br", "colour": "#848A83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768958565, "uuid": "b5360a8d-87a4-4074-9b29-000cfc842f7d", "comment": "Malware payload", "value": "4140d26ecad2fd8a3ea326ee49f5dd8bda3696e0d1ae6e756db6d61d70bf3af4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "pluginjsupdate-com-br", "colour": "#848A83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768958565, "uuid": "7fb492bb-b783-452c-afec-6e37541d3f32", "comment": "Malware payload", "value": "3d1eaf0777aac4c76ff406b9ecf82af7d045b8f3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "pluginjsupdate-com-br", "colour": "#848A83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768958565, "uuid": "b4dfbc17-b275-4423-affd-3ee4591536fe", "comment": "Malware payload", "value": "edf014e652e7649aabc762a61897d947f62ed549ac0e49f388a89d053805e71df65848a8bacf7244d9325db4c41f1e27", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "pluginjsupdate-com-br", "colour": "#848A83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768958565, "uuid": "74155660-e5d8-4572-a988-66582ea151a5", "value": "T16E945A0C57569F64EA1EFB3AE4710804E7B8D04B214B9BCF99D35FA21C9B370C46A25B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768958565, "uuid": "2d8c8020-e054-4555-8b39-f4c2aae216fe", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768958565, "uuid": "9109f45a-23dd-4c98-b51e-94052ff5ba88", "value": "6144:KKEPwLsnY2dnVKGdGWS0alrwh5i1DkE23ozeEk5FGeRKT+dLWa5WJ/blWdV3:Kka5i1FyoaEb+Jjwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768958565, "uuid": "6256d1bc-fb1c-4f67-a84a-cb524e8f91a9", "value": 434176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768958565, "uuid": "ada8a9cc-0a45-46eb-b6b5-d5d9e52ff0a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768958565, "uuid": "b0a72a3a-fb05-4ed8-96c4-ceada1613094", "value": "payload.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914e539b-f6a9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768986859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986859, "uuid": "4bb7576e-307d-428c-9ba5-0e18762b24c7", "comment": "Malware payload (Mirai)", "value": "62089db9816df755e447779bf4b38acd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986859, "uuid": "3924c216-c596-49a4-b3dd-277b4e916e55", "comment": "Malware payload (Mirai)", "value": "425f95a70cecc3da00b8b6be322fed919c170a0bddd8f9510e757b179fb2009f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986859, "uuid": "62a8ca58-04a7-4f4c-a3d4-19643a656cb7", "comment": "Malware payload (Mirai)", "value": "8e7ed667c2cf1e90b2d0d191cafd1ed419a2f594", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986859, "uuid": "c2b7eff8-7d03-4af8-b55b-6b5883665c3b", "comment": "Malware payload (Mirai)", "value": "463a58f4302907282e9d65baa2b5351522764d7f8cb28366c627c138c274a8be82291e468e7a752795d02d81dd6eb2d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986859, "uuid": "fbfcfce9-b0a8-4864-8e9d-f5ebb92a9253", "value": "T171732980FA4B84F5D8474830407BF23FFA71E5794070C76DEF9AAE26DD27A41A316299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986859, "uuid": "a51a47ca-3505-4c75-b6f9-e1d82ee6394c", "value": "1536:ZsYqa1+/WjjzMG6YiZdNYLSyZrZbW48FEnAjvsRJWyKTq54wbZn5n:Zr1+/Wjv6vZdNYLDoRFEnAjvsrW7wbZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768986859, "uuid": "56528f76-b610-4f1a-869f-0eb785302c97", "value": 76212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768986859, "uuid": "22b01960-e929-4283-9c9b-9412a262b6f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986859, "uuid": "f70dbc4c-2cf9-4a2d-acd9-57e98cd5e841", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce049e4-f69a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980409, "uuid": "e9e1136e-a6c8-4cae-975e-4861771aee52", "comment": "Malware payload (Mirai)", "value": "6620a47f6d3f16480ebdb687b50b6351", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980409, "uuid": "195f1170-89c9-4104-a58a-eaa2e5a9558a", "comment": "Malware payload (Mirai)", "value": "430d6b2164deb058fe20f483b99f033ef1e4487451e1b80413d1883edcfab45b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980409, "uuid": "ecd856d2-3f6f-4be3-8b6e-f5a4b844babc", "comment": "Malware payload (Mirai)", "value": "f0cba499bcdfa3a6814d3b5f8331644410a85491", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980409, "uuid": "86388e72-47f0-4b6a-875e-9d8e0cffc076", "comment": "Malware payload (Mirai)", "value": "9ae00d198a723c83db78f8425bb68652397c14553d991c5ada29b13152e2eb01fe675eaf86f53245a1cd9d4d5e084acc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980409, "uuid": "2d877b12-e1d0-4524-8373-7618961237c6", "value": "T190E319C7F800DEBDF80BE77648134909B630B79249920A377357796BED3A0E54867E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980409, "uuid": "299c58df-c8a2-4f24-ac98-895e833f1d80", "value": "3072:mkhs0yLTGEgQWjr3ZmEVZjbi5Lgz2ep83+AyX/chbu+Q:Q0wgQWvZm7LwrXAyXibTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980409, "uuid": "bc0c955b-8e9b-416d-bb38-064bf98eb48a", "value": 150304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980409, "uuid": "15825f8a-bdf7-4c82-9b85-5f2e96743d86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980409, "uuid": "09b40fdf-9236-49f4-a423-90fbad40e5ff", "value": "ub8ehJSePAfc9FYqZIT6.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9d3515-f6a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768984571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984571, "uuid": "42162a9b-ea70-42ab-8c82-5104fe44d757", "comment": "Malware payload (Mirai)", "value": "6fb0bb054459954ab5737e524e6f741d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984571, "uuid": "9b393015-1385-4034-a7d2-c5ce8e1f20df", "comment": "Malware payload (Mirai)", "value": "43f061b3363390f9a18c45ebfa7e1ecf5b816b8c89c3bab854c1949e66308f59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984571, "uuid": "a33b4000-cfdc-4987-9d0c-f1fb765d0b1b", "comment": "Malware payload (Mirai)", "value": "e23363e5da19118e55fbe579956a2a9bec551ec9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984571, "uuid": "eac3e63d-ff44-4a3b-be3c-f0f853622098", "comment": "Malware payload (Mirai)", "value": "37d57f04f7a8655f20e9873237750aee751a6565d6e5b7912270235b95f2ef1f25f56ed2bedc1fd0f0d2d32e16b415c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984571, "uuid": "aa42780e-c905-4c1f-90f9-266c0ae100be", "value": "T1C433F1E16133437DEE22527421296384FC96285E50070FED14A8ED8F4EE764B2EA5BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984571, "uuid": "9c5fe8ee-91ab-4446-ac35-bf330e5e2f76", "value": "768:+lQEuWOn7yYJQJcxD5qcWYmKfMmXs5q2JABE6o7J2DigPIkuPqtK7mux0X8:l5ZyRWD5udIoEBPaJ2egPIkI48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768984571, "uuid": "5dd23414-a5fc-46b6-9f6d-734587f44d43", "value": 51324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768984571, "uuid": "98f539da-371f-470a-8f1e-65afe1ade5b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984571, "uuid": "f7df8056-0d27-4cc5-8052-1365e968626c", "value": "ub8ehJSePAfc9FYqZIT6.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd27dcb9-f6a3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768984383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984383, "uuid": "e5b485ba-86f3-4ffd-8805-9efd6e9c0d85", "comment": "Malware payload (Mirai)", "value": "28dfb6a75d93d74f430902702e59bdee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984383, "uuid": "163da0d8-54d4-4e1d-989b-de7f73539ea7", "comment": "Malware payload (Mirai)", "value": "4409752a9a014c5699614f0f834392292cb14f889d55bd63b332a50af4c04220", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984383, "uuid": "38e0897f-8911-41fe-bef7-d58cb9497d62", "comment": "Malware payload (Mirai)", "value": "a14eff64062e6de43cccf56829bdcdbf009a32d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984383, "uuid": "0414babf-e647-4aa5-b88d-5157ade6cf77", "comment": "Malware payload (Mirai)", "value": "5fb905ed9502630fb537253b682745b2e99e60b56882fd3b65b1e0a500463b8eb0fad3e7eea3cfa84d74f38e0ddb20d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984383, "uuid": "ee4a81be-412a-406d-879c-f9fd77231ce8", "value": "T113330220D3009C9EE8704937AFB3958263B84CF855EEE0724D21C29955D7AC59F7AFCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984383, "uuid": "fea042ee-c7b7-44e2-80ac-0738d0dcf852", "value": "1536:c5Ow7WZE0mUh7JlMsUMWfoyBK4xKeqbLs:E7WZt17JC7MWfo4ebLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768984383, "uuid": "8b29e878-1374-4b5c-8c49-4e996d6fe9e4", "value": 53664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768984383, "uuid": "65f9c646-ddbf-43d2-a3f3-58b205d0e438", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984383, "uuid": "2903678c-a84c-4c6a-b611-7474d1b7938a", "value": "ub8ehJSePAfc9FYqZIT6.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a686ac-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Ngioweb)", "timestamp": 1768998629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998629, "uuid": "af006630-b8ef-4953-9d19-11b6bbfdfdcd", "comment": "Malware payload (Ngioweb)", "value": "62da5a3d00c995c8ce99cef677df84e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998629, "uuid": "96a9cdc1-6b50-42e7-a52d-a34812fa3d6c", "comment": "Malware payload (Ngioweb)", "value": "44202555c38860d1d6195e3f763d68e6b003e1e181622bd8e25ba6fac35e9549", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998629, "uuid": "fd128d12-6317-4809-86ff-7ac8760f8917", "comment": "Malware payload (Ngioweb)", "value": "f6011d06e7bb213ddcc05a3431ee5c3a908d7ecf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998629, "uuid": "d4b666c3-369d-4c52-ba7d-d7f314bf861d", "comment": "Malware payload (Ngioweb)", "value": "3cd81119cae07a9727dfee1995c3865c3df4a4786d8751437c7e8a6bcbdf2e9762454a592e0be25860b6cc604a043c08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998629, "uuid": "d18146f7-7251-444e-8425-46a8bd9c884b", "value": "T10EA30A5DB4808B67C5C12136FAAF424833739715EFEE37069D18BF243BD752A8A2A705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998629, "uuid": "0b061c0c-0ef4-4aae-b45f-9b39ec4457b3", "value": "1536:q2M6oaoJDFZk3pTke7OopuejTsZEQFeZP+FSEozxBtG7195p3GfrUJIrm2KUj/Ja:qd6AJUOoW6mafzxWZQTU6NjdV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998629, "uuid": "aa31a474-6aac-4698-8612-21b746cb92c8", "value": 103520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998629, "uuid": "81411fd3-afdd-47cc-a5d0-3649de15e34e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998629, "uuid": "3123e50a-c157-4997-958b-404d7408ed85", "value": "titan.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5113864c-f6d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769003502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003502, "uuid": "2e1643ab-bdfb-45ef-843e-86d48813cbbc", "comment": "Malware payload (Mirai)", "value": "b72c1aa4eeba0945eb33f61f3d743313", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003502, "uuid": "50e4ae22-6344-4d42-aaa1-5b4f67384f33", "comment": "Malware payload (Mirai)", "value": "4432be5763ec44465adc4d27e3da926cf803dc468c2c336a50cff59e207740d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003502, "uuid": "510e84d0-98a4-439b-8d74-8c9b80249761", "comment": "Malware payload (Mirai)", "value": "d0d0408f23e217a9ec13ba4d59f1290da9113e64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003502, "uuid": "1efdaea4-56c5-4f08-9daf-27b3660146e8", "comment": "Malware payload (Mirai)", "value": "674275b479b99be24a3bf4c4ac92d405fe51db786cfbaa40fb82082c8294627da65fdd7912a7e5c8909d783ce2a8f652", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003502, "uuid": "935013b4-8859-40a1-8e63-d66f18e4fde2", "value": "T1B3938E02CCA59DE8F07E6E3110B6CBB74717A545A91B6CF73C86C2251017A88F5EABF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003502, "uuid": "c4106dff-d9ba-4871-b30a-e75af3c381a2", "value": "1536:wq46/9K9tEn+edLVeFEv0G953EJxjLb7NFyQaL6Cxkkbs6TAbVR:wq1FOI+edLoFEbjExLGL6n0dTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769003502, "uuid": "3c3ca065-6fc5-4bf4-88f8-dad5d5f6915c", "value": 91344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769003502, "uuid": "2eec1e17-1d02-4089-b718-861badc68813", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003502, "uuid": "59a797ca-34ad-4887-b06f-06fef5771873", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89bf67ab-f6a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768983840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983840, "uuid": "d906ca8e-8ff2-4a68-9713-7ceec75f47e5", "comment": "Malware payload (Mirai)", "value": "9f1c3695f5419b0fb0cf80dba2d2bf6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983840, "uuid": "a6cc90d3-e1aa-4412-8190-312a17d14689", "comment": "Malware payload (Mirai)", "value": "44416a0e03e3023fbbe9fe9902b88fb7e91e220ba51d66e84f6e8b36b00cbe31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983840, "uuid": "da46328e-ee25-4ff3-83a5-54446088eec2", "comment": "Malware payload (Mirai)", "value": "b469e67f5f63bd42d59873ac841819095be92fdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983840, "uuid": "0290bd6f-18fc-4ad1-8b60-ddf94fefa7ec", "comment": "Malware payload (Mirai)", "value": "a0f6a2195d0dce18358a350745bd9293882645b98a207f6a0dc088cdab35611380cdf951b14ea2af27117f51a29c84a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983840, "uuid": "f6d88f37-a9e5-463a-8b71-f2713e5cfc1d", "value": "T1FB03F1C4C1FA8996E2BB21F730BB74133491F22D4E5E5272AD8C53BD9901B43EB292D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983840, "uuid": "c286efdd-1c30-4000-8715-4313904fc475", "value": "768:DS0rTPMISiNoy3D2D96UY2UJ+utnziO40/sTvOI1mS1y6/FViWis54MV+nbcuyDD:Dl0I13D2oB2Y+a2OYX1mSL/FJ4MEnouI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768983840, "uuid": "4d07e9a9-7edb-4c07-877a-0c254dc7ca56", "value": 39252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768983840, "uuid": "798b08f4-2b15-4894-a3ea-e73e3dda0a71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983840, "uuid": "478749f2-2386-48be-97d0-cfbc02120a02", "value": "ub8ehJSePAfc9FYqZIT6.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098aa913-f668-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768958714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768958714, "uuid": "7d4aace1-d1df-40a9-8da9-9fbd3461aadf", "comment": "Malware payload (Mirai)", "value": "1876d85e409c3a23ba5fc660c41c08cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768958714, "uuid": "4d0e81ae-082a-46d0-b390-597432f2460e", "comment": "Malware payload (Mirai)", "value": "448a1fc073d1db5a49295a3f6b40351c36a7888f610ab73b769dbe9892e74f23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768958714, "uuid": "d25f8605-52c7-4df5-85cd-ad11b50fb6e9", "comment": "Malware payload (Mirai)", "value": "a8bf7916f608e840f39ce9c5b2fef7d718da34e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768958714, "uuid": "62043ea7-ced4-4f9a-8bf9-54bb625e2fc3", "comment": "Malware payload (Mirai)", "value": "04d9af71c0ac31ef9d955e7a1f5f8689517f3ba64225507eb485e3564319e8b9abdc624b37aeb13a6be4964fa4216679", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768958714, "uuid": "fad5b18b-375b-4352-b8da-91fd3a79df51", "value": "T19CB31995B851AA12CAC35677FF4F428D37165398E3EE3203CD185F64338B96B0E3A642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768958714, "uuid": "6e0f7f5b-d9af-45d1-aef3-9118aa9c096f", "value": "3072:uVuyOQhM24YPBGYRWlR2q1ZGU38SeVcrTnuQH4nT4:x0hMpYPBG2WP2q1UU38SeVcfuQHQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768958714, "uuid": "61820cd9-26c4-4117-8f68-cbcb8998ac69", "value": 112040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768958714, "uuid": "4f2403fb-3a4a-42d9-b797-5d6660a1f746", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768958714, "uuid": "a6cd162f-8b0d-4453-8856-58ab7881312e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f986982-f6bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768996198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996198, "uuid": "273382ce-a6c3-4adf-8e10-c0386592a130", "comment": "Malware payload (Mirai)", "value": "08d1cbea93963f4ea9abdb668239f47c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996198, "uuid": "18602e91-9fc5-4e96-8a76-a75b4d63bf12", "comment": "Malware payload (Mirai)", "value": "448ff52d763297cc2af279e6d51d2a3956b6dc9e30c34fbc7755b62ce4b4e1d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996198, "uuid": "bc92a3c5-53eb-4fc0-aca9-40fb6fe99f69", "comment": "Malware payload (Mirai)", "value": "73159ea96e5fc1af6e9c4928210a3c405d43ba04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996198, "uuid": "6a3c4c4f-f384-4057-97d7-a3d1310402d7", "comment": "Malware payload (Mirai)", "value": "083e617c72f100232b590fc3710ee7356a72934c95878b43a7174c96e7e2e0a93cc29a4570f3b2ba3c6b5d316b7b0fe8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996198, "uuid": "d2523006-bfe8-4277-b890-85e7b26019b6", "value": "T18E835B3579392A17C0D0A57E12F74758B2E22B4E2AE8C65E7D720E0FFF50A506413AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996198, "uuid": "1ef63238-df94-4712-acaa-c79a54105642", "value": "1536:YYnJONKUq1et03jRIJQ3Jfr6fSjvsoBJ2s3WzAORch+hTF:Rx1Jzso3T3W0+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768996198, "uuid": "2d7bf331-c5eb-4504-9321-946920e9caeb", "value": 80848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768996198, "uuid": "a40fb11f-8cfd-4189-8508-396e447c47bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996198, "uuid": "d1f1a802-09c1-4f44-bed6-027cca017a5b", "value": "UnHAnaAW.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e653aff1-f69c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768981418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981418, "uuid": "ab003dcb-94b3-4502-be55-16925f26c900", "comment": "Malware payload (Mirai)", "value": "08fce81050bdd8f70be629c8aa65c5fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981418, "uuid": "0d087ca2-a440-414b-9542-531991f63117", "comment": "Malware payload (Mirai)", "value": "44dfb4a3d329e43f9c5d1963465e9ce571b9d01f95c8534798ed9155634db8d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981418, "uuid": "22c6a849-32ef-40bf-84dd-ee987c9434dc", "comment": "Malware payload (Mirai)", "value": "c7c21cd2ce8afedc44097edd8bfee0f594279531", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981418, "uuid": "699f083f-97e8-40b1-a63c-47795326b6b1", "comment": "Malware payload (Mirai)", "value": "dffe39ca07773b6940320fceffa0315a55d0e363be508991ec0959f27d3df7bac6a9561f8f6b1e51c8f4aa7b5aae95f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981418, "uuid": "2791953d-c031-4f37-bf00-d31eba2d0ab6", "value": "T179430250D3A91C93CEE97AE15CD9A9CA97F4B74EA1C8A44258C63B015237DFF4814CE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981418, "uuid": "db3acaeb-a3ce-4b14-96e4-5f851b5e81ef", "value": "1536:ENM8JDG2yIo4SMdel0DpoSnCn9tzoU6CO5B1uwLc4u+qgw09U:ENBZyR4Ql0Ne9tzFK1jc4u+qgwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981418, "uuid": "79305130-d47c-4afd-858e-488ea5f6d811", "value": 56524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981418, "uuid": "ef0d5f9e-4d32-46da-8d8f-2224fe6b43e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981418, "uuid": "4bbf0dfc-3103-4268-80dc-aec1e8dffe11", "value": "Orbt.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71510c2-f6d5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769005901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005901, "uuid": "adef2010-c0f5-4adf-acbf-62be6a24543c", "comment": "Malware payload (Mirai)", "value": "3fde9d078127e58e2b989b421f384596", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005901, "uuid": "82f25dbe-8ecd-4a4b-ab4f-3f38494dc5fa", "comment": "Malware payload (Mirai)", "value": "4566701d1a15a4a7625c5a81840334ee22b93218256c6221d3372e6e7678bdd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005901, "uuid": "ac66d618-6843-4bf1-bf21-d1b4ffb41269", "comment": "Malware payload (Mirai)", "value": "2bb2dde53cce1bc838ac84cb88504f60c9f9b2a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005901, "uuid": "a28c3b8c-fc0f-4c16-9853-e7cda69d1d57", "comment": "Malware payload (Mirai)", "value": "cdae2fb99a4eb11cf88ab99aea4eb5bb4a19063c97e4c2dfbba64a4bcb79c8859236c667289c9f38eb6ca3b86fe71e26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005901, "uuid": "ccc2e200-cece-4564-aaa2-f0197584437d", "value": "T1DCA33921ED796D2BC5C0713B51E34530F1B6539E16BC9A5B3EA31D5CEF18220312FAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005901, "uuid": "7347a681-1aae-4773-92de-b62505d19424", "value": "1536:xt2/fzOnRJXWu5rGsEJLymGJwcH4piGf5XyZ0hWTnAmDOzm7uhp:A7sm+GTL0if5C77YzmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769005901, "uuid": "e9cb2e0b-5845-4d99-a09f-d6838513c09c", "value": 100372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769005901, "uuid": "f5e91fbe-8b80-464d-8331-c7a5dd538852", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005901, "uuid": "f9e5cb2c-3eb1-4887-887d-dd1c0f36dbf3", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7edd9c63-f70d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769029778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769029778, "uuid": "a382a351-358e-403d-b5c4-4130ddb057b8", "comment": "Malware payload", "value": "4b945d82d21f35dd0f8c07568f47c4cf", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "KONNI", "colour": "#0C6B38", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769029778, "uuid": "3f8a809c-c95f-49f0-bc2f-cf300f73397d", "comment": "Malware payload", "value": "45acb82fa97c31ad41ae49c99ac8720afd7c11d9f9936dca3762be37497dc967", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "KONNI", "colour": "#0C6B38", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769029778, "uuid": "538bd2a9-7c05-4ec9-9c4d-01fdd48cf26b", "comment": "Malware payload", "value": "a57bccb6fc51186d0b6465ac9b469ddb5ff8c9bd", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "KONNI", "colour": "#0C6B38", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769029778, "uuid": "d9e65b80-1cd0-4058-a57e-27e6ff19c26d", "comment": "Malware payload", "value": "5e4a03a98367edca1d93d45167b4d55e1d3bed462c7b9cd5695ab15cfa6a31e4265179545919b0c7e969cd5f638b5af5", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "KONNI", "colour": "#0C6B38", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769029778, "uuid": "9ad41541-dde4-4f8d-85a4-d4c6d4a0d18e", "value": "T1F3D4232375F9090F73F10198EB0D2941045FA18F5A2BF164A1FDADD1A8736B18EFEA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769029778, "uuid": "150785f9-24f5-4c8e-9ffe-dd6ac20368e5", "value": "12288:aZf3TpTxEeYAiKQ94Ll4xatV0oLWCq9ASr11k+ZOFe6DwAAdkabJtCoMwooxb/:2/Qvt4LlM1Ohw2coe6HAOabTCTwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769029778, "uuid": "8a029cc6-08ae-4351-9ce2-5344843cd173", "value": 655986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769029778, "uuid": "7ded437b-bd5d-4508-ab32-0ffdc1c74cab", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769029778, "uuid": "b5ec5bc5-b7f4-4ec2-80de-d7effc6c8051", "value": "b3096199a4e7ee7a51147d734fd107e2cf8fac01c4e642c9b35b7185957721b9.bin.sample.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a400c0a8-f6a0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768983025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983025, "uuid": "05fb2ee1-9e6e-45ca-945e-82427157b201", "comment": "Malware payload (Mirai)", "value": "f70970d4c7c8570bee16b605d3c03b14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983025, "uuid": "23b6008f-357b-4dc9-84d2-d510b2545a72", "comment": "Malware payload (Mirai)", "value": "45bd68e307110a7fc1c7c0a7cb2bd4f9760952fee2d1e2c2d7deee07a4ecf5e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983025, "uuid": "a9092a14-685d-4782-885e-6553189f1c47", "comment": "Malware payload (Mirai)", "value": "e64985805a45839037da9e1880f6f65580ac9c8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983025, "uuid": "35ef627b-4724-4837-984b-8812d429ac5e", "comment": "Malware payload (Mirai)", "value": "dd34c562a4fd0ab7883ed272476a2521bf31e5708fbf37051760fedf332bc158fe94588ccd07c32c21d431bfefa3d1b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983025, "uuid": "87b859d3-2dc0-441b-a682-bd55ee376222", "value": "T10B734A037B8194FCC499C23447AFB539F972357D1239B2A92BC8FE23AD48E111E6D592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983025, "uuid": "1f1230c2-b0ec-47d9-af53-a0a14e2002d1", "value": "1536:+CLnCbliRmLXpj7WmEsf7rCMkLqsC5IRvYNh0hY07s0kTnGtCNwbZn6:NLCbQwLZj7csfWqstRvYL07s0kTGMNwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768983025, "uuid": "2ee2b48f-3230-4504-a43c-8201ae49d6e3", "value": 79696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768983025, "uuid": "44eafa36-37d6-43b7-9315-089aa5d52102", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983025, "uuid": "e943d18d-7903-47d9-8d73-74716b34f030", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc93eb7-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034927, "uuid": "324a5e20-d57d-4e67-8555-93b4230fd086", "comment": "Malware payload (Mirai)", "value": "df14c5f59f87dbcc3ef3f87c7a74fcd2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034927, "uuid": "a8ea1240-5070-4e33-bb3e-a4ba84c14ed6", "comment": "Malware payload (Mirai)", "value": "470d72e60393120b6f67c8bdbfb44cba8b42615a32f04cfce7cec8c4d0af4d82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034927, "uuid": "67a8d76d-48ac-41b2-85f7-3d200613534b", "comment": "Malware payload (Mirai)", "value": "e595266706f24333e4cfebdc855a7d18068e7894", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034927, "uuid": "7ec2e793-f134-4d7e-901f-8c6b94acdbe2", "comment": "Malware payload (Mirai)", "value": "531435004f516ae13caffe15046c4b51dbb7d70dfd2bfa9675a0186f906497975793f53e068ee16efc1f6aa78104533d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034927, "uuid": "bd7dfff0-2359-43a2-a807-7461d0daf2b1", "value": "T159930A82BB4BCAF7D40748B041E7B63F8A31F9394471C299EF56FEA5DA235C16112398", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034927, "uuid": "c15133ef-bf18-453b-acdd-344f188a6459", "value": "1536:ogC2c4y+vUnCw2vQdZScuvWAIfZP6IkbPGpeLwS9:vC2rydnCw4Qd5rpfZP6IkbOpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034927, "uuid": "d4cb88e2-6e1b-454a-bf8e-70f6ed709630", "value": 92320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034927, "uuid": "657154fd-159f-4317-8046-f9da3c099421", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034927, "uuid": "47a436df-42bb-4f7d-956a-0aab56d32cdb", "value": "titanjr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca81e5f4-f673-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768963762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768963762, "uuid": "fab73a03-9be1-4d3d-bf80-de3edd243cec", "comment": "Malware payload (Mirai)", "value": "e407705f5c9fc117ce03507f176d25b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768963762, "uuid": "b005cbc3-c8db-4502-a3d2-5ced0ef68c81", "comment": "Malware payload (Mirai)", "value": "471462310f6f727d4e6c33aa3b67032e57915ddbe692ddc848608ac0a78102d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768963762, "uuid": "851fd3c7-b544-44cf-9cf2-322634290a12", "comment": "Malware payload (Mirai)", "value": "a509828de00e01448bb9c979df8323112b5086ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768963762, "uuid": "984c1541-fed6-4da3-bd0c-3310d68811d7", "comment": "Malware payload (Mirai)", "value": "04612ef5176439e98cf8810294f978847f31daf9dcefcec7a5fa02a989a1ddf4beec3b77044f71cad9b5747d1dd327cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768963762, "uuid": "a3c33139-17f7-4ead-8eea-118458e43790", "value": "T18B631855BD929A13CAC5537BFA5E42CD3726239CE2EE3213CE149F6132CB42B0D7A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768963762, "uuid": "69f28812-76cb-4c36-ad2b-2e2bcd267580", "value": "1536:D0aCJlu5BIIjZXtsFGE/ZMfl7p8nIVGvuhyN:glu5Bp2MuKlKICu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768963762, "uuid": "835aa2f7-c449-4cbb-8db0-818f46f4248e", "value": 66776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768963762, "uuid": "8e8e3627-e344-4ab5-adc1-ddda3b4bebf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768963762, "uuid": "cfa0c80d-c8f7-4173-a563-ad4caaa9ff2f", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539cad44-f6a6-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768985467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985467, "uuid": "f8ab1a58-7f1b-4627-8fba-f574f0e37631", "comment": "Malware payload (AsyncRAT)", "value": "d42d3e8798b744f18e30615e60b719f5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985467, "uuid": "cb0189f0-111c-46c2-8c4a-fcc6eb1b48ce", "comment": "Malware payload (AsyncRAT)", "value": "477c09a67603a4b499b7c20cdbff58f33522dc86dac5af5fb6688daae57fbc05", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985467, "uuid": "ab754bb5-ae76-43d3-a757-85d19abd80a9", "comment": "Malware payload (AsyncRAT)", "value": "37997005ec99785cc937a94c1afbbe27dc534988", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985467, "uuid": "ee552787-5e65-429c-97ac-566a3b839a08", "comment": "Malware payload (AsyncRAT)", "value": "06950ff215e71332f6dddabca8c2986fd9339a1b6495f2dcda09cb5a776c8b9b907d6eb34137c12128f995592643eccf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985467, "uuid": "c3291239-d235-4201-8c51-c85b9c828d51", "value": "T1C4C2190473F58262D1ED4ABE48339200D376E58B5D13DB9F6EC495AD2A337CD8A21BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985467, "uuid": "0c55c181-1850-4274-a3da-43ac49627a50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985467, "uuid": "5820c83e-0799-4262-8b0c-bf0d8a937b98", "value": "384:p4plGkApoYzgenwQklsMymrJhxJHqqbuUsJQxnCJf+BWfXW4/1u+:p4DGhpoYEJQkiMyCJhxpFbHBFBuu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768985467, "uuid": "4b8fff60-36b7-443d-9b40-7f2c5cb619cf", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768985467, "uuid": "0bf67e31-edea-4927-9847-fb1281a886ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985467, "uuid": "1e672a24-94bf-4f9e-b4c2-6749ab47fc08", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af06489-f699-11f0-a129-42010a9c0007", "comment": "Malware payload (N-W0rm)", "timestamp": 1768979896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768979896, "uuid": "239f8afd-81f3-4667-8770-a309693c4acc", "comment": "Malware payload (N-W0rm)", "value": "7c70efa64db91cf0e276e547cd08a669", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768979896, "uuid": "5d7afcb6-8497-4421-89e2-6c6426239646", "comment": "Malware payload (N-W0rm)", "value": "480fc5d1e6a75c460ad7e654600210a2b67a344f3cd4d47a34a22470fbf1ac40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768979896, "uuid": "6291570a-de0d-4bb8-ad6f-bed1786aa2b5", "comment": "Malware payload (N-W0rm)", "value": "7b7fd96f51cd1f3b5c2348b90b1585cae2a3f3d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768979896, "uuid": "a6eff7ae-97b5-4b83-9e7b-df01067f8c62", "comment": "Malware payload (N-W0rm)", "value": "8c67d57f5e5a9101bedab669f36368c0ea88cbc11ad7a749c58ec2ca0d5057d089e0e5b7a5d12d49a4835f26da930357", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768979896, "uuid": "e0eac727-30e7-495a-8756-0a132b5ea624", "value": "T19CB733E38526C723F881B2778F0D53E8CC9CED27D4991B87C7DD9869164BE604742E8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768979896, "uuid": "ba67e2b4-e2ee-4185-a5f0-8dfb7382a468", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768979896, "uuid": "28646a94-438c-4433-8047-4af89eda008c", "value": "1572864:3o7Jht1kDDLmNfoSSRgBmOzl/RavTOwZA6wYz:3o7NSONfoSSSzLa7aO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768979896, "uuid": "cb1a0c38-5237-4a52-8e83-b4ce839f9fd5", "value": 52435229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768979896, "uuid": "7a8e2810-84c2-46a8-87bd-cf059a8230db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768979896, "uuid": "bdf66e20-358f-4d2e-9265-0bc0365d2a55", "value": "tsetup_16.4.6.2.6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4489800-f69f-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768982596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982596, "uuid": "ba83bf05-27b1-4e67-ab05-5022780a14dc", "comment": "Malware payload (AsyncRAT)", "value": "42bc8ad693eeb39790d98bf6723535af", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982596, "uuid": "1e3f1355-8284-4a97-abc1-c3bba2c542fa", "comment": "Malware payload (AsyncRAT)", "value": "48e135925c0f65084ec84ffb599f912aae84d1f0f97672760d9f2780f490a377", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982596, "uuid": "c4eaf988-961b-40a4-b7f3-3c1d52c94159", "comment": "Malware payload (AsyncRAT)", "value": "9931279e5b77fc8715e9a9b34e0f0d0b70d64ab8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982596, "uuid": "c70ceadf-24bf-4394-9997-942866f5dc93", "comment": "Malware payload (AsyncRAT)", "value": "1e87b0a5aedc7a3ebc927d68feaf8f25bdea090c33c85739dc8451f6ea77f88dfd341aca580f035363bd589f4318c7ec", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982596, "uuid": "153d0499-db22-4e4e-8435-b61573d5bc92", "value": "T1A49328302F898523D1AD4EB4BDA2460FC6B59D733112DA5F6C8434D75B7EBCA0D122EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982596, "uuid": "de5aefda-14ae-41b6-a063-08b8c4d82d49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982596, "uuid": "3a4d07e7-a293-4d6c-a1aa-94f2e279c247", "value": "1536:/k1/7X+j5B7Aam3PVybb8wPN5/IsGRfa36VclN:/47X+j5BXk9ybb8QcBUIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768982596, "uuid": "2ac37052-bcf8-486e-9d37-fbfd235ed674", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768982596, "uuid": "3b63432f-261f-4624-8076-4fa9cca229a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982596, "uuid": "97105e74-7c6d-4291-94e8-9e1cd8ca40df", "value": "TeamviewX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a0bc51-f69a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980592, "uuid": "3d6c7b50-514e-4c83-84a3-c0b50726723c", "comment": "Malware payload (Mirai)", "value": "50284d2dfab8c0a3109089f514446747", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980592, "uuid": "048afa35-1cdf-4726-a431-f96d2b47b250", "comment": "Malware payload (Mirai)", "value": "4974d13f74ab74c32f590df1ab11b9dedbed6a87b51512b01ac73891fa2fb008", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980592, "uuid": "95ac7de5-e3b9-446c-a1b6-d5211d61489b", "comment": "Malware payload (Mirai)", "value": "b74ce8c292ff93b4d4e301bc45f0820dbeb95f7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980592, "uuid": "7c526f1a-232e-4f1e-b60c-f7fb1b1ccdef", "comment": "Malware payload (Mirai)", "value": "7e3b57216cc29cb0278e28980857439f0bbcbe73efcd59ec5752e15a001be4cf29686d9c9b956674fe9c4c535fbc7a6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980592, "uuid": "7a07b0b4-1469-4c63-9443-1e49d6faaa43", "value": "T1BB93B4057F651FF7EC6ACC3B49E81705248C680BA1E93B36B934D858F65B24B28F3865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980592, "uuid": "c1d4e92c-c82b-4515-a2f2-c372a068249d", "value": "1536:pnpUY7LzPxa/iXjlaHtCA7OaP6rR+xCZ9fUfhCub:pnOuPxTXj82aC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980592, "uuid": "97621e72-df73-43c2-8cdf-a277536e721d", "value": 97516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980592, "uuid": "1d9eaf5a-a89b-4c3c-91dd-39e4af3af408", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980592, "uuid": "fe04c44a-552b-4157-83be-8aeefa89bac4", "value": "sdxkzX_UXA229x.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2863640b-f6cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769003004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003004, "uuid": "d63d6793-fb13-4ed7-bfba-6edd328c0a43", "comment": "Malware payload (Mirai)", "value": "542c31eb4b2c9e2f3b06dd9fc612ca2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003004, "uuid": "3c155b59-cda0-4e83-9330-0d250b9e854f", "comment": "Malware payload (Mirai)", "value": "4a38f1014c304ad379aa8c7de953dfe5d210249b3b03e5a20841824b475ecdcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003004, "uuid": "23f7a247-093c-4f51-9121-7cc1a91a3cfe", "comment": "Malware payload (Mirai)", "value": "aec42723cdfac8fb8468d797d851b1781dfa4740", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003004, "uuid": "ad45a52c-17a9-4112-bb4a-00eb58e90d8a", "comment": "Malware payload (Mirai)", "value": "ae900b6d684ba425759ea589db8cc71142295d130795a18a3f638dcf169a9e701323e616fdf46b485c489ae6ce9253de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003004, "uuid": "b11651b6-ac84-4ca7-9ad5-dae497fee7e7", "value": "T182A3198ABCC5C612C6E061B6FB0F51DE371643B8E3E67143CD19AB29675B85B0E3B250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003004, "uuid": "659977f4-0377-4e84-8e10-c688dd9e0f33", "value": "1536:u8b33ukAP7Aat6U5YMWeT4nfVGW1hKU4TQ+DYvI+wPP2XvDT2bVR:u8ruFz2SYMwfVGW1oRQ+OIZ2fDT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769003004, "uuid": "12ba3ce6-3318-4c96-b888-1267945b3135", "value": 103636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769003004, "uuid": "335fcc02-979f-4c50-ace5-c59374889e1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003004, "uuid": "5a1a73a0-1d05-4088-9f47-bf1d34d16b4e", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caeaa96b-f68a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1768973641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768973641, "uuid": "23b61c21-527f-4d0c-ac1a-086ae9190f41", "comment": "Malware payload (Adware.Techsnab)", "value": "253df2b709aa881a96499a42e6746311", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768973641, "uuid": "4e582e93-f14c-43fc-9745-880e9a11f7f1", "comment": "Malware payload (Adware.Techsnab)", "value": "4a97a8f2d3be52a3567941087f20097774b22275860992bc29c6e03ca9d46f2e", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768973641, "uuid": "a98b3e4a-35b4-4b49-9e84-1ad943f2205e", "comment": "Malware payload (Adware.Techsnab)", "value": "dd105c8aa98bf5f3b466b89d7f40665c7f96f8c1", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768973641, "uuid": "0e7d188a-2cd3-4e3e-bdbc-5aebb662fa34", "comment": "Malware payload (Adware.Techsnab)", "value": "781ce5d427783ee3aec6f467070dbce97d872ba3e67aba74847014dbbe75fb1b858fde40b5195b256bf84a10991336e1", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768973641, "uuid": "a8fedac4-2adf-4065-a1e7-82827e5ba17e", "value": "T14DA6337036D5801BC8AB6C7EA0A8CF375916BD252762D2DFB2488075EAA11D0D17F8B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768973641, "uuid": "8f90d7a0-e1be-41ca-8ee1-5019df75dcc8", "value": "5939410b96773d14b36f2ddd9c7141f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768973641, "uuid": "b943f85c-2dad-472e-865f-83d97343ce6c", "value": "196608:v2tAkZ6qScGDnZXRs6q7mFMxGKE1eos35Hg5uSXinsnoIXSnair4aw41:v2V09FFK7aeos3pg52nqoI8C41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768973641, "uuid": "d90b8fc0-0ece-4ef5-bbd2-5f767df7ac6f", "value": 10370802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768973641, "uuid": "617197b9-205f-40b0-a826-c44845066e8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768973641, "uuid": "69345259-ef4f-492a-a904-f9dd8d75eaa2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ea185c-f69c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768981233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981233, "uuid": "d4cbe271-02b3-4a00-b3fe-0ff8fee4c4df", "comment": "Malware payload (Mirai)", "value": "aabe83b8423b602abb4bbdad35df970b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981233, "uuid": "9f23aac1-0947-4eee-b570-9de73a991850", "comment": "Malware payload (Mirai)", "value": "4c26c6bc3ad11ed36f314512247018c9b195cd70dcda4f78b6aa74421020d79a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981233, "uuid": "74b821f0-2191-4065-8494-a8236969c8a3", "comment": "Malware payload (Mirai)", "value": "0700a6c5ab1a0e382fb80072c6286dd7453c1e3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981233, "uuid": "a7420087-294e-4fb7-9797-283ebf011d6c", "comment": "Malware payload (Mirai)", "value": "86b4dcd4e80504ed574c442f7b7a032a7d27cac7cc507b654f4b539f7af3a85a6d26f4383b15c89d886744423530dae9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981233, "uuid": "f92f65e0-3ab5-474f-a89c-2ba18f7b2725", "value": "T11703F199AADBD699C99E00340D1EB94F144CF10CE3481A2BABF053F3D493FA528260DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981233, "uuid": "101982f6-ccfe-4f3b-8e53-34e72e12adfe", "value": "768:yAMb3ZPf4zDoVwJt8Xq1poQmtWv2F+srfFmVntKOQ9Fh7YnbcuyD7UHQRjm:LEPfctBpxiJl4VtZQDhYnouy8HyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981233, "uuid": "7ecd689d-ad50-4b49-8ffb-7a00f387bf33", "value": 39228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981233, "uuid": "63dace49-bd95-4b0d-b581-5acd96a6758a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981233, "uuid": "6749dc26-9c02-4b68-84b4-13869eef870b", "value": "ub8ehJSePAfc9FYqZIT6.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577d5ac3-f6d5-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769005660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005660, "uuid": "62e4bd1f-bb93-4fc2-b494-49e189fd63d7", "comment": "Malware payload (Vidar)", "value": "c1450ae573c7becfd0cf1770c86371e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005660, "uuid": "29b53746-9985-41f8-910b-47d853353ad3", "comment": "Malware payload (Vidar)", "value": "4cdcac5b3c9b02d42e672f52a34811006fdb727320ee379530c9452c88cd8c18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005660, "uuid": "efd4821a-0ac0-406a-bbb4-884e1f97297c", "comment": "Malware payload (Vidar)", "value": "09e9ef758dc68e2d9a6070a1f4e53df6888437a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005660, "uuid": "8d2c9257-ae6d-4ba5-b8a4-9f70e8f4f544", "comment": "Malware payload (Vidar)", "value": "b58c0d0968bc2577d384201fbdb3bfd93a5984efb9ea1d9d19041e89277c7c2a0dca72a6c35267ab72177bef2bb8a60e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005660, "uuid": "3aa33fb5-c0c0-4bf6-b9e4-dd70db9da5bc", "value": "T1EDC56C43FDA158A9C4AAE1348C7A71917B707C440B3163C71B5277B92FF63D0A83AB99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005660, "uuid": "1cd47803-2c2b-4359-b3eb-8a5d2a407794", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005660, "uuid": "d3d5ac29-8e55-4dde-ae91-674e2e083c36", "value": "24576:jzkHWtOAvp32b1TfISLDJoawqg7puXKfORygGeaLcMmjeleN4842l7m+Mb:jzk2oAgbJIOoawq76PgGvdCq+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769005660, "uuid": "dad839a5-f1a7-41ae-8918-47da4bc7c3cf", "value": 2723032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769005660, "uuid": "3aa26cec-2215-44ba-bbdc-2d7e0bb04dd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005660, "uuid": "689d24e8-fb08-4e34-b13e-a448207ef807", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f39beb-f6cd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769002307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002307, "uuid": "5bf8338c-548f-4952-a43a-8392b0aa3465", "comment": "Malware payload (Mirai)", "value": "55dfbb20954e76fb3035d121fef112e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002307, "uuid": "107b8a26-1b10-41e0-85e0-d4e378d03473", "comment": "Malware payload (Mirai)", "value": "4da3ed0d9a21afc5096cb131c07ee1fa6f9d6152dce27ca58ee4bf88262c705a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002307, "uuid": "632265ae-a563-4282-8c27-c4efb689e912", "comment": "Malware payload (Mirai)", "value": "51319d5e47b5e4b70910898b922563c760ba22d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002307, "uuid": "f6178015-9903-4158-b07c-1d20b1e9e579", "comment": "Malware payload (Mirai)", "value": "01d78f1ccea39a71d25efedac64f1880aa99b149e1630a2affcb62498f1a1dbc1689f3e2234c0556d82ec1011c4577f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002307, "uuid": "8a8b91c5-4378-4e8e-a8e2-03807091015a", "value": "T1B7A3088ABCC5C612C6E061B6BB1F51DE371643B8E3EA7103CD18AB29675B9570E3B250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002307, "uuid": "bfa8e315-1f66-46a4-94e0-281ade9e247d", "value": "1536:zDhuC+Oot/54I/AjTg6704RA69Rd8Lrq7FTfsBHiQvkHnJ2T2bVR:zFT+3tT8TPK69Rd8fqpTffQvkHJ2T2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769002307, "uuid": "21f731e7-ff0e-4bbe-bf2d-08aec9fbfdf7", "value": 99540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769002307, "uuid": "c5a7e44b-bef9-4cfb-9002-bda75575bb19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002307, "uuid": "838af599-d952-4eeb-88b5-53fddbd8663a", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb16ba1-f6a9-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1768986642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986642, "uuid": "30f7e3e7-176d-4efc-8087-5c3e34db7c81", "comment": "Malware payload (Joker)", "value": "69df2be19ba1b895d571fea3befa1d8a", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986642, "uuid": "a9720587-416c-412a-aa9a-23a35ba54540", "comment": "Malware payload (Joker)", "value": "4da675ca67a2d2f092e0d7fdf7d81288d75e59b6119639a2a43d3ff4a4f442a5", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986642, "uuid": "8832c016-9668-4cf7-89b8-d9d6ab90e726", "comment": "Malware payload (Joker)", "value": "86e909b3373eb909c66a321b5c57a72b65c48035", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986642, "uuid": "3e410c60-1eff-432b-82d6-c97ed1a97c0d", "comment": "Malware payload (Joker)", "value": "fc336796ab59a0a1a48643a1c879fcfb4d22d10d1f1ca8e5e51520f6e444a1cda0c1ff1225b68c37ecbfcdc222f79034", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986642, "uuid": "13784244-699d-420b-96b8-223d68c37fef", "value": "T1B637220AF74D983FCDE7B4388EAA026251262C895641C7576A12F11DBEF76C49F0AFC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986642, "uuid": "031bba84-7fe1-4f60-862d-46d7320ee9a4", "value": "393216:DPLgXZxolaCFftGjnaJjY2uG0KcIWEwzFdlkqwgmBtUA/sJNMsPm4XW:rLJNftHmVKcIWEwzFTKgmT5M/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768986642, "uuid": "c059847f-0726-478c-b300-4fdfa09d7abf", "value": 22937037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768986642, "uuid": "78757b44-8522-4c99-bea6-f12c3537ff07", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986642, "uuid": "5919e89a-fffd-4b50-ba22-7863c0a8fdcc", "value": "Quick+Junk+Cleaner_1.0.3.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54794ab5-f6bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768996206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996206, "uuid": "e9de386f-dfc1-49a9-8339-5dabeb730ede", "comment": "Malware payload (Mirai)", "value": "92199f97fdb76a4cb188a9f506be26f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996206, "uuid": "36523b7b-bfcf-4db3-a249-d1fb3769bee5", "comment": "Malware payload (Mirai)", "value": "4ddcdfa4b6a670d39d1c70edb2ce77c26f715f78d931ec4435bfe41ec0db5369", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996206, "uuid": "2469a767-c1d7-4977-b09d-38b62acd507d", "comment": "Malware payload (Mirai)", "value": "2d9568d096a38c6ff18e9ebc740d42fdaef057a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996206, "uuid": "6108c12a-4cc3-4ddb-a4f0-917f6fdaa0e1", "comment": "Malware payload (Mirai)", "value": "2cc3538047435f7fa49ad6aa33a367f45704d8318f78ad3268803aafb39c981b4af022b31ea3d4900b120a9f5c675ec1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996206, "uuid": "cbd42d12-1215-41cf-ba82-4b2a96f2f187", "value": "T191A3C71E6E15CF7CF79D873447B78E25968833872AE2D141E14CDA015EB028E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996206, "uuid": "fbaed725-10df-4b41-9da3-56aad673f71d", "value": "3072:pqunD7x7pJVnEbc//kqadL37awLaazOBCIM:pqunHtpHxah3WAaaz4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768996206, "uuid": "c97889c6-4d1b-4acc-b21c-618267c576be", "value": 101132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768996206, "uuid": "c39e1878-4dba-4049-94a0-27afcace562a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996206, "uuid": "bdbebb7a-df4d-48f7-8c78-8931684b34ab", "value": "UnHAnaAW.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bafd9f4-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034739, "uuid": "26b5195e-48e7-4301-85fe-19e9488785de", "comment": "Malware payload (Mirai)", "value": "daacddc5250bc6a0020420003bf68052", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034739, "uuid": "c98d7a6d-191d-4867-b98e-a208bd48e607", "comment": "Malware payload (Mirai)", "value": "4deaf19c7c5a846b1a19cbff89b37db8bf6b412af536959ccd493aac328cbe07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034739, "uuid": "4bdd193f-7bf1-451f-bed8-80d0c6490f22", "comment": "Malware payload (Mirai)", "value": "5656c3085400a8f06c3ede4cee132e71cce5ad6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034739, "uuid": "28dc0f92-3a9f-49d4-9bd0-90a69c4f06df", "comment": "Malware payload (Mirai)", "value": "c7414de95a3733e898bb731a9b85152f57237f15216d4b01301b788b1b96da336098cd63cf997190fddd7501b7162803", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034739, "uuid": "77a33934-96b4-446a-b397-28a9039207c3", "value": "T187D30945F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034739, "uuid": "e8227650-7d2e-453c-ae2d-ef26f907a588", "value": "1536:UFKdzElm18uZJNb4A6Fa8eAZHk4VB7fzTTr71igYSvGueqZvd2UlqKwyw6RNPYTJ:UFKp50VU8e947Lb71izSftBdRalKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034739, "uuid": "ca757822-ed01-4009-9842-60677c6004f8", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034739, "uuid": "48cd3648-c895-46e9-92af-970acd0e89a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034739, "uuid": "ab07ea8b-ed67-4a0d-9bfc-7f906ff77689", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1c9fb0-f6dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769009075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769009075, "uuid": "a0ca217b-178a-4126-b06d-36a536b7485c", "comment": "Malware payload (Mirai)", "value": "47c93a0acafdc004efe0196cf5cda68a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769009075, "uuid": "938c355f-71e7-46ee-bceb-c8b86a7bfb24", "comment": "Malware payload (Mirai)", "value": "4e9b4acacce3dde242dea2542bb59132b475355e96c1ca80c26ff417010207cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769009075, "uuid": "26559f1e-9987-4c3a-a5c6-6b9c121916f0", "comment": "Malware payload (Mirai)", "value": "3cb568a556772fcad595e9c04af732fd576da124", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769009075, "uuid": "72a57de3-caca-4148-a03e-e6dd9b2ff15f", "comment": "Malware payload (Mirai)", "value": "be9f26af5e85e03682a367321deb887fadbce2362a9b3c7da95297abefa3748914951f922ad4a11930905e38ebb15565", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769009075, "uuid": "90949ff6-164b-434f-af2d-e70f5b202f59", "value": "T19AD3C021E4006DD1EC2129F578BA96BC0350EE700BDE1586EFFDE95E747BD98386D2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769009075, "uuid": "5593994d-857c-4462-b974-173bea85323b", "value": "3072:PHiBTNkAgcly+hoVpE6AKUjq+8biA7JBd/xH:PCdny+hovsmzbisJfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769009075, "uuid": "f336f6b2-0c99-47e0-9a54-9404a8f15ec5", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769009075, "uuid": "2497620c-b863-4d90-8fb2-0ecbd9f20cac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769009075, "uuid": "1677c26c-815a-4318-abe9-e4be80c96b66", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75f8d56-f6cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769003271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003271, "uuid": "7f69dc3e-a9cf-4f03-b570-7863ff5254d3", "comment": "Malware payload (Mirai)", "value": "6a9d2bd95f1e05ee812c016940acec06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003271, "uuid": "985ddfa2-7723-4865-abd5-e7182476ec87", "comment": "Malware payload (Mirai)", "value": "4ef6e0c861db175e57eca03d9a83d2ed347b266c8a0642f33d993a5a5b8a4a49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003271, "uuid": "75f06c8e-c516-4f12-b28e-71a1527feb63", "comment": "Malware payload (Mirai)", "value": "47730dd841132e341644d5d0625dcf18b2c2badc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003271, "uuid": "47d27dc5-53a0-4ebf-a697-0af2cd76e558", "comment": "Malware payload (Mirai)", "value": "d1d2d7bec1c749a79d82f518672e00de8509aed16c85da6b94ae06071b3ec9e33359dab968ac40e44b38acb661f4568a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003271, "uuid": "29da9804-36f8-4fca-bb80-c00d852d44f1", "value": "T164C3C64B6E529F7DF32C82358BB78B35A749238533F0C185E26CE9515D6038E682FB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003271, "uuid": "99b6c3d3-41bb-4897-aeb5-f944af46b47a", "value": "1536:3JbO56gEDbNDbrDbgjP4Ct8c22A0NfNG6JxeSzDCLzSYZ2uX0T2bVRu:3U5tBVt8c22A0NVG6JksCLb0uX0T2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769003271, "uuid": "b176b734-1cdf-4de9-ae3f-733cd1052716", "value": 120480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769003271, "uuid": "94bc32bc-d926-4f2d-a938-18d6cebe026a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003271, "uuid": "cc3cbebd-ff18-4f47-9a00-0b80bab685fd", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d1758c-f719-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769034895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034895, "uuid": "1de67306-d668-4b84-a7ff-5b8d6f73424a", "comment": "Malware payload", "value": "fa966fd43ae4399a1865ceaae8306ea9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034895, "uuid": "cac97575-4d24-4411-a6e0-806b3d329e0d", "comment": "Malware payload", "value": "4f0dd9e2fe994c1d50b7180ac5a9cb2ce0c427d7713b5c59e30fafd953e69b49", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034895, "uuid": "1acadd19-0a39-40d4-b735-0b7870852277", "comment": "Malware payload", "value": "6ec30a27ff219cf85d6980a6dcbe41c6bdc1adf0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034895, "uuid": "ad17bc4b-5af6-499b-8d98-5cfd003fd645", "comment": "Malware payload", "value": "ad3313e83f114db73e6f46353618c6d213dd5abb75ba5ac366c1bfa5facf90ac933204673ad15422b3f83c19d4de38d9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034895, "uuid": "016a5e5c-f63f-454e-a218-ac1e61a2ee97", "value": "T11301DAEF61615FB08A288F28B963442C600EC5E1F5734758A9D7283A8CE8B077654FC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034895, "uuid": "8f3b45c4-ef2f-4915-9c7c-a9977868e785", "value": "12:xVHXVHYVHjIWdVHye/WVH6tIVHnSLKVH4VuVHxWVHEVH3nJVHTgOTln:cIY/htqKVh2ln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034895, "uuid": "8f5daa8d-50c3-44fd-914e-8264062cf61d", "value": 718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034895, "uuid": "8d50ea97-289a-4794-b6a5-3e67db338132", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034895, "uuid": "1afc0d9a-ef29-4493-ba8f-bcaca3067ebe", "value": "t.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87896ac4-f6cd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769002305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002305, "uuid": "2376184f-1b61-4487-ac6f-ba87a5285b91", "comment": "Malware payload (Mirai)", "value": "2d0a68db0e901f71ffe07d49dee08587", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002305, "uuid": "6a90ff10-aad3-4ec9-820f-a1ec61a8953b", "comment": "Malware payload (Mirai)", "value": "501d6292328ec6c98fd4a0564b73c295e485620617b4e7d2c1d8a8dace3a67ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002305, "uuid": "c7944350-dcb0-4a6c-bb3d-26b5697123d9", "comment": "Malware payload (Mirai)", "value": "62fbd8935f87fa1683d7ac78f23fd205a55cfc24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002305, "uuid": "15a0b916-b39a-48c9-9fb5-6155022c3a05", "comment": "Malware payload (Mirai)", "value": "d958de6e7fa3210812af36867ddfe25a9ee546d5087efc042abf9655e13d93c2cef6cfe0ab30a5fad340f3cfa0bb3dda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002305, "uuid": "b3f32bcd-f21e-4b82-9a0e-dacc5c6e886d", "value": "T1BC536E42B3084643E59B1DB0393F2BD1D3AFDA9011E4B3C6655EEB8A8173E32554BE9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002305, "uuid": "dc16aff9-331a-4ab5-bdaa-75bc2849d724", "value": "1536:+7zswxPbxGEIvsYJpJS9oFhlYZCVGgYT2bVR0:+7z1P5isYJbS9oHtgT2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769002305, "uuid": "aa90ac33-870d-4e04-8658-05e754d9526d", "value": 62776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769002305, "uuid": "fbf5d31c-5da7-44f7-aa93-0184d705e039", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002305, "uuid": "952171fe-b2a6-49ae-84cf-79d2e84545ce", "value": "nabppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf12a1f-f6ab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768987766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987766, "uuid": "adefdb7f-0e36-4842-8eac-ef436c401a6f", "comment": "Malware payload (Mirai)", "value": "15cf80ef7dee70f11007edf5700fa0d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987766, "uuid": "feb7ce26-c990-47b6-8890-38f7ce3961ae", "comment": "Malware payload (Mirai)", "value": "505b9c302899cf898d8812c22bf1c36e9e10bc818c0e538c9f8ade3f37771e1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987766, "uuid": "0d83c77a-dc64-497e-b33f-dcc50b1ff990", "comment": "Malware payload (Mirai)", "value": "8e95630bda91f9cc25316e418cfe4c9a71a0ed01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987766, "uuid": "8a9ccfce-ad4c-40d8-ae8f-40fbe910e2f6", "comment": "Malware payload (Mirai)", "value": "7d6f9eb4526f84407f5ad69bd3324c7201de7d1f4a096832a1b050db9f3dc3376b7cdeb0f951e7be5435b96059a4f893", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987766, "uuid": "7066c6ac-2d01-462b-9981-010da220caff", "value": "T1615302E926C56901C4BC81BE73394AD45F8545D4266DD76C63B00EC8EAA31CF29CC9FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987766, "uuid": "877f0e12-3622-4f76-b541-c9d6902b26ec", "value": "768:Stvq9PpAZ+A4+xS9GYX56rFxXhCTVpQk9g/CffrMNaRP5kx+RDB636ucfTcw6+uq:SYhwzxS9GtJHY1SuRxtbl6+ugZ+Vk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768987766, "uuid": "23994856-6a7c-49e0-becd-596988ca4501", "value": 62596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768987766, "uuid": "0888a84e-19ab-4ad8-9e37-046f27d51bc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987766, "uuid": "0d6a002d-4cae-427e-ab62-de1ba998a4f0", "value": "Orbt.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd73311-f697-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1768978938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768978938, "uuid": "4c51a10d-b08c-4d93-81bc-2e1ec4a78e37", "comment": "Malware payload (AgentTesla)", "value": "bf3ac0cfb8473b37804d3dacd3b3f271", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768978938, "uuid": "008c1633-6947-435a-9eb4-e65ed57fd429", "comment": "Malware payload (AgentTesla)", "value": "50e923ba9552802da81b5728214af11b06c1cbb9cba9bf039dbe82ab67642907", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768978938, "uuid": "3e77af85-6d8c-4e02-88b2-48c6c35e6e84", "comment": "Malware payload (AgentTesla)", "value": "6288130d9996c7123cbc3a5cc4f66e15adc60763", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768978938, "uuid": "a97d4cba-fb0a-41f8-a993-14af2f4531a4", "comment": "Malware payload (AgentTesla)", "value": "ce0df81a3555474aaf69f57b0162925d452902864cf98e904768bb87fab5df389dc6d3d2a78a465721e7c9311c30b146", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768978938, "uuid": "679b7313-c90e-465a-92cb-e2ff99006377", "value": "T1D3E4124277388D23C93B1270EDB3D9253176AF5952EAAA0B33667651787398A034F34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768978938, "uuid": "ddc61966-b7fb-4f80-afeb-cd71fcb4bd9c", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768978938, "uuid": "0fa35d7b-01fa-4b2e-9389-456a2e29a49f", "value": "12288:wokfyVPw1OJMQoguS6rT+sjh4VNzqiN4ouEkrrmD9+rN1oIHo:wJMPy0uxr6sUFtN4ouzmD96N1oIHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768978938, "uuid": "abc23c3a-2d22-4ca0-a32f-e2b8daf0df77", "value": 674952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768978938, "uuid": "808659d5-db00-4179-a2e9-989799e134c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768978938, "uuid": "3560e1e8-1f48-4f6d-a732-e8f19b89cdbf", "value": "AWB-793553427494603888WN_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03661e1e-f6d6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769005948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005948, "uuid": "bc85792e-cd03-43da-bcc7-2b5580315dc7", "comment": "Malware payload", "value": "382620112a2319b375161fb629ec140c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005948, "uuid": "225bd57e-c9df-4b4e-8b75-d231ed317a83", "comment": "Malware payload", "value": "519a7b1794b6ab602a02d5c03506611541048054dbd6c4aca8db2d81be12c608", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005948, "uuid": "21c72170-32b6-46c1-9dfb-caeaba6f8be0", "comment": "Malware payload", "value": "10c42d8987a9e1fcd3001b82185e140201c2aee4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005948, "uuid": "ba746afc-72f7-4269-9de5-3fe5ec7c83eb", "comment": "Malware payload", "value": "563e31b1b4b0b5d6820447325612e6722d22c1f61fa1a05d5329ba08e2a3f2e4987fb1ab21396cb8ecb8766a38ed159e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005948, "uuid": "0bb477b0-7b8a-47ed-9177-8d90843645b6", "value": "T1DD28E01663E112AAD577D138C79B6203EB72B40B13309BDF729C03652F63AE45E7A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005948, "uuid": "57bd4d5a-2e3a-4767-82a9-bed28a8dbf4f", "value": "9eba512b03d8cac8a6c4424e25e9f06e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005948, "uuid": "431be73f-8012-48d9-b02e-a2b902feec32", "value": "1572864:mBeI7yCDsW/oR6lvviHKI4VJt2gy10cFDudHabx/:mBeIZM6lvvXI+t2gy1+dut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769005948, "uuid": "afcd7aa2-6df7-418c-8f8b-f57adaca6a79", "value": 94777543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769005948, "uuid": "fb69ac27-6bc0-4c48-be46-eabcb0b8d963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005948, "uuid": "51028a3e-9e13-48b1-a713-fff7c64a5a4f", "value": "v2discordid.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76fd65a1-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034919, "uuid": "83bcbd34-112b-4c5e-95d0-81d60702ca62", "comment": "Malware payload (Mirai)", "value": "f83349a91416be2de7dd77ffd1d57c0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034919, "uuid": "8a2de81f-e827-4a9d-b21c-6a774ccb2e28", "comment": "Malware payload (Mirai)", "value": "51ece55e46739fb475e8cc3c983a0ae94223eb7f6f449f57d7adeb3a23a8e6d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034919, "uuid": "c7e60c6f-936f-41ae-9249-8480a296c9cd", "comment": "Malware payload (Mirai)", "value": "d817ba5691ccf856db4f5a0cb7afd089266282ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034919, "uuid": "26dfa3a4-4ef7-4c04-bda8-807e9bc07f4d", "comment": "Malware payload (Mirai)", "value": "3a97a383aba585c13b4bec22ef4ac7812502a5c6886d9fd865693d903d50816cfd102417b08b8d439fa7f3356690ea44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034919, "uuid": "720b4ac8-4822-44fa-bcec-f8f3ec0cdeab", "value": "T1A6933C0379C1CAFEC447D0B047FF6935C862F83E053AB18A63A4FE527E49ED02A59690", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034919, "uuid": "75c889f8-bfbd-47af-a714-7859d23defa3", "value": "1536:TtvVWmlzcwTj/wzmjZDl6B3rRDKu1x12ecboKU1hHnrlrI8xbBN:RQmlpTj/wzyZD63f1x12ecbo9hHnZrZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034919, "uuid": "a583d43d-9012-42d7-acb5-35621d70898b", "value": 94400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034919, "uuid": "005c11e4-827e-4039-9e0d-2123fd44d2a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034919, "uuid": "7315bd55-a33c-4217-b90a-391c53f68a80", "value": "titanjr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e7cfa5-f66c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768960691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768960691, "uuid": "b52f57d4-ca97-467b-b14a-b793053e4708", "comment": "Malware payload (Mirai)", "value": "ee79035857eb7cb4d0e973820a0c8285", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768960691, "uuid": "35da7bdc-cd6f-458f-8a35-6d760a36d05e", "comment": "Malware payload (Mirai)", "value": "5303fc67e81fd71ad9d9f382c266ca34e9a1c87bd958a920651edb57871213e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768960691, "uuid": "fc1a8779-5432-46d0-9a58-209e3c6609bd", "comment": "Malware payload (Mirai)", "value": "b130f4abb675e460689a377ee8bde4ff57d6ed75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768960691, "uuid": "54e86d59-1857-4e82-bac1-77df62ce6e3b", "comment": "Malware payload (Mirai)", "value": "ed6d38b1be4bc3917cc475ca9ac1a7e76eba7d35099cf7e2213ef76c00d71ef3ad3c1cdb6361acf3fae83583f8055c83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768960691, "uuid": "2724122a-9465-4908-a84f-7200f3903bc3", "value": "T194B32995B892AA12C7C2567BFF4F428D37165798E3EE3203CD185F6032CB55A0E3B256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768960691, "uuid": "a250965c-2483-4544-b970-44e9d5355387", "value": "3072:4PnWtgoDkPMaL/P3A+yK3fimnGZpK3lCHKConT4:4utgckPMaL/fAnK3fimnGZpK3AqCA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768960691, "uuid": "1e158141-c4c4-41d6-ab95-47a0f0f3ea64", "value": 116136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768960691, "uuid": "e6d643de-b891-45a4-aedb-433becb8b9f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768960691, "uuid": "7effcee1-95b7-4b82-a8b6-3cb1d935e459", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2100a78-f669-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768959399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768959399, "uuid": "5868f3e5-b1f0-449e-8e59-489ec3ae58c2", "comment": "Malware payload (Mirai)", "value": "9efa2b07e89173e32a44aba3f8f114a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768959399, "uuid": "d9cacac5-008a-46cb-998e-b8c41fc4dd40", "comment": "Malware payload (Mirai)", "value": "5305880aa18ac4332fc1f087a2f0abb97d8277638e35de22340dc5e00b951d96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768959399, "uuid": "f146a33d-477a-4e87-8bd7-12f2672e8c9f", "comment": "Malware payload (Mirai)", "value": "54beaaafd434f1c2968fb947afb2522a5a897692", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768959399, "uuid": "980d1c6b-dc4b-42f0-8fb6-f6294466adb9", "comment": "Malware payload (Mirai)", "value": "6173e4ee60ef46926a50fc64810036d7766c0dde74d8c02a0d08bbd9d964f7e07abebd9d20821d07bbba28699fbee0b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768959399, "uuid": "db0cb6f9-4932-4268-b8f6-6df20b57ac3e", "value": "T131931A4ABD819B11D5C522BEFE5E518E332367ACE3EE7112DE144F2167CA91F0E7A402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768959399, "uuid": "7a28f8a2-d3a9-48d3-8316-439b19043c44", "value": "1536:cwnxxR7c1hFjO0QK/v/++eDZkklZo7U+W1ycTpyPXWlJGi4ANVtdd:zReFq0QKGPDeuZuU+W1ycTpVQATtdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768959399, "uuid": "6f9c5b7a-b40f-4867-b83e-239566f0dc63", "value": 91748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768959399, "uuid": "ceca9893-7517-4e58-93c7-d5c49fdc886c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768959399, "uuid": "026d592a-2c62-4f3a-8af7-bd6862d404ea", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7579ff5-f709-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769028181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769028181, "uuid": "18f0f8ba-d1b3-4a3c-ac8e-a79a28e056d1", "comment": "Malware payload", "value": "c1d68b52c9d8269ea666a4a27074859f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769028181, "uuid": "b0a85b9f-c94a-4f3d-869e-f56bbb7686f3", "comment": "Malware payload", "value": "531b8591b1f1a41bbe779c1f3bc5b042286d80b2594949283c8e652b43a98d56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769028181, "uuid": "9f0dea79-b9ba-436d-b32e-fbab0a0f4507", "comment": "Malware payload", "value": "e5e8c2d53a957b4c6ec1e6ec11bd13dea7e93955", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769028181, "uuid": "03ef9d9e-c158-4f8e-a43b-0dd4180b7c3e", "comment": "Malware payload", "value": "b4dcd111618630a4956f06ee8021b94b0f0993c6f84654b16a01d477a3a8d5f4f4e523a9c62d312f1c52de1712e151d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769028181, "uuid": "51cb4d96-bd69-4e51-b250-9c30fbfc38ce", "value": "T15395223545E825E8E0AE4F7970B1613386B73D5C2E35B39F1C85BA611FF32E0A126B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769028181, "uuid": "d9a3e0fb-bbd5-4019-bcec-b54b196b554b", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769028181, "uuid": "31cd7176-cfb7-4636-a4bc-bb8f43065a77", "value": "49152:edJucnIdiM+IxiHXwYsocYeb0HuOThfVAqmwqNTK:ascnxHXwYDyb0HfhfGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769028181, "uuid": "2c272d7a-3d1f-4855-b6bf-0241076bcd07", "value": 1889280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769028181, "uuid": "60a6f8c3-5b22-4147-980f-75a1ae624042", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769028181, "uuid": "89ed5b03-a854-47b6-81fa-5c2350a68f05", "value": "Kiddion's Modest Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d06b94e-f6c7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768999576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768999576, "uuid": "7f292db4-87d4-4511-81ad-5de6df474d1a", "comment": "Malware payload (Mirai)", "value": "d47efb8b80414acd150dfb2f4f239ce0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768999576, "uuid": "2c267375-2871-4461-84e7-eb5738ef11fc", "comment": "Malware payload (Mirai)", "value": "532856868cbd4cccf961f8b16154706df2f2f0a5c61c7fe1b9430f3aa1cc5164", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768999576, "uuid": "a0c2b478-7d3d-4aa9-ad15-fbc9bcff6c04", "comment": "Malware payload (Mirai)", "value": "bb520de8df81fdbf6d4c6a41abb351443143d76d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768999576, "uuid": "621e5b90-b6d5-4236-be1c-ee26413196a7", "comment": "Malware payload (Mirai)", "value": "3ec370a3bad78e22c693c20e7a71bda0ba2ed10cf9ffb365811004b48b88d5e170771bc595bed90b21d273233875e39f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768999576, "uuid": "8eb944df-42f3-4fc5-aee2-6bcc4cabeab8", "value": "T1DAA30BC6BC81CB11C6C566BAFE0E51CD33134B78E3FA7203DE145B29674A86B0A3B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768999576, "uuid": "11fdd7f5-07a9-4676-b195-aa580192f3eb", "value": "3072:YFxNEjIY9n1RExXfp8ky33AGxHkSvg177U9EKBGzT2:Y8nYR8V3AGI17g9fY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768999576, "uuid": "934c392b-d35b-48d2-9ce0-bb3616193968", "value": 103692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768999576, "uuid": "1c3ff2d4-bae3-4c1c-92f3-9de12922ed32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768999576, "uuid": "7e1789cf-14aa-4a4f-9543-806283f814cf", "value": "jklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6263670f-f6e5-11f0-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1769012550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769012550, "uuid": "354c90fe-5db1-4361-a7ba-c1d8665fc03d", "comment": "Malware payload (DCRat)", "value": "6790ad5ddb8c2dae3eabba05191eaa97", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769012550, "uuid": "134e8e05-6b71-4cf7-816e-ac8519e9244b", "comment": "Malware payload (DCRat)", "value": "535f8582aed8ce412fdb82cbbf7d33090d605b4d38e5aa395e6201c9511204fa", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769012550, "uuid": "9ec9d476-9a76-4c0c-b791-4d966da18c78", "comment": "Malware payload (DCRat)", "value": "2aeceb4253b60fd81e688f9d0157a20fc35b4714", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769012550, "uuid": "39a582d2-9e9c-46de-bdc5-ec8e9ca7fb97", "comment": "Malware payload (DCRat)", "value": "f1b61a5c9bdcb03733fed39921bc87cbe99c2aa3dc4c2e174f3060618f66b63f231c5c4660a53b1aeb88d731420e672e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769012550, "uuid": "ff309824-ee02-42fe-bfeb-b8cd2c1a81c2", "value": "T110D3F505339CC811EDED0BB4BFA2990D06759D36D50AFACA7CC431DB56FBBC185122AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769012550, "uuid": "d34c5271-456a-4457-8cec-e0e8b63ce021", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769012550, "uuid": "8547b8f5-5cc5-41be-b98b-02e3bc958751", "value": "768:qR1Cu3zliPf5kiD9J60HFhrIefF01+yYCv7mqb2nxpwH1oEukl0az08GEqLXwehS:qNzWBP1F0+Gbb2wzGEugehG/YVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769012550, "uuid": "3b6ff966-be67-430e-88b7-7c7359a07b0e", "value": 133632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769012550, "uuid": "96fbd5ac-cc3b-4364-b111-a84bec68c367", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769012550, "uuid": "d7ff651d-be14-4e24-8aad-e1b2a4fee206", "value": "Window11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83045e1a-f6a8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768986406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986406, "uuid": "720dea9e-b620-4d7a-b02d-439b943a3e68", "comment": "Malware payload", "value": "5cbeb83ae2cebc318fffbadc29ceacdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShadowRelay", "colour": "#4A2AEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986406, "uuid": "95bd027f-4de8-48c6-817d-c99558273275", "comment": "Malware payload", "value": "541628370c4d4f64468021bd83414efa9ee1634554acf29055c6c1dfa601a5e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShadowRelay", "colour": "#4A2AEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986406, "uuid": "85fab6fe-e658-46e3-b790-ede04cadba8c", "comment": "Malware payload", "value": "2358fd681988f67f35049d6d653b7df3a2c37ccb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShadowRelay", "colour": "#4A2AEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986406, "uuid": "6ac699c7-55ef-429b-b2dd-791bfcbd8ea4", "comment": "Malware payload", "value": "5e94bca44991ef4cb69433235d974a4a71dbdb59c63736ad3095aa1684c3d9fab30b23d0ce22244b262670490ffeeb80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShadowRelay", "colour": "#4A2AEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986406, "uuid": "6ae83197-0d11-4511-8b1e-9bf875643700", "value": "T195B58D56E7A801E4EAB7C13CC9564117EBF2B4151370ABDB07A48A691F23BE61F3E740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986406, "uuid": "4bcb994a-9c5e-481e-a274-9be73fd36f23", "value": "26be21847eabafbcf20a4e92427dd55f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986406, "uuid": "7ed15dde-de5c-49a2-aa4f-3859fb16278d", "value": "49152:w82Ks+u5lz6pA2AGGCA1BdCgNylW0YOOmQdPhrM7tD:w3x2pHW0YOO5PrM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768986406, "uuid": "e73ae6fc-3155-4e27-83aa-e599dee34e2b", "value": 2383360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768986406, "uuid": "419d1eb2-8d28-48ea-a87f-c0dc68486839", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986406, "uuid": "43713c72-58a5-4124-8c77-cc2e23335290", "value": "2025-08-28_5cbeb83ae2cebc318fffbadc29ceacdb_akira_black-basta_cobalt-strike_coinminer_helldown_njrat_satacom_vidar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b174b272-f69a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980471, "uuid": "b516d361-d43f-4c2d-8926-48d551d21783", "comment": "Malware payload (Mirai)", "value": "4ae8b2c3202854e14c68eca94807df46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980471, "uuid": "546528b5-2c2e-4269-a287-6beaaee9e8f3", "comment": "Malware payload (Mirai)", "value": "551e14d467be7a6675b4dee30c407fd367ad22fdb767d5668efce81620af606a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980471, "uuid": "770ff82c-1db6-4b07-9467-63c287d2d471", "comment": "Malware payload (Mirai)", "value": "0bff1344cffc5dac8d3f50913e904b0cbf6164d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980471, "uuid": "4dfa233c-ac47-4c0c-a184-d2cc2d79e099", "comment": "Malware payload (Mirai)", "value": "42b4dc68d5188d222821dddaa86b34a4e06ac736785919c369b0f08d8ca6d95c65b3e0d04037ebba3e8d37519976a5ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980471, "uuid": "01747b0f-61f5-478e-898b-54c112a22518", "value": "T1F2635B4372680F47E8521E74293F07E093FEED9120E2B788696F9B594A34E371985F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980471, "uuid": "3b6e71d5-3091-4e6c-abc3-31b625dc3c24", "value": "768:D+org9DLomSYBG0yJ8tnOV+y6psxnudstER06XSORsroCh4SlZ1TchiithsJVJH0:DqcMDX5BChQ7tYAIPjv943SnY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980471, "uuid": "e39e4483-ff4b-40c0-a273-05d0afba6639", "value": 72936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980471, "uuid": "69488c8a-3d4d-4e88-99e5-347873ddf132", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980471, "uuid": "043e21af-7ea8-4b2e-b7b6-c76865886a11", "value": "sdxkzX_UXA229x.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671a8fe9-f6c2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768997526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997526, "uuid": "ba096c5e-6039-4872-a455-b8229140f013", "comment": "Malware payload (Mirai)", "value": "f8ec17faf2ac085f5f5edb04c9b1c05e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997526, "uuid": "1f20b994-d014-4dd1-ad75-e9fa2c695b9f", "comment": "Malware payload (Mirai)", "value": "55358f69ba743d6ff483f5237b3171c15928246d5de09b4769ef862083313ab4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997526, "uuid": "309d295c-6c4e-4ee1-9394-36fab844f375", "comment": "Malware payload (Mirai)", "value": "1add13713d5d07a4ae70bf2c27faafc52438087b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997526, "uuid": "db41c6af-ed29-4443-968a-db04b1f50842", "comment": "Malware payload (Mirai)", "value": "b47d23f9ff7ce3d2239cbd8018797b60306b4e4de228e6a5a7f00aa1927e791095f543fed070faac2800f3d27f450cdf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997526, "uuid": "ec1ae2ce-9dcc-45f3-97d5-793112c40247", "value": "T157B32907BAC0A8FDC599C135465F623ACA73F52A2135B2AF1790FF1629DEE1037296D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997526, "uuid": "c90ea208-0303-47ea-bab2-10cff1944fb3", "value": "3072:7uVeH6qmymzsXQjiJfsCpWZF8a1uxZGS1p1Sn/DTw4aQHhIYK4:7uVeH6qmymz3efsCpWsNrIEjBYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768997526, "uuid": "64aacb31-0a32-4c5b-92c7-b48787345fc9", "value": 117712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768997526, "uuid": "81e8793f-b5ba-440f-a82c-11cd41ed8bf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997526, "uuid": "05de6769-89a7-4fec-b44b-ba5f1c6a604c", "value": "goon.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bcc6103-f6c6-11f0-a129-42010a9c0007", "comment": "Malware payload (UmbralStealer)", "timestamp": 1768999278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768999278, "uuid": "4e2443c6-ee16-44e9-b8d5-0b05b615de01", "comment": "Malware payload (UmbralStealer)", "value": "764178a8c8c018344bf5e9643ff1e1c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768999278, "uuid": "4314ca05-e221-4583-a1f6-adc5a888aec8", "comment": "Malware payload (UmbralStealer)", "value": "554215041162636d2bb16bfd0fa716e83f38e3ff14fe8040615aa2db92fe8c53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768999278, "uuid": "8cbdac03-886b-46bf-8fad-28d6d4260b35", "comment": "Malware payload (UmbralStealer)", "value": "43f6859e0dbbeb5e4b72c6e347e50d40fe322654", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768999278, "uuid": "5405d85d-c413-42b6-9354-25c85c1f66ae", "comment": "Malware payload (UmbralStealer)", "value": "939e58453b689e3bfaabce7ccfcfae44357890a377976da81e6d92f05711e99587656351bb6a1b2c8be798f9a4f26cc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768999278, "uuid": "deabe260-0372-4e0c-9619-6090cfc50a37", "value": "T148543C552A68DA32D61F8B7E97A510DB47F1A233E80AE74E0C44ADE434317C3D9DB923", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768999278, "uuid": "0f4150db-776e-4987-b8d4-ecbf5f275c26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768999278, "uuid": "f63fed8a-bd51-4da4-bd01-cd95b10bb580", "value": "6144:9loZM+rIkd8g+EtXHkv/iD4szeAYe5xyG6XKYZd88Mb8e1mQB/ibUaR:foZtL+EP8szeAYe5xy3XKYZd8B9Bqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768999278, "uuid": "0275a3fe-3afe-42e3-b2eb-e30e55c30fce", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768999278, "uuid": "00658eef-8831-40b7-84d2-6ba0598aac90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768999278, "uuid": "9a3e4f29-53e1-499c-9152-dee813ddbf6d", "value": "plugin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e81ffb1-f6a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768985861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985861, "uuid": "e88c4ec9-5cc0-4ff2-a610-0394d09292f5", "comment": "Malware payload (Mirai)", "value": "2500726bd2489b3596c2a6eca37d127b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985861, "uuid": "f20d1060-08d9-42ec-8786-e21a01eff183", "comment": "Malware payload (Mirai)", "value": "555d4f012ca0fce80acdabcc61b112419eb54b2e63e78380814d0633d3b80221", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985861, "uuid": "10e3ae59-5789-4c95-ba82-fa7eac988d31", "comment": "Malware payload (Mirai)", "value": "56cbecfecdd8ca5e165178d126ff9c3da2e5d8bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985861, "uuid": "1d41d9a8-59ea-4029-95f3-ed32135dd56e", "comment": "Malware payload (Mirai)", "value": "dab36df37be367acede888fded4411f2939d799907f4396e115568233b8e91c7040f56b1f89cf5f0b125b4b81f3e07bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985861, "uuid": "a389fac7-e5b3-4744-9e03-a251b32dbd38", "value": "T113F30886F8C19B11D5C155BEFE0E524E33231BB8E2DE72026D256B60778B8BB0F3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985861, "uuid": "504c437a-30a7-4449-9f2f-02cd86aa2c17", "value": "3072:doxy2If6xbQwVEq2OlXc8Se2aAacAMp8J25b7CTZl:dZaLVE4lXc8SNaW8J25HCTZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768985861, "uuid": "7103e655-6adc-4b45-999f-b6f3607f0123", "value": 162748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768985861, "uuid": "845e4f30-8290-4928-a362-bc7e45955b4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985861, "uuid": "10e85a65-82bc-4761-a9c7-37e4d9797d40", "value": "Orbt.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97ad00d-f666-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768958150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768958150, "uuid": "f53cdff1-fb7f-4a5a-b773-1526e13e79d0", "comment": "Malware payload (Mirai)", "value": "fb8fb65c21b58de93d797da3f9cce503", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768958150, "uuid": "84d2cb97-172a-45d7-b276-fb1fa5b0ac3d", "comment": "Malware payload (Mirai)", "value": "557a9ef4117523312d5cbf492e618053086e5e6b464e6dd0e9aa2355cee11de5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768958150, "uuid": "8fcf0371-057e-464f-81cc-45b12641a193", "comment": "Malware payload (Mirai)", "value": "e2e321d828d4745915bda825a0928a5b6582e9ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768958150, "uuid": "9f49235a-6882-41d5-8c90-96cc3bd43660", "comment": "Malware payload (Mirai)", "value": "c6045667985e491cd317012c345d44f777606304244f5ddc6e549a93c093da3b6a94d5ff5363016ecb6494ce1ed3d21c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768958150, "uuid": "51636932-53cf-4211-9087-cffc20c65f81", "value": "T1DB04881D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768958150, "uuid": "95bdc333-9c94-4757-b3a4-c43bc94c8c75", "value": "3072:jg57RM7LHZwbq1YSBan1yvbysxr1uGSLI:jglRM7LHZ0Bqyy1BSLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768958150, "uuid": "11834f65-e436-43cb-b1ce-05622e01d0d9", "value": 173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768958150, "uuid": "3a8c0e06-b292-4040-b50c-1667a88121a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768958150, "uuid": "71fa31c8-97d8-4ca9-909c-d2df762ea4c4", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67cfd9c3-f6c2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768997527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997527, "uuid": "decfd412-a9b2-4155-b50c-15de5c1eae50", "comment": "Malware payload (Mirai)", "value": "a7126104b9b24c27fd438c69d95d5483", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997527, "uuid": "1d3a4255-ece6-465a-9c11-023bd65bb703", "comment": "Malware payload (Mirai)", "value": "55c5e82d75ade06a10267c0c36e9f9cb2ea30a9a0d6c55c1a1b2ee7a59220f59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997527, "uuid": "0fdcd439-71da-4ba9-a55b-8f609dc34a57", "comment": "Malware payload (Mirai)", "value": "e4040df98be7a7fec57466b6849a00a86f10b5ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997527, "uuid": "beac668b-3d98-423c-aeb9-72717ad2aa21", "comment": "Malware payload (Mirai)", "value": "4c24a286f75c7731ffc71583151d1878f99416be0a58f2d6ea8d5684d1421fe61e1536f8ccf2fb5d30cb4475ff9a62e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997527, "uuid": "249a817d-23cf-4018-8255-9c5e6b1a187e", "value": "T184D32A6AA8428B11C5C716BEFE1E514D33131778E3EE72139E246F2167CB82B0EBB545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997527, "uuid": "57632834-6a5f-41c2-b68b-c4cdab1dd0f6", "value": "3072:UKEeHqVQ7xUDIPyOBnsxaDJQYnJT1Grva7Yw0fdYleCIt9j:UKEfD8ZBsIDJQ0JRG7ad0pCInj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768997527, "uuid": "6f4a8c44-7b33-4c7d-89e3-eb00cdc066ac", "value": 133048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768997527, "uuid": "a051c602-b1ed-4ba0-9abb-b4e5b94a3e78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997527, "uuid": "e6b03607-7d8a-48ad-9cd0-b4257d5cd493", "value": "goon.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6acd8d2-f69a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980560, "uuid": "c8e1433e-e794-4836-a11b-6cc291ba7373", "comment": "Malware payload (Mirai)", "value": "7b3fb71c3ea436d141a667b8975c2928", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980560, "uuid": "3101b159-0ad3-4940-b1a0-f87e124d5dca", "comment": "Malware payload (Mirai)", "value": "5670aba7c8c9cee88a0bd6ad32135d9eea213be0bb8b366c4ccfda12380cc488", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980560, "uuid": "58980b04-ab26-4c12-906d-a748d0736f97", "comment": "Malware payload (Mirai)", "value": "99f062a7ff6af2bfa6c9c405cc05616d6295fb52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980560, "uuid": "6f77ae77-179e-4150-9129-ba667b5d5636", "comment": "Malware payload (Mirai)", "value": "eb187ba0eafc430f1dd66292e44c644c90df7d6fbaee05e36ea824d765b907d5b94af60aa337f76550a894b04fa36cc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980560, "uuid": "252ffee6-2008-4ce0-8a06-6c07d56736da", "value": "T165D2E1CDD5F4F8C4DF6A8A31A4AD51318A4130A676EE4DACF321DC1E5928F5B72890F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980560, "uuid": "96cb3763-231a-46a8-bdc7-2be4f9ce897f", "value": "384:FTxPknusG8GovTjrflqX6E0WSdJEaLVYgsghdJBl4Sk6h+O4+k69mEjxPyRWGVCA:Mus6ovT/flqcWyJRLegyu+z+38EjwW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980560, "uuid": "daa5b07f-cec1-40a6-9169-e05e5e8ea5cb", "value": 31072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980560, "uuid": "723a9ccf-aa43-46b5-af88-21ac21ba01e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980560, "uuid": "c39cbcbc-d396-4890-87e6-07b3460e0e48", "value": "sdxkzX_UXA229x.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aba38ec-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034898, "uuid": "896d6cd7-9499-4fb8-ab46-0c649b1cb3d5", "comment": "Malware payload (Mirai)", "value": "6b6e046c32f5ba150d52b11cb62e5a4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034898, "uuid": "8b513c54-b5b4-4423-b382-f064d87765ec", "comment": "Malware payload (Mirai)", "value": "56fbe540dbc23fddc5be95941b83730ae9a7cb6e95945da3877f27bb281cb6e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034898, "uuid": "11225a4c-00b4-43d6-8261-cb30120dab24", "comment": "Malware payload (Mirai)", "value": "eea9fe8df07e8767546ec79d6091ca26cca3bca5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034898, "uuid": "7047d119-718d-4f90-b4ba-813594d7123f", "comment": "Malware payload (Mirai)", "value": "3210f1614299bcec107743e678ade0643f971a68b96d0fabb1bbef5c3fafd43ae64dee6548146d1e867d5d2594c1db99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034898, "uuid": "3b5b70ab-d532-46d5-8ef0-c6e32c169cf4", "value": "T15E04C50E6E26CF7CF7A9873447B79E219668338326E1D546E16CD3105E6128E241FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034898, "uuid": "380af2cc-d3f4-4970-b624-0f8922e0fef7", "value": "3072:9yUbnXCmQyXNjvOt11WvzLxUUvESMdMdADPfgt4bIEFVe7vdrJ3NfFNjS2kFVHq3:9yUbnXCmQyXNjvOt11WvzLxUUvESMdMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034898, "uuid": "ccd1bd66-e589-4a9a-8b48-212e23c9d239", "value": 175800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034898, "uuid": "e28aa4ca-562f-48de-874c-33d6dac2bc95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034898, "uuid": "488a1abf-b3f4-458a-a8e6-138f09235458", "value": "m1ps", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8fd096-f6a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768985808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985808, "uuid": "204f3924-045a-4f0a-afdc-9a035aa08fa8", "comment": "Malware payload (Mirai)", "value": "e3a5ec8dff23e7804a5e4b43b18d915f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985808, "uuid": "a59d8f9b-16a6-4880-9692-5d8553226198", "comment": "Malware payload (Mirai)", "value": "5756a91c1c659ea68986af0b7b15c04583ab1c49e1d31b4ea3ddfbd0c79dd69f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985808, "uuid": "adece8cc-d8ca-4790-b006-4d60aa783378", "comment": "Malware payload (Mirai)", "value": "1a9d1063f89a052121252788805a6d6aaaf8ed42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985808, "uuid": "e4ccb8c3-f502-4758-bcf1-6edd12bc4d72", "comment": "Malware payload (Mirai)", "value": "5bcd3ead3349cc42c8d8daf249b460690d63c04e981cc3cca0d643c01c99c4624ae7826aed72be8cd97e3a3ccd8641f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985808, "uuid": "0c24ad45-f021-4c8d-8e07-f018823e35c0", "value": "T110D44B59A8419B95D1C02BBBFF1DA34873132B38E3EFB1069D195B246B9BC1B0F7A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985808, "uuid": "6695d3af-2d7f-44a0-802d-6e46aa0e045c", "value": "12288:pQtHcPm2jXsdApEQ1xHC+Y3NEYKgRHirt2Cny/w3nwfHiaZe+D+Qj+EASSksR2:pgfdApXxHCooirKwFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768985808, "uuid": "9c221a76-ab1c-409d-a7a0-65c4a006b750", "value": 597364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768985808, "uuid": "a898cadd-e38f-4736-862d-a9e8bfae9a1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985808, "uuid": "b5a69d0c-b23f-4ce3-b001-033ded09eccb", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e97b6a-f6c5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768998649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998649, "uuid": "671ce6be-7ae9-400a-b748-02769b553f38", "comment": "Malware payload", "value": "b7384f3b21b7543c68ea9b964fe70872", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998649, "uuid": "43369b02-e8be-4b60-82e3-fdfa0f94bb20", "comment": "Malware payload", "value": "57aaef1e742e6af66c90382711c58d933526e8e68b1bf823b6af33a96edd84f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998649, "uuid": "4696c243-b7b7-40ad-a443-d4676f23300b", "comment": "Malware payload", "value": "a773f65fd87f0c19f60ab2b36db8727224773d4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998649, "uuid": "e46235b3-6b58-4b94-9e9c-f04e5077893a", "comment": "Malware payload", "value": "55646e5d067add539aa188496538893525c3bc0f14abb872e0edab662da3c401c83f56bf8a7a4577db6d6e89bfa6b28a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998649, "uuid": "d407b6eb-4962-4d8a-a3b2-aa743c567120", "value": "T1EFF35C46BE911BDBC05ECB31066B831313EDD88A53AA2B2F757C8D9C3A597494CC3AD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998649, "uuid": "3c2c3548-7dc4-4259-a6f8-ba8038e3ca8d", "value": "3072:wKq5ttjPssQxpXOIbxZWkF+gAnOR9NrvIC:wKqtsdxp+IXr1RjTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998649, "uuid": "68561c8a-6b0f-483b-8ff7-5057cf814ace", "value": 163724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998649, "uuid": "7abfad66-6de6-4708-8804-2737949c7f82", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998649, "uuid": "f79476f3-8e5d-433e-b351-82847c3b24a1", "value": "titan.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902f6d43-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034961, "uuid": "790d203a-f67d-432a-b49c-1a74cd746ddd", "comment": "Malware payload (Mirai)", "value": "34dca36fe7373a2c084938db2af795dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034961, "uuid": "f3333a08-35f5-4f5a-8f4f-fbea79827298", "comment": "Malware payload (Mirai)", "value": "592b311c0d7d125cbe6c00ce870134455eeec269f2f900b9be3064cf529f18c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034961, "uuid": "cbda4307-03eb-4985-a922-f05154a43363", "comment": "Malware payload (Mirai)", "value": "4a515da5eac9a7079780cf4779ffd95c2009e276", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034961, "uuid": "1ac3a43a-3c3d-4a87-ab21-9054b7dbc697", "comment": "Malware payload (Mirai)", "value": "51eec8c9c5c8cd76320fba18f4371b4750556e381f8993a166c38a3fcc20e4a282a972aef28c48def2876571497e2117", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034961, "uuid": "fa48408a-2613-4f3a-a127-e67bcc630ec9", "value": "T125042945EA404B13C0D627B9F6DF42463333AB9497EB73069528AFB43F8679E4F12A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034961, "uuid": "d3f3ae67-12d0-471e-8ede-e2131609569a", "value": "3072:OLe6vhN1QIruCee+asuTuRebU7IVILOZQy38YhTfYo+M/Rvs1tlLn:ee6vhQIr1r+asuTuReAvLO738+x+M/RO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034961, "uuid": "522bbe81-776f-4218-9080-991e4abeb843", "value": 181474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034961, "uuid": "7645d517-dad8-40d8-84f2-d1f69e645036", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034961, "uuid": "b13df1c4-a0e6-44c9-beaf-bbe06859945d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27691a7e-f6d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769006868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006868, "uuid": "7d5b383e-87e2-464d-b199-e08ac363e351", "comment": "Malware payload (Mirai)", "value": "c3bd629c00525ef0dfd45c23c22a858f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006868, "uuid": "0303e15a-af64-40c4-b5b9-e046ab6786b4", "comment": "Malware payload (Mirai)", "value": "5935faae472a81a43c2a030bb7fb03017555d5f95335845588b35292eb904670", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006868, "uuid": "7dae9de4-769a-4a12-b9a7-aaff439e3998", "comment": "Malware payload (Mirai)", "value": "90f00caad54b9aee3b0991c52056c0d521a9040e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006868, "uuid": "8cf15cda-0b4b-4dac-baa9-26e3dff45f2b", "comment": "Malware payload (Mirai)", "value": "c4c2cadea6b413c1cdcdc2ae1b410d939a1b2e7fb89afabe41a282738a7b272c6b86891ced7bd1951788be6c7fcdb95b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006868, "uuid": "efc28620-329c-4321-94d5-e68e334f7412", "value": "T1BD43F895B991C616CAC46277FF0F42ED771643E8E2EE73039919AF24369782B0E3B540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006868, "uuid": "d58992ef-d139-4e7b-96d2-7c05b04cfaf3", "value": "768:BE25/1jtnzKa90rqnJy9oYWcmujCVN2z4B1qXtyhm/pynaSGyp6ZZpYxPFotdhT2:1/XkrUJWJk2z4B1mnBXAfFohT2bVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769006868, "uuid": "4313d478-8f9a-46b7-b1a4-1cd72e09d257", "value": 58580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769006868, "uuid": "91d3bb53-59db-4d39-aa0f-88abf9c92875", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006868, "uuid": "578184ca-7cc5-4a74-972a-b7a031f52414", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad6b084-f6b0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768989801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768989801, "uuid": "7528b153-f00e-4774-9a97-fb42c49fd1a1", "comment": "Malware payload", "value": "c12fb7a5128feabfb4f469e2b6f1f3db", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768989801, "uuid": "5dd431a6-9937-456e-b908-f3dcfbda2b47", "comment": "Malware payload", "value": "593a9dc7daa61f7aa6a152a095b01c696019beeabe3dd63264e8917b9a97a7ad", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768989801, "uuid": "e6f54875-7cf6-4ab0-8b35-3f6f539e6d92", "comment": "Malware payload", "value": "00255e69dfccb597daf40bafaf3137427db7f9b2", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768989801, "uuid": "13e5c51d-0b0b-4153-8c89-2ab2739c5148", "comment": "Malware payload", "value": "d78b63ee03559ee06e0fb5a9e18776b5b411c11a1f7bddec8eb508e3bfd04f9d5c5c1b5888392524c5466a134d159940", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768989801, "uuid": "114ac861-75a9-41be-89a1-ae514548f6d1", "value": "T1E766332259E36E42E36C59FA77338182A04A5925E5201238D52F4E8DA613DDF0FFD7F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768989801, "uuid": "69bd84b8-e8fe-42ce-be3c-4988e41b8a54", "value": "b58258e2297dcb3863be03d7366a04b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768989801, "uuid": "52c9c976-8275-4148-abea-f97768733c6c", "value": "98304:xnSqp8baI7URIvBv2mnM1do9Bw2dvpJKjT7dOX19Jpl0raI6iUClm8Qff2/O:JSqp8GInNBKAw2dvp87aF0rxPUomZf2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768989801, "uuid": "3604ce13-5d53-4902-8cc1-78520dbd6e53", "value": 6780944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768989801, "uuid": "86e9892d-7e96-4bc7-813c-23cab9b923c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768989801, "uuid": "77401156-f59a-4d53-bf40-7c575be5b949", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986451bd-f69f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768982576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982576, "uuid": "e3b868df-1005-498c-9baf-5002308c284c", "comment": "Malware payload", "value": "f373df6399fde6e40d9d3dfeef3cbdcf", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982576, "uuid": "586a909e-51fa-4127-a933-e6e08bbe1792", "comment": "Malware payload", "value": "59943554ae244e65ddd1d720238fa47b8be3e341b7c02c436d08b6f03cb620e0", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982576, "uuid": "bad5b45e-19ab-4098-bd78-2753a8e8927d", "comment": "Malware payload", "value": "f15cad5274886581eaf08e40b98506f1c5442ce2", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982576, "uuid": "283c2c9a-9c9a-465f-a075-52c5d82ab0c1", "comment": "Malware payload", "value": "b3a6bdbaea8bf1ccd241be3a82421f9a0109c51e7abae3f4da7e89bcfb6998213f055f7660120ef968774efb96bac336", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982576, "uuid": "9d624226-5f9b-455a-838d-6f8170f1117e", "value": "T1FDC73321B4CE8B31E66F90345669DB39A2F13ED107B144DB53D0D9BB1E3A5C20A76F22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982576, "uuid": "956fe7a3-6db8-4c62-bf68-d031e312fdf6", "value": "1572864:3ubnD/IqC/25jK4vz9iMgckqosQIcN54c/mJfLZ:3gnD/a/AjxMXGPfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768982576, "uuid": "48ffeb62-af3c-4e52-84da-e22f3eb8adcb", "value": 55830528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768982576, "uuid": "51a57b3a-dcf2-4f72-b85d-d8bbe89514d5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982576, "uuid": "935754be-c910-4ae6-9fab-4ff096c399c5", "value": "win32-latest.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ff185d-f719-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769034966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034966, "uuid": "27834b5c-8960-4113-a1fc-4e8ce7cd7d44", "comment": "Malware payload", "value": "41be7bb0ebe7127d186150a426744239", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034966, "uuid": "45488848-f89d-403c-a6d8-e375ddd89d89", "comment": "Malware payload", "value": "5a6764c467642b38b95d21072cb969e0223a21c9e8e177090f9a4aa0a1336b55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034966, "uuid": "4018fa9f-85cc-4705-b446-ae5dd6fb0042", "comment": "Malware payload", "value": "c4fde761a458db6d66ef90178a32e64f0f00f84a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034966, "uuid": "862680eb-8cd1-4673-ab7f-2aee16fde7da", "comment": "Malware payload", "value": "ba8055a723fa68159ea3251ce089caff72be07c897c1adc7c2fe8ea0cff525a0c455325edf134846eb2aeaef8b6353e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034966, "uuid": "f7de30c2-5549-42a1-98fc-3d182334f8d2", "value": "T19CC35B0672180F17D5A35AB0263E5BE083FED5D020F4BB89691F9B668672E371486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034966, "uuid": "73124b01-ab62-4885-b139-0af27719f5dd", "value": "1536:8+ebaW8zqIjkVWV3KY0gPWhZ/JiZW+tUh+XPc41UpcHARLf3qCQyOXpkwi+qQDQC:858rAyPWnJph+XPc41U8qvQyOXQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034966, "uuid": "01f20f31-f2d9-452a-bb1e-41ab399938f8", "value": 126480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034966, "uuid": "5558a2a3-6dea-44aa-9b17-5b20a27550e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034966, "uuid": "fc972dd6-4aac-4a34-9417-533bf501d470", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b11443-f6de-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769009650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769009650, "uuid": "e9fec8c0-b6f4-480e-8dac-f67d0d598880", "comment": "Malware payload (Mirai)", "value": "50fcdef9c83b0ba8cc4aeb1d7a8dc8c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769009650, "uuid": "d6711fcd-ea24-4e1c-b6b9-94828cba8de9", "comment": "Malware payload (Mirai)", "value": "5ab70732507521d05fa8ac92e64759a795a4c91f5e27dd7965b9a1ef81c304ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769009650, "uuid": "edfd31c7-3b12-41ec-9b94-d65c807e3b14", "comment": "Malware payload (Mirai)", "value": "629fe898f58c3a233594176227ae3f372c9b5b4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769009650, "uuid": "871af9e3-b189-4131-971b-2783150564d3", "comment": "Malware payload (Mirai)", "value": "43cff973652bafb6291b440c222a03d9bf7d02a099745a617d177ee7723b6a3b99978ef49fb1a132c806eb5cd2b00177", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769009650, "uuid": "d907a237-7763-465b-a818-65c01d7472dc", "value": "T122146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A99772256246CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769009650, "uuid": "7bea9fb3-30f8-4f3c-8437-5b7876b1c354", "value": "6144:zNROm5155gL6mTX7zRR1Lwt8Al7IKTtz:XgLnLzt0ll7IW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769009650, "uuid": "e33a256c-3b7d-44c4-a0e4-749a62aa027a", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769009650, "uuid": "99a96b7d-f291-47a9-973b-0a85208b681c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769009650, "uuid": "af57517b-f87c-455b-bb03-f7db2b04271b", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d11127-f68e-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768975049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768975049, "uuid": "187c2935-9fd1-4772-a1e3-2eed3b7155c1", "comment": "Malware payload (Formbook)", "value": "dba24cba0127fc2f6d4d03852cc731a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768975049, "uuid": "391f6dbd-279d-4727-b4bd-f2f8fc5b337a", "comment": "Malware payload (Formbook)", "value": "5c0bdefeb2e965c9cb1aa42e28b84b31e11693b4438c47e97be98fb1b496d940", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768975049, "uuid": "51fe5c85-1ed1-468f-a88b-0e733f82492a", "comment": "Malware payload (Formbook)", "value": "08866796251b922775699ba9a72d1e5257ea64dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768975049, "uuid": "afc6fb4e-1c37-4d5f-8cad-d1071a68d0c4", "comment": "Malware payload (Formbook)", "value": "205356d98816c8c4ee3b8551f566c899166d1279ac8ab4dd746c2ea6fa3728332b71c4bc9e72633eb95863c672580c42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768975049, "uuid": "88978d4c-a1d3-4229-b530-ce59f9f9ae4c", "value": "T15125125867D9CA02D4E70BF509A2E23113F4BD9EE411C24A8FE9ACDF3870F4199647A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768975049, "uuid": "94332a36-8ce7-4214-bfdc-c38fd0a57210", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768975049, "uuid": "732255d5-942c-43cc-9da9-b7e9ca1e2c19", "value": "24576:zFOBQkVDKBOFugCTF5OS2+8b6yUo6Y894GMirGwrB:sBQHoKbOS2tGyUVY8pPrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768975049, "uuid": "ed85b381-0767-44af-aac7-1c0b7009ee33", "value": 991232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768975049, "uuid": "39dec327-1877-4e4a-8a26-86f4ffa97450", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768975049, "uuid": "06a9ee5d-6459-492d-ba1d-8b87a516855a", "value": "PO 0130356-501 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607bae32-f6c2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768997515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997515, "uuid": "130f1e05-a93d-4f86-9646-583ae97d3db3", "comment": "Malware payload (Mirai)", "value": "0b80a6cc5ca94cac852a8cb694e90f9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997515, "uuid": "3aba68f6-3bdb-48a4-a98e-771191907dbc", "comment": "Malware payload (Mirai)", "value": "5c27fce16f72f8941685cf7cd7d13eea213fcd1f58f310a601cfa8190400fcdb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997515, "uuid": "2129ce02-a464-434a-8e0a-47914ffc3688", "comment": "Malware payload (Mirai)", "value": "80a1f61764a081f2442ec5be0cea8f3948728610", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997515, "uuid": "0772792d-52ac-4afa-87f7-3b1cf7f496ae", "comment": "Malware payload (Mirai)", "value": "072c27bc4e5db9c7086d2290acb505b6be785415102fafc8e1a0bf2aa1ca878161aca8adf8c70b859ce6154d7d58f505", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997515, "uuid": "8afabfda-b11e-49c0-a29a-e427452bd503", "value": "T195B31907BAC1B4FCC049C1350A5E623AD963F4692234B6AF57C4EE162DEDF113B1A6E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997515, "uuid": "67b3f338-b1b1-433e-8dd3-f166d0710f66", "value": "3072:v5GOCzpQbGjsh050H6PE7UXw2Wdekai0cP:BHCzpDjsh050ac7e0h0cP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768997515, "uuid": "2fc785d7-8579-4fcf-921c-d7c29a347bb5", "value": 113616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768997515, "uuid": "a02d653b-74f7-420e-be92-2e3c82671e65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997515, "uuid": "8ef4bd40-54e1-4e3e-b491-c3f2a05eb2ad", "value": "goon.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08bc1ceb-f719-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769034734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034734, "uuid": "1881e598-5fab-4c71-89fe-027c61fb2f06", "comment": "Malware payload", "value": "066e94cc55e32d71a0bb280e474fb6f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034734, "uuid": "7833f292-e044-482d-b087-6ff6df7496e0", "comment": "Malware payload", "value": "5c6985df87f4445477790a14971cf5d972377cd30912f6133d38205c2e622d05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034734, "uuid": "ae75abe2-a7b9-4be8-b234-3f415b4c78ab", "comment": "Malware payload", "value": "9bcc57ac982595c922b78fbfbf0bfaebd1076a37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034734, "uuid": "952bf422-af92-48f0-85d3-4dc6ef82e25c", "comment": "Malware payload", "value": "587803d714192e83d0d5ef0fae197b826e02e0505e75850c7fe57001b0079a2126585358f2f4b956124602bc42f46d8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034734, "uuid": "91b6a759-8be6-46d6-9a84-2618e2c3d970", "value": "T1EC333A13A981D0FDC5AAC274076FA22BD933F03E1235F25E37E8BA26795BE311E19505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034734, "uuid": "d7cc4adb-e0b3-4f08-9021-5497824bdf63", "value": "1536:9dyKLo0WuloV9PYuHx/krGCZHGvt3Ugohzi:byKLk9PNH+KkQ3si", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034734, "uuid": "79d654a9-5302-4909-b14d-4bdeec76811a", "value": 50832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034734, "uuid": "a93220f0-073c-4a92-bb35-3e6978830658", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034734, "uuid": "2740edde-805e-45fc-b3fa-b423c2f38d68", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1de85da-f69d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768981787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981787, "uuid": "0c580c65-251c-4952-8869-d238b387decb", "comment": "Malware payload (Mirai)", "value": "03b3b3df12f0cd6bfc268e05d9b36c39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981787, "uuid": "d378821c-f6ae-4200-835d-809d0ffe5ca2", "comment": "Malware payload (Mirai)", "value": "5cef3fd6d7e4cdf41358f821a833f4ab0ae37a163589b70b79c1a0c098a3ede8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981787, "uuid": "842197b8-d201-4721-b0b9-e4762fed6e43", "comment": "Malware payload (Mirai)", "value": "d8d2e202d15043920eb0bd5e9622ae3f1ec3ba19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981787, "uuid": "3f043060-4dc4-42d1-863f-65b42d8f79dd", "comment": "Malware payload (Mirai)", "value": "2e61b7b7cae700a0c357edb1280ca09d4cb8d1f4da6071003c51c78adae0c954c9f6675660023b5f92ae5a0d355aa054", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981787, "uuid": "b09fe05a-3140-41d3-b53b-06d86a11c3f9", "value": "T18C72CF329E0B6D73DE348C36DA7DC94B6B43157999EA3076340424ACBB5240B4BB634A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981787, "uuid": "c6061736-93d3-4a8d-877f-5c1c76f5cb1e", "value": "384:wPIAb4uVpq04FT7hjw3GzRT5Kjuw4mzLw6hymdGUop5hInP:wLFpq04hkWl5KiwJ3w6s3UozinP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981787, "uuid": "471bfa31-454c-434f-b1b8-5d739db6935e", "value": 16604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981787, "uuid": "1782471e-044e-4b5c-ac21-c184b146eb96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981787, "uuid": "138151c0-74ba-49c8-a67b-2e060a279e40", "value": "ub8ehJSePAfc9FYqZIT6.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9347bb-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768998641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998641, "uuid": "19d10e42-f663-49d3-8e68-754a489f2eff", "comment": "Malware payload (Gafgyt)", "value": "b0931d009c6cc1cc7b760d26b562b97d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998641, "uuid": "014d8703-34d3-478a-beec-60aea6311424", "comment": "Malware payload (Gafgyt)", "value": "5d4a92220b3f6ec02fe6d6c713958cfdb9b9820ee0dfa803165f06c5daa8f582", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998641, "uuid": "19ee486d-35d4-40fe-b4db-2de4ff0bb426", "comment": "Malware payload (Gafgyt)", "value": "614cc784b6321336b54023db2294fff2defd1d94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998641, "uuid": "f5e7a519-dfe2-47eb-b03c-6d42562a7a9c", "comment": "Malware payload (Gafgyt)", "value": "821ffc352ffb69a249e4fcd5acf6ef30d2684d2a571cae87ac27a3e68724ad4d930b0c2ff784c20bfa48f71a314ca135", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998641, "uuid": "ce8ec5a4-81cf-4e35-bb71-a945a1ef1818", "value": "T1DBA36A45FA9BD1F3E88306334627EB6E5770CC01414EDE45FF0E7A68AE2174A890A76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998641, "uuid": "b0b51f23-4b8f-499c-a87d-d59dfd424811", "value": "1536:5+33y3mzvDjRM2bm832vXvanCCisaum1Z5x2eoreLJVjUPDWAP:s3iWzXRT7GvfanRi77MeNVjOfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998641, "uuid": "d7c2a896-fe1a-485e-8932-9fdb32328e2d", "value": 98380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998641, "uuid": "2f87f4bd-2a06-478d-9349-638e46dd355b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998641, "uuid": "cec0ec1c-799f-4a42-a2f0-f4f136c02da7", "value": "titan.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69642cee-f6c2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768997530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997530, "uuid": "ced20923-d0b3-4ebe-a6f4-40861df3f496", "comment": "Malware payload (Mirai)", "value": "43180fcac99d5491163640fa06429c87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997530, "uuid": "20d4a702-190d-4e5e-8cb7-343376fc1678", "comment": "Malware payload (Mirai)", "value": "5dac2dc56879d36491c9ec38bba143ce753d8d78ec0907b8522b86324d8c00e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997530, "uuid": "4e67ac4e-7410-440c-8ae5-9f3ab29536aa", "comment": "Malware payload (Mirai)", "value": "a61d513602748fa3f6e11d60606e199f44ff804d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997530, "uuid": "f52defce-f900-46eb-86b8-99657676e717", "comment": "Malware payload (Mirai)", "value": "8e0c8cbe4efd4013efd748f7aebcebc8e0cb0e6ba7f4ac178dfbf541df8aa3fe2bdbfbe0828a0533bd01a1acb50d11e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997530, "uuid": "58c54723-fcd0-4f2a-a186-15ace733a4bf", "value": "T1F0C31943E783E1F1E76501F0215BE73A4A36E8324112DD66EFA4BDB27C61341B65AB2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997530, "uuid": "0cbc2d51-844e-405e-9329-7ee8825182e9", "value": "1536:XSbFf6S3W5Jt2caeck2f6SqCW8oNvn3uFwXUx31Uab195oC7ZcZz0HCrZ:XSF8D2sXn0qK8C+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768997530, "uuid": "0d42bdc0-be6f-40f4-816a-b6ac42b93cee", "value": 128356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768997530, "uuid": "a12a4f70-22a3-4454-91a7-dd49a3220af0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997530, "uuid": "19402c56-86fe-490e-b15d-a064b415d988", "value": "goon.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef70afc-f6ab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768987607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987607, "uuid": "a67ab69e-ac73-4c2a-a452-80e3fe81a3b9", "comment": "Malware payload (Mirai)", "value": "2cefbab2a9181910d7f99012e4737186", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987607, "uuid": "7df0682a-d63d-4f5c-b56a-91e3805ea830", "comment": "Malware payload (Mirai)", "value": "5e595ef333cf9a2d7760182c7457de9e99f7f39f1ee4725596a2dd43d73e7d35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987607, "uuid": "7ab82291-e2dd-4f03-ac61-128a72b3fa53", "comment": "Malware payload (Mirai)", "value": "a40c11ca6cd3b39e84c0661a8a37423f3f05af85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987607, "uuid": "0dbbc5ef-e801-45a0-b6c3-7a9e7646377c", "comment": "Malware payload (Mirai)", "value": "47a473a97322d21542ee6c0070aefd83d51ecf143d334c987b2c34404abe4defce87e7394888b7f26bd6339259d2142f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987607, "uuid": "36076f89-2970-410c-b9a8-316ab2f00d58", "value": "T1B114B95E6F328F7DF6A8C73457B75A20976923D627E1D684D2ECC2101F2028E541FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987607, "uuid": "63f6319d-38b9-4eaa-a4cb-537ec043a698", "value": "3072:op4tFiK08/2zcvTcZTkdlY/NwvMPxSQBr39Su+ANEJ038E5hX3de:oetFiK9e0G6lYiwt3YGEJjE513de", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768987607, "uuid": "5a9718c6-df6f-45a3-b56d-acea248af116", "value": 198524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768987607, "uuid": "3d03e8dc-6217-40f0-b8c2-6e4385d47e25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987607, "uuid": "fbeb4c1c-2357-4880-8179-dea48242ee23", "value": "Orbt.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f95e533-f6a9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768986856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986856, "uuid": "b0ca5f2e-9a59-474d-9086-2d5025beadef", "comment": "Malware payload (Mirai)", "value": "be4abf457783736a1970a9c285748fe1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986856, "uuid": "d1281904-a4ce-4af5-a0ad-d2adb6c55f75", "comment": "Malware payload (Mirai)", "value": "5f2d4170884bf455d550051662624c6f7ec163c7ef13a174df47eb47e96f7449", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986856, "uuid": "cdb59443-5ee7-4fa5-bcee-1ed9cac1f2e5", "comment": "Malware payload (Mirai)", "value": "1f25ad6d79d482ba98d915e71e834593e9669343", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986856, "uuid": "b9802b09-e510-4e1c-8d6c-7f01827c4d0f", "comment": "Malware payload (Mirai)", "value": "22ddcec3a3235a67c954a7d676a30d500e1d440d5cde0fe8807bd7fe701cda75a948a75152d5340fa2b0cb4ddeef5ec2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986856, "uuid": "4ff2322d-1af1-4b6b-8f02-45c96c96efdd", "value": "T1C5C2E1960DC90EBDCE4093FDA23F4BE5283879FA5F4F85542C2D9ED552F9272A260029", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986856, "uuid": "e8c1625b-d925-4550-91b7-153476acab62", "value": "768:rFvBH+bMXPUzzkTsjOcj6kex5grhTJFk83:rFZebMXPdcj6kSgrhTJF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768986856, "uuid": "90417d70-4b2e-4851-8c99-cb92444b4b93", "value": 27348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768986856, "uuid": "727dd9f8-1d58-446f-aa0e-e83d41476e8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986856, "uuid": "9df3c682-e079-4042-815b-057204d1cb00", "value": "sdxkzX_UXA229x.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "127956fa-f6d7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769006403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006403, "uuid": "6daa3ba2-31c4-4902-ab90-3435f6ce0d91", "comment": "Malware payload (Mirai)", "value": "aab964c7b6e62dd798a9d98ff613f518", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006403, "uuid": "52f0c330-b140-4086-9fa2-7520b03f555b", "comment": "Malware payload (Mirai)", "value": "5f444c1905a44e07a2b4d79a9f1c2dbc4a0f33e30da3a64e8216745ec07da75b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006403, "uuid": "b521470d-221c-485f-9be9-80818e99f4af", "comment": "Malware payload (Mirai)", "value": "e4bf5c0ee24a4ce2eb9076a5e154233098847984", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006403, "uuid": "f66703df-2552-4e9e-ba53-8a08c1b84303", "comment": "Malware payload (Mirai)", "value": "a7822bff1e9f53cd42d62a4c19f03264e1dbbf5dfccf040192aec1c9fd4eec010d5ff05e82c3bd1cf502e16bc6ce7040", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006403, "uuid": "2a5625b4-25d4-4885-9b78-f508c5f00ec3", "value": "T17CB3D085B210AE55C02272FCB1870A90D3B16E7B4B9A150B44B3F5B46DBCCD47E1BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006403, "uuid": "c7905c97-cfce-400a-9a6b-d71eb1929ed2", "value": "3072:X5Apzl9NOvXoVLAE375lhYy5SkOXNwu2:aevXCLr59hmNwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769006403, "uuid": "8cb6834a-fd07-41d9-b809-ff93635b39bb", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769006403, "uuid": "d82547ed-a160-430f-9dae-e656a2f520fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006403, "uuid": "3a280af4-ff4a-49d8-941b-37a1e87825ba", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed32c34-f718-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034690, "uuid": "8fc04043-6a60-4c03-b9a9-1caaa80b4ddf", "comment": "Malware payload (Mirai)", "value": "d885716d52fbab87e274b445e047cccf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034690, "uuid": "c5ecebec-8e59-468e-917f-0e42c48d211f", "comment": "Malware payload (Mirai)", "value": "5f44e7405b7903aed32ed22105a7a7f93d22652bf1feb639b5e3b7e57cbc07ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034690, "uuid": "57185247-1302-4830-bc60-822aee936901", "comment": "Malware payload (Mirai)", "value": "e87a5eb2ec1c8f713dee414d993d27d4b3dce5f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034690, "uuid": "4df97339-7666-4a43-8d0e-01cd468cb24b", "comment": "Malware payload (Mirai)", "value": "dd05a8b9fc6761ddb32ee85313aa3cccfa586ca10578682e3ee49a6e5b11488d37e68ddc86a7b1028599dc8fe3f63a0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034690, "uuid": "33ee1ab2-9818-4bb7-86c8-ae24b4666451", "value": "T148530856F8818E11C5D412BAFE2E118D331767B8E2DF7212DD206F247B8A86F0E77916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034690, "uuid": "c687834b-550d-4ae6-969e-f19bb161a70d", "value": "1536:oMnbVB/wIHFDoWccI5D8508+9zIIsiML/b1D9:B9w0DIcgDrmL/b1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034690, "uuid": "7f506f7d-70b6-4249-a0f1-54e819d1bc6e", "value": 63004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034690, "uuid": "bde5b3f4-e402-4390-860f-eed7eb8dc300", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034690, "uuid": "b5b6de49-93ce-4322-89db-76d9956f30ca", "value": "StormStresser.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b5486e-f69c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768981125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981125, "uuid": "62296730-3e95-4a60-a1b1-f20dae9a61a4", "comment": "Malware payload (Mirai)", "value": "da56c79fdbb6d408c55f546205441f64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981125, "uuid": "502fd640-5b3b-4a3e-9319-1813529982e7", "comment": "Malware payload (Mirai)", "value": "5f91211f9fbaa1686d24c1e720676f282ec6c9a6e8bedc6a3bb8b4392b1bdd48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981125, "uuid": "e23e5336-9072-42e5-af1f-aae726076936", "comment": "Malware payload (Mirai)", "value": "e323ae923360bdcedc125949850d554061481c53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981125, "uuid": "e254b6a5-3508-4d14-a8b7-5953d69041d8", "comment": "Malware payload (Mirai)", "value": "f4abf8f4a9f1e343f5cf11fbbcefb8efb67338660781436e429a4f0b1ca104af0ad03be5d98c1d30492f98313b7354d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981125, "uuid": "112a328b-e751-459d-8cee-6ecac3ee32ac", "value": "T1C5B36DC9F58FC0BAE85210313126AB3657B3FC39123DDB53D7AE963198A3580D62A71D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981125, "uuid": "db48f98b-066a-4219-9bfc-1d4232c7f8d5", "value": "1536:bymy+rpMawaOCBaqXwwyVXJ/0ZrTUqrQJiaE/62c68F7EOcFrUD3LS9/+QrKBpm:WmFrpjwC1gSWYau6e8F4tQGl+QuBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981125, "uuid": "b17a9c73-f86d-4b77-a5e3-7425f2d5ba55", "value": 109420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981125, "uuid": "b9b2e957-ca5d-4fbc-8e9d-999b29b0d767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981125, "uuid": "e6d27690-bf93-4463-b002-97c4f380f046", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d602e4a-f6bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768996194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996194, "uuid": "67d6828b-18c0-4c06-bf23-84805319fcb4", "comment": "Malware payload (Mirai)", "value": "8ecf95e90ed7aaf7987dd8ce743739a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996194, "uuid": "a602c5e4-1044-444d-aec3-c6b862db0eb6", "comment": "Malware payload (Mirai)", "value": "6012b94a2e7e1c86a8184ecb88b8f295f037a87a3268fd357597a0b39f6cdef4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996194, "uuid": "23917865-acb5-4094-ac6f-f246a22a66b9", "comment": "Malware payload (Mirai)", "value": "e82f7ae6579aab2a9717d3f9cbb127730d0cee31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996194, "uuid": "9b7feb7f-b2d9-4bbd-9427-c289da76d9a6", "comment": "Malware payload (Mirai)", "value": "87800fb8c11797104904fc8f2316c41513786c9964d48e8087b8998958f99162fca363be28aa43d19731ab66e431767d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996194, "uuid": "66066eb3-0ef8-4d86-b270-e1a1642f0874", "value": "T115E34D56EA818E13C4D527BABAAF01893332A75493DB730689145FB43FC6B6F0E77601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996194, "uuid": "2936829b-d1cb-4715-9206-0a4aa66a5372", "value": "3072:kgxYi2gojQeTWKrsRdxEK36w/WyCmwde7u+bnZ+xC1TNXnu/IM/9FKxqh:vxYi2gojvTWK4REKZwe7u+bnMx4NXnIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768996194, "uuid": "0f8d2904-402e-40e6-ad5c-5faf59ef89d2", "value": 156877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768996194, "uuid": "2218cafd-06f0-4784-9c8c-90838eb414de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996194, "uuid": "1a8b764d-b7fb-4ecf-bebc-c549a4479dfa", "value": "UnHAnaAW.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d9d790-f6e9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769014454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769014454, "uuid": "8bfd5c26-9d71-4e8e-bf8e-dcbf83587b48", "comment": "Malware payload (Mirai)", "value": "ac2cf3aca651653df582c1f98540240d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769014454, "uuid": "a32361df-657f-40e1-8e39-e50caa12a4bb", "comment": "Malware payload (Mirai)", "value": "60246e66a15265caf6b8d57f52e17f1f58f33498944d18dede0b91b8d4ebd087", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769014454, "uuid": "95af88c5-77b6-4b08-8e75-751a724be6fe", "comment": "Malware payload (Mirai)", "value": "bc5f3f03466cd900653d2266f26e2d2e2e8e22c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769014454, "uuid": "4314d75e-4d5e-4950-8adc-60de907fa241", "comment": "Malware payload (Mirai)", "value": "2ede923f9f14977af3fd5210a93de202e2438bfc227900f0dbac894425cf4f2aa680dfc4aeb849aee3f7efa9e4026ed9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769014454, "uuid": "c37590f1-9060-4f95-acb3-f725900578be", "value": "T19413E106DFFA8A22FD7A243228DBFA436544D17FE8078D93AD9431B7DCE4E115922781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769014454, "uuid": "9e483c8f-e46b-4e8a-9330-9421a30111d5", "value": "768:PlIUbfix5uB+nziFBWxpGhcFnBcoqN4pxGryCfDBsqb8QofmwCC/PWI7SZ7nbcuE:PlPbfV+nziXg1RvcBfWI8XmwC2O9Znop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769014454, "uuid": "56fe4faa-52a5-4a09-bdae-b0c3449e1af0", "value": 42944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769014454, "uuid": "7cf895ac-095a-4553-9859-131d06684853", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769014454, "uuid": "8f178784-0a8c-4367-adef-fd9b73ee709f", "value": "x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0176d437-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034721, "uuid": "66540aa3-ed1d-4ac5-a2e9-3b65c932f86c", "comment": "Malware payload (Mirai)", "value": "11bbc3116635fc4ce3bd2106f85a58f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034721, "uuid": "1db5c78c-3d11-4942-bdee-dca97825cc0d", "comment": "Malware payload (Mirai)", "value": "60c79549a63ed8d2dd76a5b21ad62c1126bcaaf72336ea36a777d9cd653b2d8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034721, "uuid": "f2d585e8-3275-4aff-8ea5-f6051d8fe8b6", "comment": "Malware payload (Mirai)", "value": "4e6b903d9d0961022e16097f77f478cadf2cf241", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034721, "uuid": "69ae96cc-eb0a-438b-8ebd-72d4621c3f62", "comment": "Malware payload (Mirai)", "value": "7442632d4ae29e5ad764fe09b3aa9a18eee34f0f724a01e98a12dc381d98e5beb4dd0038a22eb988534f25e1dd81f705", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034721, "uuid": "0ac79cfa-a480-482f-8433-5457a9fb6ba5", "value": "T146E32AC7F900DEFAF80AE33748570905B630BBE115921B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034721, "uuid": "8945c6f7-1b59-4edb-afee-eda75e4a77db", "value": "3072:GmzTDH86Jl78HenJljAX0Gidw+w9EEVvjbiQLZrEyqKY+f:G2TDH86JRHjAX03dC9EMLmyql+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034721, "uuid": "61043910-eb28-4866-9d7b-613d80a61210", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034721, "uuid": "b548b86b-36c1-4f69-8299-83b17c09149f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034721, "uuid": "e1a4dfaf-2642-403c-ac79-46f0d6c9f89f", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1074f64c-f6a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768983636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983636, "uuid": "a1a71bd2-cc71-42e5-90fd-5e22346b3275", "comment": "Malware payload (Mirai)", "value": "629cb0fbe7305f6e6d321984dc482183", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983636, "uuid": "a749be5a-482c-4d9e-b6c3-0cc878d45271", "comment": "Malware payload (Mirai)", "value": "6129a459b1f6c34abfb129177031e315379ff95fb486c5000028979c77d45a93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983636, "uuid": "c5bf3db7-1495-4c65-99e1-bc2cacf3ebcd", "comment": "Malware payload (Mirai)", "value": "ef32ebae340cfaaa52b43c8c6fbc51ec116bb0ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983636, "uuid": "cba6ea24-f592-45be-9eff-dfeea4a828c9", "comment": "Malware payload (Mirai)", "value": "da0d6e113153d479aa5a640e9ba8b5bb6534e8bcb3bb5e6d3db829fec65d1d0b28290959435905fda2b5fdaaa9c7309c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983636, "uuid": "ca5a37bf-5328-4fa3-bc4a-31217f9b55e8", "value": "T18DD2E1E52B5402F9E6586A752ED443A1FF700FCE7604E80F395ED243C65B8B93867EA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983636, "uuid": "371a365a-994c-45f8-9470-24d523c62de0", "value": "768:ZS4pDnsEeV9y3eu269nvGX1pAruKJgGlzDpbuR1JsL:/AVlP69nuP67VJuiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768983636, "uuid": "de7d3626-83c0-47f9-a0c9-71e88b65ca43", "value": 30132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768983636, "uuid": "42604269-bfba-40fd-8bb8-17070c57674b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983636, "uuid": "4a3e7d14-ed5f-489d-9167-0404149600a9", "value": "sdxkzX_UXA229x.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "048066ea-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034727, "uuid": "64d0c9c2-c01a-4022-ad31-65216f4334db", "comment": "Malware payload (Mirai)", "value": "10a2343694110970c732b46d6fdd8834", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034727, "uuid": "bf3ee3a1-0282-4cef-8861-79107e03f14a", "comment": "Malware payload (Mirai)", "value": "625fd5598d8d85faf92a0fba142f6691f181f76812132acb0c2126296a1590a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034727, "uuid": "007946b2-bc45-41c9-877e-ad4c3debccbf", "comment": "Malware payload (Mirai)", "value": "ddcb544cbc05ccecd5abaa2dfe201927c0b93036", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034727, "uuid": "74349fc0-7449-4ce4-bafc-5bdca5e16d71", "comment": "Malware payload (Mirai)", "value": "5453d635dbf43aaf4b0cdd29e58496beaa25b8a6b45dda28b07844d2ea312e78e301eb4506a26cd555e35678422a565c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034727, "uuid": "611a90bf-e477-48c6-816b-eb9652677a00", "value": "T196E30B46F8814B12D5D111BAFE1E528E37131BB8E2DF73029D246F647B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034727, "uuid": "7c21cf56-fdb1-4c4d-b635-3cfa1421d157", "value": "3072:DHea4CTSUjnwJIXMb6kzz5aTHACdYV8P4eL/:zePCTSQ6IXu7zdaM38P4eL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034727, "uuid": "8f99f7dc-e9d1-49e7-9b5c-6267375579ea", "value": 144156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034727, "uuid": "21fa4ad1-b733-43b7-a095-3b5e8fad0288", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034727, "uuid": "f1b3c000-151d-4006-8c8f-9095550d0a1e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c04293a-f69d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768981482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981482, "uuid": "165181d9-6829-4f7c-84a2-5882e46bb29a", "comment": "Malware payload (Mirai)", "value": "0dd5682cf94acb260c7c2e91467b3626", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981482, "uuid": "488ed66d-f350-4ce6-9a44-4ec1f4553bd9", "comment": "Malware payload (Mirai)", "value": "6354bfdc2884b85dafd568b420a88e12fb31f849fa805e374aafedd076a900e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981482, "uuid": "ac9dc90f-0973-4abd-a77a-98883eb63380", "comment": "Malware payload (Mirai)", "value": "5be2ce0df04edb588be486951970bf69c5234f94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981482, "uuid": "a3005f34-3d1c-4a3b-b15b-a75f7d17e609", "comment": "Malware payload (Mirai)", "value": "967e209db5e800a9dc651fe9545c2a1ff5a5e2489cd6163d01ab3e620eb84841bdde077facb7d08df4886e185eab9222", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981482, "uuid": "60200676-4901-48f2-bb31-7dda245206b4", "value": "T1AEE34B05735C0947E1532EF0373F67E193DFD98221E8EA40651FAA8EA272E72154AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981482, "uuid": "c83f5b50-b2fb-42b9-893a-ba13616e59ba", "value": "3072:x4QHiiplQSv00U8gP0RUX+iGfxCm3J4LztgyrTWhS:BllxF3J4Lzuy/WhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981482, "uuid": "d36b4373-0d0b-4b72-ba08-5e04447760e4", "value": 151064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981482, "uuid": "f4bb0438-2a4c-47fd-8c76-fc53256f7d77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981482, "uuid": "97b7fff5-7526-4205-9639-7fb6ff9a03bd", "value": "Orbt.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea51bf54-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768998605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998605, "uuid": "00bf30f8-b1f5-4394-9692-d1be5e2f4a0d", "comment": "Malware payload (Mirai)", "value": "a6ceba7345fec4de07aceef699620235", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998605, "uuid": "fe5df1e8-5a81-4f7b-9fe1-8c418d8c059d", "comment": "Malware payload (Mirai)", "value": "63645c3f42f40fc8309194092414209411ba9b2439c314d961ef186b577be7f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998605, "uuid": "7038d784-0d57-4d74-a4ee-2d2407a736b1", "comment": "Malware payload (Mirai)", "value": "f3c5965d070f520405a35bfcfd324498ceea6a4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998605, "uuid": "3fcf8529-b139-4060-87bd-7e32b31df42b", "comment": "Malware payload (Mirai)", "value": "4fd9e189a9f6f1913fcb2660bbac6146013b4cc3aded40d323e6f9f5aa2f1ccd2ba9ae600b2a5951ab2a5aeea81b96e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998605, "uuid": "49c54021-0222-4cad-8f38-c4c49f551aaf", "value": "T1AD635C42F29290FDC49BC274479FD526FA32BC5953207DAFA795BA311F36E20270A760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998605, "uuid": "504e04bc-91ec-4292-b5c2-76225c4c4f3b", "value": "1536:l+wwwhvQTYYIVbL5PDzorCD/TOzwc5or:sPwyIVxvoBzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998605, "uuid": "3c037786-5987-46f8-954f-fda509333086", "value": 67488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998605, "uuid": "b46c68a5-b7ee-4fc2-b36e-904f264985d5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998605, "uuid": "1dd78852-36ad-4bb0-a476-1691b486f46e", "value": "life5.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94e33a3-f6df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769010226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010226, "uuid": "a21d35b1-fec4-4bdd-9618-4809b0dbcedd", "comment": "Malware payload (Mirai)", "value": "7bace175cec3ec2a6f5ae4c5240639f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010226, "uuid": "b3a71654-cf75-4f5b-a758-8408bcbb4602", "comment": "Malware payload (Mirai)", "value": "639abfbb17bddde7cc73ee0022fee26bbd567efd8f7af924321d42eacd1b564e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010226, "uuid": "f39f2a4c-f1c8-43d2-bcd3-964f4eb11de1", "comment": "Malware payload (Mirai)", "value": "b588f1eb410460fb3b32533fc252a275da62987d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010226, "uuid": "fdf57826-1e3a-48dd-acfe-ba3913710efe", "comment": "Malware payload (Mirai)", "value": "b5444a8b79510e2e05ce15c5dd0ea27ddbe8b623d252d7635c6c5d18df42b05af10923053868d9510c6051dbfd9cf940", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010226, "uuid": "2db77232-e27c-4ccd-a70a-dd8ea31d2e9b", "value": "T14AE329C7F800DEFAF80AE33748570905B630BBE115921B372257797BED3A1991963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010226, "uuid": "392f4f81-b88f-4682-9f6b-5ec19ce85034", "value": "3072:KmzTDH86Jn78rCdV5jAti2id2ow9+aVvjbitLLxGyMYE6j:K2TDH86J5fjAtiHde9+3L4yMP6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769010226, "uuid": "1f33a997-ef1c-4ff8-b9f7-724283e2a6a4", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769010226, "uuid": "db2d8c2d-74b5-4172-b780-7a06fdde08fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010226, "uuid": "577a5478-e1e0-4ab2-8d74-7a5ae7a048de", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f760f180-f718-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034705, "uuid": "03e6a4f2-a7d1-4b20-82a6-84d1a7fa21e7", "comment": "Malware payload (Mirai)", "value": "6825172c4ba7e6b222b381b187e5c1fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034705, "uuid": "538e4dd2-22d4-4662-9ecc-eb9de26a3438", "comment": "Malware payload (Mirai)", "value": "63c0cbc17330f181579ab05b20ee4062f7a31d05d84dbf47f31c807f284bb21f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034705, "uuid": "d612289c-949c-4c5a-9974-b3165fe3a276", "comment": "Malware payload (Mirai)", "value": "3d99d227e74486421251131165adb047e13be096", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034705, "uuid": "14a53b72-5205-440c-846b-96c39cc6da76", "comment": "Malware payload (Mirai)", "value": "f54758ef50cb6866f3732e0b02e14eaea37ccfa95c2f7487cc206601f4d385287295731cbcf89c1cc9301778cc354dcb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034705, "uuid": "a9e4c105-e1a0-4d37-a12f-64bc08a50740", "value": "T193335B0272280A07E4675EB0353F17E093BFF99021E4F688680FDB5A8676E375586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034705, "uuid": "43d1f1c1-4815-43f9-9fa8-fa232e565077", "value": "768:p+iT0OhqRF/3pa1aILUjiUKLOvJOh9OpTy+cmmrH:LTDABaMIYj/KLOvcIpTy+3mD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034705, "uuid": "18f9fc50-f2a0-4e72-a56a-c0fb04868b5e", "value": 51048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034705, "uuid": "39fd6fe9-a51f-4035-968c-c743c228f37f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034705, "uuid": "f57e46f7-1756-4246-8cbf-25de788ed462", "value": "StormStresser.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f923fc-f701-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769024664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769024664, "uuid": "797166e4-a0cb-4e42-9c8f-2210de9a4a68", "comment": "Malware payload", "value": "79b90a01424e3174d9d6f703fceff9c2", "object_relation": "md5", "Tag": [ { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769024664, "uuid": "ea0102ae-8136-4db0-96c3-91358ddf6fbb", "comment": "Malware payload", "value": "63f2c3f18220c0b71fe777fab66a06f95f2ec5f0b6c539e69149901a64f41f71", "object_relation": "sha256", "Tag": [ { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769024664, "uuid": "c283cf0a-c6d1-4795-a5d1-edc9726d74fc", "comment": "Malware payload", "value": "c33885e331338b796597b1ea5ee078d55de17771", "object_relation": "sha1", "Tag": [ { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769024664, "uuid": "9b4fd7fa-46f3-4cd9-a890-65ad423b56eb", "comment": "Malware payload", "value": "3d033ed2b099816ff4eeebabfc6d53bcd3985a3815073df6f8613ce811781cca20d8d2af8fed62d25b5efa73f11a881e", "object_relation": "sha3-384", "Tag": [ { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769024664, "uuid": "a0f20ed3-dc09-429b-9c5e-41b36efcd3b5", "value": "T1FF573326728BC532D62E017BE924FE1D1879BE73073121EBF7E47D6A94B48C1A274643", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769024664, "uuid": "652026b1-5361-4dd5-bd4e-4107d4a9a0ca", "value": "786432:VZgJ3w3LsdFs5gz3hKMbKb7BAaFvKrb7:ViJAAdF/KN9nK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769024664, "uuid": "8c373361-6798-403d-a5f1-da4e2015b830", "value": 28286976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769024664, "uuid": "b930f90f-e0aa-4033-b027-4ed09352c748", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769024664, "uuid": "c7c61c33-74a0-42ab-9aec-f393f13f06b7", "value": "google12.3-3201.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb824a18-f6df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769010230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010230, "uuid": "0048c837-566c-44b7-9e4a-61cd43aa8d90", "comment": "Malware payload (Mirai)", "value": "055c019c51dba9cfdfb7c65041ec6223", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010230, "uuid": "ff310cd2-ef41-481e-a314-14e668b6f9b3", "comment": "Malware payload (Mirai)", "value": "646d0d5079fb5a2347ccfd2496205df33a700d68f0b4ac9aec1932f810ba4838", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010230, "uuid": "09a2eaf3-a5be-4881-b54c-b54d8c019812", "comment": "Malware payload (Mirai)", "value": "ebddcd0c4af147ea80d58502e17a62395eef7c9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010230, "uuid": "1fc7a6b3-8a14-42bf-ad58-24bd8e322573", "comment": "Malware payload (Mirai)", "value": "dcc85edb6605f869e3f41b40cd11b9106282330834cc112cd0ce27cb597a995415aa815f504b1dac5fab9fc6db1bcd26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010230, "uuid": "7c90c222-599c-4515-984e-745d3604a841", "value": "T159D35C17B5C180FDC4DAC1744F9BF53AED32B1A91238B26B27D4AF222E49E205F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010230, "uuid": "8b1f6aab-8a52-4519-8a2d-8ff3859bf1db", "value": "3072:79eSuygEPjt6qkWqVdKmDnYMb0gBd/gQyVGsdqml6naj:79eSuygEPjt6qkWqGeH2lana", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769010230, "uuid": "cddb1624-28ed-496a-9ca3-3595f7bacaa2", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769010230, "uuid": "6296d870-18e7-4682-bca6-6124b83e316b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010230, "uuid": "763e6c96-930f-4721-98e4-65c17f9ed8aa", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e86bd4-f6ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769000911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769000911, "uuid": "26c839da-fd25-4679-a9d1-527e2a60a7dc", "comment": "Malware payload (Vidar)", "value": "751b8e25f55fde88d10fe8e7332553ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769000911, "uuid": "1996bdec-8225-45ec-842c-f87ca7e56628", "comment": "Malware payload (Vidar)", "value": "65a6b4f54de82d5d4b58222cc02143e4b58febe8cbb267dde4399c767f6698ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769000911, "uuid": "3d9b2b5c-e99f-4b83-95bb-9954fe486715", "comment": "Malware payload (Vidar)", "value": "17ff7c2f30b4f708f9481e7ba41390f91b475b29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769000911, "uuid": "10160a4a-241b-409c-a9a3-491e747473aa", "comment": "Malware payload (Vidar)", "value": "ef571eae0106e6d422a771666e00c101025ab462e489c7588ee233307f7cda63ee44d6db252879b1ba9fa173fe644288", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769000911, "uuid": "261f5fa9-594b-4f85-afa5-9037ad3e4548", "value": "T1FEC54A126D9488B5C4AAC2358D7A72917B327C050F3163C72A53B6791FF6BD0893BBD8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769000911, "uuid": "6db2423d-eed0-4805-b778-b88822b4f50b", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769000911, "uuid": "0568a0e6-f0fa-4e70-8684-875d6002f718", "value": "49152:zGJqlMIVUoQ2S1XRWnhcd2w+qkb1UykdCeH:zhNgZ+tb1fkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769000911, "uuid": "cedd0d48-cb9a-44d3-82ac-130161d20941", "value": 2634456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769000911, "uuid": "1c29459f-b112-4268-82d0-818dc0a9c734", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769000911, "uuid": "086e7b10-d380-41e5-bae0-e1dd12e7f231", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26538820-f65c-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1768953608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768953608, "uuid": "df169c95-cd7f-45f3-91e1-98687b76ed06", "comment": "Malware payload (RemcosRAT)", "value": "45f0dd13eee160bf78be95b3f145cddb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768953608, "uuid": "db739b61-1a03-431f-8e7f-1236bc77fc95", "comment": "Malware payload (RemcosRAT)", "value": "65edff5a98c4b7b0619c4db2e1724b2edd8ac22b3f244bcf08fc612fc9fc68e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768953608, "uuid": "9307435c-1e9f-4b9c-9fb6-fcbcf8cc79f4", "comment": "Malware payload (RemcosRAT)", "value": "b37429485424e54118f73cf953ecb670aa24fdb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768953608, "uuid": "372633f0-264d-49c4-bec8-7d98fbe0086f", "comment": "Malware payload (RemcosRAT)", "value": "a554e0ed752e9cbf1dae1687c2cb0a9226df3e1b627fadc3a3c3eafbdae1d5fdb73f02596e4c09dd625ecf7fd3c0060e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768953608, "uuid": "496271dc-d26f-49b5-8bb5-cf15b72dd9a3", "value": "T1A9252312A3D0E499D1119B781C2A16BF6AF5ED305CFCBE5A0318BE2C1D67196B74F2C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768953608, "uuid": "95f55df3-4ca1-4366-a2b7-20e96138cbf1", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768953608, "uuid": "a1fd6028-acc0-4ff6-ab2f-e2d4dc12465d", "value": "24576:5+kzuBVFaSsVKfhNZax/He6J2jesYl/XEvUmHYop61+f9:4A4FHsVSOtHp2CsYlhmHfpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768953608, "uuid": "ca0c1e2c-a32d-495d-a950-13d3a5f95293", "value": 979632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768953608, "uuid": "b0a069a9-1b95-4a75-872e-a798d84abc88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768953608, "uuid": "02190856-f165-415d-a0fd-df2c2d031bb1", "value": "rREQUISITIONFORSPAREPARTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea5eb3a-f6a3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768984197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984197, "uuid": "92a341fe-b158-45d8-aa00-f5ab77dbf67a", "comment": "Malware payload (Mirai)", "value": "6899f8308a70354b7d103057310754f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984197, "uuid": "cb904d50-c2db-42f5-a849-0803e8885149", "comment": "Malware payload (Mirai)", "value": "666eff9f1b770cc76921b02ea2768b851646f6a73f44b9c621b8fdc328fd8f19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984197, "uuid": "ddfcdb10-6163-4102-a558-6effcd241dd9", "comment": "Malware payload (Mirai)", "value": "4f7e7aca27f94a0218a7daa247aebdf54cbce93d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984197, "uuid": "8ebc6ba5-e1e0-41b0-b401-e9271d709227", "comment": "Malware payload (Mirai)", "value": "9b4ec4ee4e2723ed5f7de7e56e8fac237c63e374db49f1f028bb99f8823e5b0761e75019f9a540c1878e08fd6440c8ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984197, "uuid": "d091ca91-de5f-4b18-8366-c8229716ca99", "value": "T115C2E020E7A64A21D9B1803E5BBC84E3F2D21C2991F07B37520F0BE845D39A46D78793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984197, "uuid": "0e2bbfc7-1f8e-4094-ab70-69ed99f8a4de", "value": "768:FsawaQRAPXhr9lc+44JZUabl22Vo87s3Uozus:yawaQRAPB94fzus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768984197, "uuid": "3a731b02-5773-4f5f-b251-b737a6e44406", "value": 27764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768984197, "uuid": "06d6d40c-06da-4e0d-8c5c-f572aa3ca788", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984197, "uuid": "1e1fd686-b433-410f-b424-9df1acbe218f", "value": "sdxkzX_UXA229x.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2f3364-f6a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768983253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983253, "uuid": "d6424c58-d36e-47da-89a0-3be79fd90a4d", "comment": "Malware payload (Mirai)", "value": "a99d4d4a2dc6e848bfd60dc02011875f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983253, "uuid": "d6cd30e9-37dc-4adb-84e3-8a7bbb2f7832", "comment": "Malware payload (Mirai)", "value": "67b075be08b2361046d6249947442ce70a6dc552698a995c1ad8ad21cdabf1e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983253, "uuid": "726f5653-8c87-45c8-83d3-fa1587918016", "comment": "Malware payload (Mirai)", "value": "135d1dd412454ab67f4c2eb667fe5f2e924cb587", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983253, "uuid": "109833b5-5915-4a71-a82b-420c5ad1fe9a", "comment": "Malware payload (Mirai)", "value": "2355a904a2e55c8cc82684ec7915d51e98cb2f6f3650224659480ceef2357f2084af693ac07abe819292c084f18748c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983253, "uuid": "1e61ca39-b586-4346-af8c-838082f3b61c", "value": "T1956302B873EB8434E0DDF5322A4F21307371D766A42B53DE3D85B5E8F2635640857AA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983253, "uuid": "d2869df0-eda5-441f-bfdc-b6a1c1adc1eb", "value": "1536:rltrI7mDmde7Lletk8cghgLFPjihgulh6DoIktuQrPn:rl+YmdkLMk8c5PdulIktuQrPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768983253, "uuid": "af6caa64-a1e4-4a0b-8ca3-7983fb9e7a49", "value": 70848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768983253, "uuid": "5dece6fb-0b89-4ab6-9737-0dc587a7ab19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983253, "uuid": "b9498a96-569d-48c3-aaf7-af830c669e36", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007cbca4-f6c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768998642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998642, "uuid": "0bc84cc6-e76f-4550-8a55-ea8a71a094ff", "comment": "Malware payload (Mirai)", "value": "1fbecbe89d8c77801c969986d61de8ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998642, "uuid": "84e1ad2b-421a-4820-ba44-eb03609a8961", "comment": "Malware payload (Mirai)", "value": "69e58f49bccbb4e3c0d211f01d1c1e8d579a08c95132001c45271f64b5c36239", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998642, "uuid": "10ff8859-dd5d-4208-8a46-f5aa5dfe0c62", "comment": "Malware payload (Mirai)", "value": "2fd2cd386254ccc735cf6a5ad6404389fcd14752", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998642, "uuid": "0ae8f6c2-40d5-43e4-919a-987ba6e7c132", "comment": "Malware payload (Mirai)", "value": "5b884dc2499bda2caa82502fb3b7addf86687208d47d7d9074059555105c6d8adb2d626a74546742bfd459e6133b42d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998642, "uuid": "bd83d052-74be-4f53-b636-bf0da1c7d127", "value": "T1E0535B42B59180FDC49BC270479FD67ABA33BC5973207ABB2791BB752E35E201B0A750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998642, "uuid": "3d6f56b1-ac83-4c61-8b3d-6298db548285", "value": "1536:f6vTgpx7Z7Zj7DRHsGBFWblPzcB/ULaeorfu:ivTgzrRHxBiLLyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998642, "uuid": "0b167600-28ee-4517-907e-c87215b40e38", "value": 64072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998642, "uuid": "9250f3d2-7e0d-4b5b-9de3-73073c631982", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998642, "uuid": "24c89f95-96cf-4a95-b309-06601ad16de2", "value": "titan.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3cce37-f6ad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768988357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988357, "uuid": "1e9d6281-b130-477d-ac0b-509e55d86a82", "comment": "Malware payload (Mirai)", "value": "ceb8ff8cb6fecd1b5220c864921ec408", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988357, "uuid": "4686f87a-c351-451a-9da7-e4ca01e76110", "comment": "Malware payload (Mirai)", "value": "6aa82509279a64cb77127c77011ed7a8a7ceeaa4aa4f32923948c4c9f95a9927", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988357, "uuid": "7861c7da-b34f-4864-92e2-f68b984bbdc1", "comment": "Malware payload (Mirai)", "value": "2b58acca087ea0b466834d5b8b1c9754c0258ac5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988357, "uuid": "f3d4d73d-2955-493f-af66-9b4e46a04817", "comment": "Malware payload (Mirai)", "value": "e6a80c4d21703c2db982fd3e3bca7feb3820c51101ad24be86bdf4016a8d343fe5de7d2a1d7b93606ff2382b7a9af594", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988357, "uuid": "3ab6dd86-6ab0-45e1-8a94-690289c20646", "value": "T11FA3B50AAF611EF7E86FCD3745E91B0535CC591A22B87B367934D828F64B24B09E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988357, "uuid": "c3edc7c4-4cc4-4dcd-8301-6b393c364191", "value": "1536:zXXBHq5mFUz9jh8icWvVrmYsv8x9CBbdSub8oT6ZEafhe5MPKMj9RLZwbZnK:znBHq5mojpdv9lUMub8a6A51KlwbZnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768988357, "uuid": "e0ba4819-41af-4469-aaf5-f0ba2f5c7c06", "value": 105628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768988357, "uuid": "ce60cac0-cb58-44cf-9401-202cb267f822", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988357, "uuid": "468bc91f-9c2d-4d20-b519-5d483254ac4e", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31659be6-f6d7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769006455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006455, "uuid": "7d978e5d-1388-4b90-b03d-c98cb05d1588", "comment": "Malware payload (Mirai)", "value": "10c8d3b8208e09b9946bdb298860d760", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006455, "uuid": "46b10d9f-ce43-461a-b125-154bca92c076", "comment": "Malware payload (Mirai)", "value": "6b682d741ec1658de879cffed1d4c59a7dae0070e2d19779325f44193fd95cee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006455, "uuid": "4155256d-cdd0-43b2-9bff-d53e484a282f", "comment": "Malware payload (Mirai)", "value": "f7f0e44ee72ce3249f28b856369df0ffae13b2b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006455, "uuid": "28651667-b622-4b8d-b6ab-463711a00ab5", "comment": "Malware payload (Mirai)", "value": "bea4db2f0ee92be78a766d650b99e177443a931289c795c3311479e4b5cc86e687665cf0dda8d994ed0c49d8c9f2fa37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006455, "uuid": "d1e3e8e2-9f80-4546-9b05-b342e61fe83e", "value": "T1FB43E891F9824667C1D023BAB75E5A8D33A163E4D2CF7657C8204B207B8A94F4D77F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006455, "uuid": "6a3cc532-7389-4e0c-8abd-58072c0f4f5c", "value": "768:rvrFVegVE/XxlQv3Z05MABWjt6hIAUeN0+8dSIheiQxbwdcJ3BdrUAho/rw9Q:Ntq/Xxq3v6htUeN0+85eiHdcJrdBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769006455, "uuid": "fbf44de7-7b30-4ed0-be81-e5455bca674f", "value": 56096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769006455, "uuid": "90a70d65-3817-455f-9d23-31b7a61e3a4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006455, "uuid": "b7e3a964-0d29-4c8c-8b5e-0bdf01675a50", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a911fdf2-f6a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768986469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986469, "uuid": "862efedf-39b4-4db9-80ee-5d9633c41883", "comment": "Malware payload (Formbook)", "value": "b26bc87dc07222dff80c81e595dc69ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986469, "uuid": "2c31786c-f6cf-40d8-840a-38bb662c3985", "comment": "Malware payload (Formbook)", "value": "6b76f76b9ed250c6fa30cd2bb8228329829c4fac161dcd1058b7a640bffd2601", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986469, "uuid": "15b78eac-78b4-48bd-aa5e-7dfab3ceadc5", "comment": "Malware payload (Formbook)", "value": "e8968df90ac1b191cb35092b2fd97cc3c7e76766", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986469, "uuid": "f3856b25-b058-4f9b-8948-e4aa22f69093", "comment": "Malware payload (Formbook)", "value": "b9c89f6b77250128dc9b3ff4c32c5ebf74c322dc6ddce48b31495a171033abc54fdb355149799b028432854ae311001d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986469, "uuid": "7144d2e0-e108-4bea-9545-5ecac50e3d8a", "value": "T1BC2512446B98CF12D4D15FF006A1E3B62374AEEBF811D20A8EEE6CEB3464F516954393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986469, "uuid": "0226c811-fe15-4169-9641-af45520046fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986469, "uuid": "cbd676b9-5f3e-4235-b227-c8107b6f3a43", "value": "24576:KItdg9gFSYkgBNUIPXlLYqgdrJTG6sId9V5:nt2Sx1BP1LYvl66z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768986469, "uuid": "ea94fa2f-86cb-49f4-a1a5-ed835daad5a5", "value": 972288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768986469, "uuid": "93259fdd-0415-4099-8fda-0adc01e23635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986469, "uuid": "e894ac5c-c603-4bb0-854b-42e60606741b", "value": "PO--0130356-501 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc789d4-f6a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768985535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985535, "uuid": "3c123ca5-5fea-471e-b487-d65d05fc832d", "comment": "Malware payload (Mirai)", "value": "2e2167e2e65a231206c4cc6cb03b4054", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985535, "uuid": "1733a270-d6c9-4ee8-8c31-42d895a26fac", "comment": "Malware payload (Mirai)", "value": "6c1eb958d98d7ed84163cb9ebbd01f6951d1a08cab6447c803e3774d0ce15f29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985535, "uuid": "a1625ddd-90bc-4d2b-8d8d-7744da2d22d3", "comment": "Malware payload (Mirai)", "value": "a75ead89f680ff8136dcc4151e6a2a5d604efc0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985535, "uuid": "13cb177f-6ce1-42bb-8234-d6e3126d7e30", "comment": "Malware payload (Mirai)", "value": "bc40e167ee8557767a4f07f6ef6b01b7667903429940ee224abb2aa6b913a2851d9d749e04917e6b4502755cc614c6dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985535, "uuid": "0e95049b-54c7-4add-8c29-a5df09ca1a66", "value": "T10BB39DEFF34B1591C8628BF017C39BDE2E2722129F6BC5E72C0E567A18751DB490A391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985535, "uuid": "a457237c-7141-4f30-b03f-8ec6554cfede", "value": "1536:LrOwWcUx+LQT/XVMqk2Cxa23WXfOIieRdgR/LW+:uwWx+szlMBxas2OIisdgRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768985535, "uuid": "0d15f091-ba34-4279-b59c-4119a0766b88", "value": 107840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768985535, "uuid": "b549c8a2-87cc-4ef4-a912-6f90e66a8d41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985535, "uuid": "ac7a77aa-b8e1-444d-a927-4a960686f558", "value": "ub8ehJSePAfc9FYqZIT6.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba9ff52-f69d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768981615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981615, "uuid": "28413a85-6424-4fc6-ad4e-35cca10ab461", "comment": "Malware payload (Mirai)", "value": "562ad56ec8ca8d42dc5c06df3d009b69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981615, "uuid": "ce1d1708-5381-4e5f-8fa7-650bc31893df", "comment": "Malware payload (Mirai)", "value": "6c234a6ca2df5c5d27224ec46cae63b1c26f26342061cd14b353280262bc69ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981615, "uuid": "41d8ea1d-dfdd-4af9-bfec-dbbecedf9b70", "comment": "Malware payload (Mirai)", "value": "f0c8cf6619f6d8f28c553d91cff5b8f4d456049e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981615, "uuid": "6cee4654-4b24-49b7-8260-84ba8d1fae5d", "comment": "Malware payload (Mirai)", "value": "44ec8b98acde1c8f920ca4c7ceb1c4cd5986a3433a5b4c595b97814639101e221b0b05ff8a9f28266221a7608b3451db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981615, "uuid": "74c6cb1e-338d-440d-a859-cfbd0279688d", "value": "T150B39E8BBB471890C86547F50BDB4BDD3A5372118E67E8F76C0E393A99391DB090A3D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981615, "uuid": "812eddf2-77ba-4a72-b896-75075bf1eeae", "value": "1536:pMuF9KgBJ1zJW7lRmzTwo5ji9FRrD51uxWXiSgGGwbZnh/LWh:pMuF9KglzJeHmT556fD5bgbwbZnhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981615, "uuid": "3f30fed4-13ce-4fa8-9af1-b32334e0a784", "value": 116000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981615, "uuid": "8dedc328-9a1c-4f85-8d5c-c4b07383c29e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981615, "uuid": "4f04fe7c-53e8-42b4-8cb7-bc697b801c04", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63981864-f6c2-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768997520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997520, "uuid": "7bd5ba60-05b6-4d69-91e2-9fc9bf1601e9", "comment": "Malware payload (Gafgyt)", "value": "23edc0fbd75b0ebfa384b1bc6097fe41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997520, "uuid": "ddb4e811-e3c2-4b1b-b3d4-7c3db9d8421b", "comment": "Malware payload (Gafgyt)", "value": "6c3da2dfa68f5ef38d0a76ef56686e1571e405fd34413c1ec3be57d30a97e37e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997520, "uuid": "aa813c42-ed32-4bb9-aaf3-ff40e6a197f1", "comment": "Malware payload (Gafgyt)", "value": "0db9da25c611964d6a401738fc2db2934bcbab70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997520, "uuid": "4e113127-3456-459f-8224-08f3eff50bcf", "comment": "Malware payload (Gafgyt)", "value": "9582230ffffae3b5e56bc9cf776aea6406092fd60509e52042be621f41f92d1c0be819404f73726e6758673cf5161245", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997520, "uuid": "3392edf1-e9a5-4a7f-994b-4c74a9b41d1e", "value": "T138F3721E6E619F7CF7A8C73447B78B24D24D67E226E1C581E1ACD1066E2038E681FF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997520, "uuid": "9db03ea7-3314-4f6a-b311-44fb13e46aea", "value": "1536:eJNdqrjbBt608BfBygGpPeU+/0/qJ/wYtjW4TgfMtuRVYQ35LcaK7EWti1FjdwYJ:udqrjbn60g1a5iaK7/kFzbylSlHh+ns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768997520, "uuid": "665e7d77-4a58-40af-8a57-a4ddc40c9f00", "value": 160904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768997520, "uuid": "3c96ed14-eb37-4ef0-9cbd-07edc125e402", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997520, "uuid": "4b482706-9a01-4040-9a1a-1c482becf94d", "value": "goon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a90c87-f69b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980882, "uuid": "a5fa7a00-8e99-43a6-ae10-82f3e6299b4e", "comment": "Malware payload (Mirai)", "value": "70ab52406aed5be6e812abed824604a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980882, "uuid": "62bae9ad-449d-4a90-99ae-57a963e85de0", "comment": "Malware payload (Mirai)", "value": "6d06cbea592b4d6fa0371b3149468e705df9cd1b9f55addaab84747942343062", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980882, "uuid": "f808c653-0474-41c9-adc2-d2010fcbb8e9", "comment": "Malware payload (Mirai)", "value": "83032802cf84f429bd294bee575929107fa54d6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980882, "uuid": "27b231de-19d8-4b7b-820b-ca113b76117b", "comment": "Malware payload (Mirai)", "value": "cbe3fd7db09ea05d499f2d188ed3df12d6a05667d0160757776c30282451d30d5fa5a518f84c0055e983af35df4b1ae2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980882, "uuid": "9f572067-a2c6-44e5-896f-c1fe564133ab", "value": "T14C230121D21D51D5EFE7FCB96C48D982FB765BB6D62388D1A0F1DF428C22281A7987C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980882, "uuid": "be4cd6b8-e57b-4459-95ff-74c1e6082a5b", "value": "768:uCQ+w92A3MqqEMrX8U6LrocYKR7QSbXOPOcCney79ar0kr4uVcqgw0912:u/f92AcqqEuX8ZocWSb+POcCnD7940kH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980882, "uuid": "67e4de6c-1f70-49bf-8fd9-3c287eca04df", "value": 48116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980882, "uuid": "6bfa1c6b-be4b-4a04-889b-37a5e36d176c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980882, "uuid": "5556f2e9-5868-4414-9b5d-f14160cca16f", "value": "ub8ehJSePAfc9FYqZIT6.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb689df8-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768998634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998634, "uuid": "a07c5cea-87a6-41cf-abea-7056a94b31ca", "comment": "Malware payload (Mirai)", "value": "cc5a49eda8766524cd99a77e2c4bd417", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998634, "uuid": "85de9127-2a70-4a23-be12-0e8e29d8f6b6", "comment": "Malware payload (Mirai)", "value": "6f09d223b91c32242f5c88ead2d20860870176adcfc1939263135620dfc5049d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998634, "uuid": "8d8aab65-e53f-452d-bf9d-096f88e77cf8", "comment": "Malware payload (Mirai)", "value": "f4d7850bae8ae7d940b1477a83798623d09025f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998634, "uuid": "e66fd5fa-9572-4bb1-9e1a-a0b21ada5b6c", "comment": "Malware payload (Mirai)", "value": "df414dfd5d09ca57aa9dc877fddeef2bf7c8eb45cc91182e9a43f59810c2d463df0bba4537fd203e277fb6f4c9f59b04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998634, "uuid": "74458c7c-0384-439b-94d9-342eb85cf62b", "value": "T1D7731854F880DE71C6D1697AFA5E528833630B78C3DA32068D15AB3527F786B4F3A906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998634, "uuid": "0b860532-1eb3-4879-b148-48be9f495dc4", "value": "1536:xZI8AJTIOKMRbhs6Cz4CGnKKGrZKx/7+zluOpd+FFVjSzDqR9Gv1kl8X8TprCbRw:xZI/JTIOzRb/C7j1KIdpcAzDA09bbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998634, "uuid": "fe92e06b-ce61-4d96-b79c-853fc7bab6f8", "value": 75176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998634, "uuid": "4ee8ea9c-d51f-4658-be2b-9d48e86c2959", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998634, "uuid": "feaeb029-6515-4062-a053-1cb63710cbaa", "value": "kk.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a064889-f69a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980404, "uuid": "0d35e45a-0d62-46c8-935d-fb9e8eade028", "comment": "Malware payload (Mirai)", "value": "fd90890f808539f1afa4461d956a652f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980404, "uuid": "788412c4-22b6-4fe5-9801-bc9386f87e3e", "comment": "Malware payload (Mirai)", "value": "70274d5c4fb81f75f3b7aff57483e0126b79b51256227ea6fc1c0f8555406b2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980404, "uuid": "c8ea1fcd-b5ea-4496-91cb-4fa74977ec89", "comment": "Malware payload (Mirai)", "value": "f0770107037af3c62c3f83c24893361c3dde55ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980404, "uuid": "6b4c50f6-d3a1-4e42-81a2-e8e1cc8c3759", "comment": "Malware payload (Mirai)", "value": "9df357406331b193c5eb6ac0142050f7d09f6026f88f9a503680c24106c51229e474c47c8d07786730113b3990c40513", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980404, "uuid": "92dc72cf-3414-445a-b5ba-b3516d18eea9", "value": "T12D7302911FDF6EE60F7108B576F8839431A88B2DF1F8254F811B8A789A82457FB784C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980404, "uuid": "7c7d2db1-df68-4cee-8891-9ec46f3e1bcb", "value": "1536:jWpn2oUk6eoOWisb6IUFS6Znn9ubL+TSEL4JAHmuZZdiftyrCB:iUoUZXmBFSIn4b6jL4mHmuZniYrCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980404, "uuid": "218336e0-6a52-4376-9eb8-ddcc66c353d2", "value": 80244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980404, "uuid": "aec9990f-1466-40c5-99f9-7613dc3f209d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980404, "uuid": "35ca88a7-1630-4a25-bb7e-2f123efe7503", "value": "Orbt.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d73a12-f6a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768985543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985543, "uuid": "506df732-4c03-4a7b-81d0-4bbc13c91e4f", "comment": "Malware payload (Mirai)", "value": "501af9e284c3a94757185234fc084355", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985543, "uuid": "b1418266-77f7-4efe-9e61-5e1c7858f0e5", "comment": "Malware payload (Mirai)", "value": "702c5ff22698a3df5ba6e08e8325fb311726df2408e85e9bfbf07058a23fcfb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985543, "uuid": "8b8ddfcc-2f9d-4338-93f7-513a786fb55c", "comment": "Malware payload (Mirai)", "value": "37ef48d82cd4aabc2929e8193423334fada4529a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985543, "uuid": "8b44dda6-40fa-47c6-840f-6d8ea111f97c", "comment": "Malware payload (Mirai)", "value": "32db44db94abf0f92a9b87dce576ba4769dcbbcbc67d5cac5f254e969823be61799472166f8afdcdcf599f8be2e9ca49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985543, "uuid": "c3e1159e-2634-4423-b736-57f3e0738b21", "value": "T1D6E318C7F800DEFDF80AE37648634909B630B79255921A377317796BEC3A0E44967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985543, "uuid": "71d53e91-fe76-483e-a679-35e2867c030e", "value": "3072:h5qZ2S1p+yeLg1UAcbFqoVZjbiNL2BXOdL10yQMLh0avs:mZ2S1wg1UFFqTLQyJ0yQq0Ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768985543, "uuid": "6a62afad-cc85-43a1-a178-57e1286ce7ba", "value": 150368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768985543, "uuid": "70e37885-dae0-44cc-87f3-425e2b3eeea1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985543, "uuid": "4bdbefc2-3dc7-4a7b-9640-763760d4cc6e", "value": "ub8ehJSePAfc9FYqZIT6.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b555b0e-f6a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768983252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983252, "uuid": "d4590505-bd02-4bad-b8e8-611aa9e92afc", "comment": "Malware payload (Mirai)", "value": "b99daa86b62bacbcdbc9ed74c9bbcf3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983252, "uuid": "2d777109-6b16-43ae-8472-d9a099014a98", "comment": "Malware payload (Mirai)", "value": "705c0ce07b404654a1d06fe7a49cb32b28bc32a975260dd9bfc0e70550b12822", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983252, "uuid": "22079bb6-d606-4475-827b-66a670f58188", "comment": "Malware payload (Mirai)", "value": "5cb34e6ff186855e037d7c36a7dabf032115a5d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983252, "uuid": "efe3ed02-3fb5-4ba5-8dc0-a0d552e08d21", "comment": "Malware payload (Mirai)", "value": "4a5944fbad2620fa27bf2771ae2975acf4f6d5ef83ea83f34ff93b20da3221a20a29d118e4a88e2c65e507c696989db8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983252, "uuid": "c59040fa-0546-4536-a42e-077305e726a2", "value": "T1E333021BE12A629CDDB680BE57BE8B6008804F79B0807E8EE57AF187A3F454535D1DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983252, "uuid": "64777277-0c95-459e-94ff-d067fe8cf284", "value": "768:de+q0G33ObW9pCFkZ6xVJ1IefO/kjRkyeiPkz5NRn4OEagIC6JgGlzDpbuR1JT:dVGHOq9MukVjICmiRlepNP4kg+VJuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768983252, "uuid": "08c239bf-34d9-4f1e-83c9-aff21e6742ef", "value": 52888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768983252, "uuid": "8f493176-0e03-4b11-a87c-a8a2ba721ce6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983252, "uuid": "9c070931-6045-4d79-ad5d-2800f8adfe09", "value": "ub8ehJSePAfc9FYqZIT6.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5d93f4-f6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768985192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985192, "uuid": "61178465-9bf9-44f1-8e4f-56de2373c675", "comment": "Malware payload (Mirai)", "value": "83a6c6750ce7a421d03141470064416a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985192, "uuid": "068f5970-a8af-4710-b172-8671dce4f2ef", "comment": "Malware payload (Mirai)", "value": "706e5623ac6d55611448042429c11aa8b09105611a1850bee96076d97d308c32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985192, "uuid": "e897c585-26d2-4ff1-8e81-f7073fe2e73c", "comment": "Malware payload (Mirai)", "value": "c762299e6a8c963852856e5297eab42f145a65f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985192, "uuid": "74b77cb0-600d-4ff1-a83f-bc632f86ddb3", "comment": "Malware payload (Mirai)", "value": "c468c772954d0ec7862be7086d9a5d1ae1947570dd2ee28d08aab30f2eb1cf7c5971304b657bd24924f4787e01e8bf7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985192, "uuid": "38caf8dd-87bc-4564-9790-a9a44272f88e", "value": "T197148D68FE4F68D2D2C7E37DAE4A0FA231277D749565C0B51A00A29FD5EAFD488C0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985192, "uuid": "42b446f6-cac6-45f8-90b0-bfc2441572c5", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPxf:bOVfbEdxm4iubh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768985192, "uuid": "6bee7c99-546e-40e6-af57-27d601ee0d80", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768985192, "uuid": "c50836be-8458-433a-97a4-9adf5fb78a1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985192, "uuid": "8eb87e2b-8de8-4129-909e-a3eeb965d205", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf999df7-f6a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768986105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986105, "uuid": "18efcc11-2177-407d-ab31-a5476c16b5f2", "comment": "Malware payload (Mirai)", "value": "6edbd2e72a4486998781eb9ffe96ae8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986105, "uuid": "e59604ba-7587-466a-8f97-7cf18b0904d9", "comment": "Malware payload (Mirai)", "value": "70af461831dd64f40671be771cea6c363a1f771c9783ffd6c8a87b4283112be9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986105, "uuid": "1e7f9b40-a5ca-4032-8fda-39af24c9ee8f", "comment": "Malware payload (Mirai)", "value": "4b32f9af7b76100bc1c7cdff619cc5661c3a0298", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986105, "uuid": "5930cdc0-dc16-4d8a-99d2-86a5666838cb", "comment": "Malware payload (Mirai)", "value": "232047ffda9fada0b9f78f2851b4baa84478e7ad2922335b18c27ec8eaac73d1fa3e30e36ff6ca1645bf9e7ba03bc447", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986105, "uuid": "abec968e-d1e4-4133-8afc-85911d84a764", "value": "T1CC733C42774C0E43D1964EB4263F17E1B3EAA99021F8FA88650AEF46C675E339147ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986105, "uuid": "7a0841b6-8784-48a7-a1cd-8bf0e0239177", "value": "1536:gno9fYGovJm8GZMWQHRevPcyT/ojdIsEClFr+kMytpd/wbZnId:ABm8G/QxeBojdIsFrdlwbZnId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768986105, "uuid": "54430099-e9fc-4215-9a1a-225d98deb6bc", "value": 79276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768986105, "uuid": "e39d341e-67e7-4984-aa0b-99706c746e70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986105, "uuid": "814d0297-8ed0-4e42-95c7-8d824257311e", "value": "440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe10d23-f6a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768985810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985810, "uuid": "d40ad9e8-f403-4d32-a18e-e89d6185b3ce", "comment": "Malware payload (Mirai)", "value": "46e3b9cb35c379aa8673b3358679c03f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985810, "uuid": "6ff6e452-a40a-48fd-95bc-c7d78336c134", "comment": "Malware payload (Mirai)", "value": "710600780cf13c7598e97338c67c2caaa2562ec7bdde9afcfee618b12cfcecd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985810, "uuid": "e113a4c0-505c-4ff7-aa7d-4548c42a5d21", "comment": "Malware payload (Mirai)", "value": "4b5d809e1fd1eb3807a5a01d72e71c684902a21d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985810, "uuid": "553fd5b2-5b4c-4dea-9a28-8eea61abe3e1", "comment": "Malware payload (Mirai)", "value": "357e95fdfb39d35350de03677ab5192b523f402bba5b5b9e966d08e8875a043298b46c5e2e3e65e9a6a1451fa3ac8e70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985810, "uuid": "0f979608-8b79-4a39-8d09-74ad49d5616c", "value": "T165733CD5B801CD7CFC0BE67B40160A09BB2563135B930F279EAAFC93E9F21687956E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985810, "uuid": "1eb5c198-3211-4241-961c-3c26cc296462", "value": "1536:ryNLk4gMIMJ4hvZUcuvD8Fk6opUvnn9ybnm:WNLNatqVZcn9ybnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768985810, "uuid": "55837acd-c860-401b-9912-e2afe820fc92", "value": 74384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768985810, "uuid": "45400ab1-00f9-445e-acc0-62c06d8c5070", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985810, "uuid": "6f380e68-ac09-48b6-b53f-39975748c134", "value": "sdxkzX_UXA229x.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1ce643-f69c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768981267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981267, "uuid": "15e6b05d-29da-4d98-98b9-3989638904b6", "comment": "Malware payload (Mirai)", "value": "80a8e779c2e3f8ac90356c10599c4bbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981267, "uuid": "b11fe1e2-f80f-43fe-af8a-873a62ebb3f1", "comment": "Malware payload (Mirai)", "value": "71d5d4d46645b5b851c0cc2d6d56487a3a8c6c2eb7b11a5627d28537b7697500", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981267, "uuid": "98c25999-a94f-4bbd-bc93-1c4abf6705bf", "comment": "Malware payload (Mirai)", "value": "59bd54e12f0310eb431692782bc65871faf2fbe2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981267, "uuid": "feae3088-cea3-4a8c-ab9a-5cb3d654d5cb", "comment": "Malware payload (Mirai)", "value": "ce993e5af0c1a5cdef4919770bdd8f8c89eed7c8757f62d57d02a63205c9e8d684e4370981e4001fbcba08302ab4d5f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981267, "uuid": "898d4cf4-1d9d-4e9e-a38d-5529188238d0", "value": "T12F934AC5E6C3D4BBFC1204712036AB72DB73E57B302BDA47C3AD9932A822551D61A76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981267, "uuid": "68bdd2b0-50ad-47d9-8540-f7223b9d050c", "value": "1536:Zmn7N2mkhqGdtAavtfWnAcg1necWbdou4SiimIdcQeSMo:470m/4vtaAOcaCuliHIdcTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981267, "uuid": "0aac4e4a-d8ae-4be4-91db-54ab9e7dcb28", "value": 93672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981267, "uuid": "427396c8-a791-4d33-8124-a7bb950c4d2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981267, "uuid": "39e314e8-1190-4208-8544-a3657e0c5704", "value": "ub8ehJSePAfc9FYqZIT6.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f5968f-f6a3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768984422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984422, "uuid": "51e41683-9be8-49a3-a648-b1822d4b914e", "comment": "Malware payload (Mirai)", "value": "9bfed505d28a7dfbacf824154d18ce53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984422, "uuid": "6df2729e-ab71-44af-873f-639ea08b34de", "comment": "Malware payload (Mirai)", "value": "72e66af42c85121a60df2ce111d90a0e28f4a877ac92ff4b982825e5fd7718a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984422, "uuid": "f31a2062-f194-460c-8f89-8a6c825be743", "comment": "Malware payload (Mirai)", "value": "224a02e7f88199c5d6282310a4418ad70abf81df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984422, "uuid": "0be61c12-c27c-4e8f-afeb-00d58c716a7c", "comment": "Malware payload (Mirai)", "value": "100a919c2b0ecefdcb6061ca2f6373f94fa7ed6db5d9fae4b43bc35d34d7c18ae23dd6a83ef5984145d98f1e77942c1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984422, "uuid": "15368955-1f2a-440c-b854-64c01af0c42b", "value": "T1A1D3F746F8819B12D5D511BAFE1E124E37231B78E2DE73029D24AF31778A9BB0E7B405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984422, "uuid": "152ad5da-2b63-4810-b155-eda1a34d3aa2", "value": "3072:GNd1emY0+MxOIXKI+h35E/Qk/vplaCq2ELL:I1emYlMPXyh3EQk/vplaC0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768984422, "uuid": "3e5b63b9-d7b3-4543-a49e-ac2925869371", "value": 142844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768984422, "uuid": "62861289-c9a3-4879-898b-2a7add28cb34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984422, "uuid": "ab74dea0-dd0f-487d-92e3-2e382dc96cec", "value": "ub8ehJSePAfc9FYqZIT6.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cac1d72-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034928, "uuid": "d146ffb4-431f-4e97-9671-c86ff779d97c", "comment": "Malware payload (Mirai)", "value": "670c932010ea9d1ccec673c074612068", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034928, "uuid": "8b89b640-aaec-4f5a-bc16-4da88d5faabd", "comment": "Malware payload (Mirai)", "value": "73830776c745f6a962e4bbf57e0956811025385e93f4e6f76af9a9c817088b95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034928, "uuid": "9f61815b-19a1-4a66-af8c-95f689f732c6", "comment": "Malware payload (Mirai)", "value": "1b41e56ee7e05399430af4f04cb71e7674ee43b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034928, "uuid": "58bc30f2-c1b8-4500-a709-272922de43f5", "comment": "Malware payload (Mirai)", "value": "66683d4fb3adfb0429de3def156de1e1237f465f6cd4e6120c7ea25128135604a7dd0c8a964c14e48fadfecb02384b61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034928, "uuid": "dcb3c2ff-6151-4a04-8f75-250e049c4982", "value": "T127C3B90E6F218F7EF769827047F34E35965877972AE1C681E16DEA441F202CE241FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034928, "uuid": "26009b37-71d5-4055-8a64-c58b81d36e76", "value": "3072:5R+H/04x18/0F+mSD69fbZWIUVqdjnmIuQT7:B0onIUOrlT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034928, "uuid": "001609b0-6f0a-4c17-b58d-638a334e4759", "value": 126120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034928, "uuid": "81e646df-dea2-4b69-a57c-a5d835924e09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034928, "uuid": "907dbd53-81e6-4701-a3c1-c74198495d29", "value": "titanjr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e80a54-f69a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980401, "uuid": "f8a3560b-4afd-4ce3-bb33-3e1f701550eb", "comment": "Malware payload (Mirai)", "value": "778557b3923d778a05282d588c920e86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980401, "uuid": "f34f421e-563a-4759-886c-46e3b5d02df4", "comment": "Malware payload (Mirai)", "value": "742075df031bc868422b98442e475414440932ce5c3912dfae13c964ad979dfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980401, "uuid": "e87ea15f-1cb2-4ab9-8f03-3c677b35b153", "comment": "Malware payload (Mirai)", "value": "9595ad82b4f872e9454c98bddc7961bd2516225b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980401, "uuid": "b0faa120-8b6a-4fd8-9f3a-122e48443cb3", "comment": "Malware payload (Mirai)", "value": "877dd98c7e4b6f97ddf2d03be550a1bb9e7f72fa4d3413a1f0ef73e3fab40fd159a0d61173f2bc29c7ac542d61d343a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980401, "uuid": "86144924-6af1-4020-96ed-e4255a3f1e60", "value": "T183C2E076E1CBCED2EFB96BB17152D3C03B9D83C571628C9273C1BE0166AB92432489D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980401, "uuid": "2719abb5-14d5-44a6-b92d-dacc0a8c0b9f", "value": "768:kMJQsWHcFwpC7WzCXfZPDsxewMeS64uVcqgw09gq:kwW8SpchPDsJMj64u+qgw09t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980401, "uuid": "d2addec4-3b8a-4105-9d28-504611b5a577", "value": 27672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980401, "uuid": "ece05b32-4218-457f-ba2a-5bd2caf034dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980401, "uuid": "7018bbff-1ad9-407b-aa7d-615f75aaeebc", "value": "sdxkzX_UXA229x.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9051111f-f689-11f0-a129-42010a9c0007", "comment": "Malware payload (GoProxy)", "timestamp": 1768973114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768973114, "uuid": "354f2ddd-8c61-416e-a1c4-3bccd39d1bf6", "comment": "Malware payload (GoProxy)", "value": "249ea2c4539129b303a73fabf449cd77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768973114, "uuid": "5f5fa5de-9a97-408d-b6b6-1613d2163017", "comment": "Malware payload (GoProxy)", "value": "74f04df870e037da67c0faefc60526d4650926529aa344e471a4afb32c6b7477", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768973114, "uuid": "85f65377-4138-42fe-93ba-78e54b68bff4", "comment": "Malware payload (GoProxy)", "value": "d11fbd659df73d0dd318b1657a4defcc99a86d3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768973114, "uuid": "daf42c4e-975e-4e56-a825-01ad24a3362c", "comment": "Malware payload (GoProxy)", "value": "0189ea27a2de11f766d7767e567578980c219f47ba8f27aee5be3bc11d16b4396bca7faec99bb64d066de3370bcb6384", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768973114, "uuid": "230e900e-2157-4485-8fe5-70c15f842f8a", "value": "T128664A07ECA155E9C0AAE2358A629252BB717C485F3523D72F90F7382F72BD06E79740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768973114, "uuid": "182e908e-69a9-4cdd-a127-121585e819c9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768973114, "uuid": "39a5937b-5114-4482-bacd-974b19dbbcae", "value": "49152:PFDDiagTExvaS8oOeOtDfjMltMgKMc8yqTP1obBA221Ym1MbjJ/9b5ShfKiK9Kvw:PtdvlA6xcOP1GBUrIlobrzTHnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768973114, "uuid": "f2d1c998-802f-4e72-9d6c-f1de84c2ed8d", "value": 6495744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768973114, "uuid": "47ac130f-de8d-4931-8e5f-198db8253c48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768973114, "uuid": "929d2662-181b-44ff-afd9-2d174b2605eb", "value": "249ea2c4539129b303a73fabf449cd77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932c5b8b-f6d2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769004472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004472, "uuid": "bc10a344-beb2-46c3-abae-48ade7216884", "comment": "Malware payload (Mirai)", "value": "73f10226e2f81d986b2c155a7a6a6721", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004472, "uuid": "b020bc43-4e0e-44a7-9f52-77b54feeb55e", "comment": "Malware payload (Mirai)", "value": "7512b31b0328aaef6d432ee4ff25f546e6053d5083d679f33c7c275b57082083", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004472, "uuid": "dcf78479-20d6-44a5-83d2-934e69950716", "comment": "Malware payload (Mirai)", "value": "3f22d0ba124638f649f3553d40af8f070cf6b83c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004472, "uuid": "b66e5929-7cd3-4948-ab14-38505b6dc6b5", "comment": "Malware payload (Mirai)", "value": "fb92e397f7489e4c13b1d55dcebde32547814c361941c4384cebb4b89b23826c3196044c4ed5df65c7c2b8ee011dde52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004472, "uuid": "50ad89ce-997b-4b25-8469-eea7fd140a5a", "value": "T1FB148E68FE8E78D2D2C7E37DAD4A0FA230277D749565C0B11A00A29FD5EAFD489D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004472, "uuid": "3a0b5fa2-abf4-42eb-889a-f99676155b96", "value": "1536:OYtdyYq3BANtiz4UoUWHyeCFbjKEdAStt8YTpQURvqL4dqiofCsHNNjzPx+P7dF8:/yt4wz4UJP8EdAxYC4qfiofCeNRzPxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769004472, "uuid": "63859dd3-4d85-42d0-8d40-27585e2fdf97", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769004472, "uuid": "f8c47487-803d-4848-95f2-4ff638e6b579", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004472, "uuid": "7e2ff227-0633-4e47-9288-9a861818fa78", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b21ed7-f6ac-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1768988128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988128, "uuid": "169a0480-902c-437e-9304-56c0668a20a8", "comment": "Malware payload (DonutLoader)", "value": "bb3afa1cec96f946cc5d5d44cc5689cc", "object_relation": "md5", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988128, "uuid": "e91a10f3-7272-4dcf-b6ca-893224bef17d", "comment": "Malware payload (DonutLoader)", "value": "752deb8bb13033c153487d3f18e4f5ecdcb0926fca52d2775495673dc02e493a", "object_relation": "sha256", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988128, "uuid": "c49da8d0-407a-410d-ba7c-fc5c19678b3d", "comment": "Malware payload (DonutLoader)", "value": "127894d6a4a12b895d25aa5caa159b055eab9fad", "object_relation": "sha1", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988128, "uuid": "391bf40e-e4ef-4ebf-8628-9eb46f4ac724", "comment": "Malware payload (DonutLoader)", "value": "2e57032842a188fa7ece91e69af0788b2545aa20f4ea063f877ebd1227f85c056dcda40e6c01bf441ee76514e9f46242", "object_relation": "sha3-384", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988128, "uuid": "99a59b5f-e00b-468c-a5da-6b92e6ace4bd", "value": "T13135230AAC186FDAF425A631DDF5ECD3E12DCB71734541BFD121AB242AB390A0F57A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988128, "uuid": "67bf413e-6ee7-48fc-9487-ab3e047acbe1", "value": "12288:qFBMiMhn1+R6iCW6pZ5vECVqObN/go64z+1gig/Aqk+lcOyZ:8rMx1+R0W6LZXhN/go6f1gPlWOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768988128, "uuid": "b1a0f318-f272-44a5-9a60-838136dfafa8", "value": 1065146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768988128, "uuid": "303b2c40-b1c3-423b-82cf-213a73a59e48", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988128, "uuid": "1c0f1316-7608-47a0-b9fd-6faea96d11db", "value": "resource.png.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc2963e-f706-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769026929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769026929, "uuid": "e3121f34-fe27-4556-a925-26f56ef38ed4", "comment": "Malware payload", "value": "32786883a7453652949f45a4c293f238", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-55182", "colour": "#999986", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769026929, "uuid": "808f8292-31b7-4e3e-b721-a47dda11ab18", "comment": "Malware payload", "value": "75d25ad8cedb8db31f2b34b87b8ec67dbd1893ddbd0ac551a96e8834e9e181ee", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-55182", "colour": "#999986", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769026929, "uuid": "d200a955-7f0e-430b-8cd5-24663c362271", "comment": "Malware payload", "value": "89dcbcee15127ca1900888fdadd8e7c8509cfdef", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-55182", "colour": "#999986", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769026929, "uuid": "aab855a8-14ff-4cb0-bfd3-2c15edecf18a", "comment": "Malware payload", "value": "08d547fd2a5fb9f0606ffea201307c863daf8373031ddb340347f0f34c5957b622ffe1e3db384fd34d2a6b05bd0b1b55", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-55182", "colour": "#999986", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769026929, "uuid": "3ab22199-23fd-4ba8-a9de-b0f2eade4cc2", "value": "T146F1C845B79A3CEAE1AFC3F84926036FA6B4F8B0076657EF812081151D91B407E7AF53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769026929, "uuid": "d7abd5ff-bb3e-4827-88e4-c7d19c774443", "value": "65557bcc6d11b755e81c39531639457d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769026929, "uuid": "f7fa39d3-280c-456b-9669-9a192f301d25", "value": "96:7VkIRpawewKdnYs8Da3k231+V93SECntaRGc:72IRpawxKlf8Yk23093LCQGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769026929, "uuid": "612ef82f-4ac3-4657-8948-b1c0f685db5d", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769026929, "uuid": "d4c014f6-ee4c-4ba1-8243-b3fc6152c1a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769026929, "uuid": "8ad5629d-6553-4f75-a9c2-dc96c22d394d", "value": "75d25ad8cedb8db31f2b34b87b8ec67dbd1893ddbd0ac551a96e8834e9e181ee.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8caa6ca5-f6a3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768984274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984274, "uuid": "94fa3113-dcd3-4e81-a7f6-08fda3de911e", "comment": "Malware payload (Mirai)", "value": "81a6a582999eacb17f12296da2e3c94b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984274, "uuid": "454ffa7b-f589-427d-b33b-cdda46cce77d", "comment": "Malware payload (Mirai)", "value": "75d51991c73b8af27046430cb0b92b854819c1782c338c03f9e5986202f99022", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984274, "uuid": "bb8a43f4-c8cf-4eb7-9d33-b50c05ffb075", "comment": "Malware payload (Mirai)", "value": "a7ac00030a0cb5a8be6f4e13a157dbac78bbdcd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984274, "uuid": "0c3644cb-4ab9-436f-9e93-38861b79158e", "comment": "Malware payload (Mirai)", "value": "9601528139e31c33ee6cf080642eba2d1c924e36c3aa5fbac7257bfaffc52ae6dc9a290e0184916e87b2be4794c55555", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984274, "uuid": "603c2297-9b88-46ef-8650-0a13650dc697", "value": "T1E67319567C858B63D6E423FAB76E418E332063A8D1CB72938D526F51378682F0DA3743", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984274, "uuid": "76f08185-78d8-4c91-8262-f784fa4a8a7c", "value": "1536:LVKwmn+tWeMTfHCDSDc7/UTUtjn+4oEruw/8iffhHtlComm4hC3lXLgh2:LVKyUEazGNlVmPCgh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768984274, "uuid": "23d087eb-f0e4-4da4-b5b6-af7f2978befc", "value": 76192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768984274, "uuid": "bd879bce-d3d1-408f-81a8-a61dc15db049", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984274, "uuid": "de9d551f-4d0e-4bc2-88f9-db978b6a0be1", "value": "sdxkzX_UXA229x.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d2956b4-f6c0-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768996623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996623, "uuid": "3bfa22c5-e829-4189-afe9-3a24eac3fff6", "comment": "Malware payload (AsyncRAT)", "value": "10cd5cfb187c697529e3bd727cf915b6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996623, "uuid": "529fa515-718d-4255-b9fc-1db0d648e3e0", "comment": "Malware payload (AsyncRAT)", "value": "75e50384053e487d49bae8f857fd39af0179c293496f0312072dbaf9af9c085c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996623, "uuid": "8d42a86b-3e0c-4857-9ab2-87c7b846ae11", "comment": "Malware payload (AsyncRAT)", "value": "0fcf2da01b9d37104f6f461998e765c564a88a27", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996623, "uuid": "0f76b1a9-4d27-48bd-9051-2fb1d5fcecbf", "comment": "Malware payload (AsyncRAT)", "value": "eab38de91b6fce4fbe7397855e283275e9def2ca1fba5cba425296389ac4c5572d27bd2e50c8e2164736c0ea5eaa73aa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996623, "uuid": "12599a3b-5e3c-4152-8e3f-5a692df2850a", "value": "T18A1374F07ACB77580B24393CC5882F9A6BBAF2593720F861A1D959CB842F75347764B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996623, "uuid": "e388ef69-4b6c-48d6-8cfb-7768d1c16951", "value": "384:LQEdEt9QWfHekXzEGcdOnqUB3s0oQOzJc6O:lfO7qpQw9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768996623, "uuid": "fb4f296d-b8b5-4a83-9466-2446e4a47e5b", "value": 41597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768996623, "uuid": "31310096-ee9e-45d0-bb5e-b8981f4d290e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996623, "uuid": "9099e626-7870-4da2-9868-362fa2b65930", "value": "Purchase_Order_Sheet_Confirmation_Required_Quotation_Request_TradeKey_xls.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5bde35-f6cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769002074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002074, "uuid": "c67c1583-5afc-4c0a-8f17-4ff4817cd026", "comment": "Malware payload (Mirai)", "value": "87a7399fd7a255e04d20f1e3a91d69f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002074, "uuid": "9b727b98-12cb-4ca7-9d9e-188c988475e6", "comment": "Malware payload (Mirai)", "value": "76f66700d70e7ee9f078c72042641346f3dd27e2daf6389ed03d9182f33d8f15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002074, "uuid": "52a30049-b303-48ae-ab2f-3874f0d24020", "comment": "Malware payload (Mirai)", "value": "79ac35e5364068eb5ef9bd4ac373a35e696783c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002074, "uuid": "0e9f8430-05e3-4c08-a660-40684d670696", "comment": "Malware payload (Mirai)", "value": "3e4c6e9f869d3cd01673741c5a8ace071be03c3d26ed9e4131399e0cdf5b76f4adb42c30e0ea1ef09e38a0e9ae79707e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002074, "uuid": "138a4fcb-6b09-49d6-992c-c285bc1a01d5", "value": "T146634B21BE761D2BC4C4603B61E74635F1F9574A21BCCA2A3EA20E9CFF14650325F6B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002074, "uuid": "8bc46f10-1300-4ace-98ae-31850e54416b", "value": "1536:VrlioNJuQHC0IJfwMGalyZ0lrIawdw5zm7uhI2:F/+JfYFCzTzmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769002074, "uuid": "656b3dc9-f825-45f1-ba15-c02a59e19032", "value": 66780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769002074, "uuid": "9b756be7-06ca-45d5-9485-77e73bf32377", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002074, "uuid": "4217ecf9-0e00-48ea-a01a-d66366450afb", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f1d567-f6a0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768983023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983023, "uuid": "d3b3f908-75c0-4028-99e6-9a85b8598bc1", "comment": "Malware payload (Mirai)", "value": "9ef2e9b352f6dd39ee2094bcb46ba4a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983023, "uuid": "73b357d1-bd01-44ee-8c3f-f95562953ae7", "comment": "Malware payload (Mirai)", "value": "77b95bc7807219e0d0aff27972d38ae7192adacaef7c7df0d0cc6698fa3742fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983023, "uuid": "4f7a349d-f793-463e-a889-614820fc3beb", "comment": "Malware payload (Mirai)", "value": "ed791bef1fd95a7d78a3fd807215f0654a5bd979", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983023, "uuid": "aac9c73d-edc6-4510-8071-b1dad8ce7ebe", "comment": "Malware payload (Mirai)", "value": "270a9e8b708d6ba7876dbe587564c8745c7aabcd0144844714d5ec6ea76cdc5d61d6ccd5d20c551c1e1a87dc3ecba5ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983023, "uuid": "ef0dc319-096c-4789-9db4-2dfa64ea70ee", "value": "T19ED3CF32E0086DA0DD2116B4347659BC0340DEB40BD59243EFBEE59E28B7DA57DEDB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983023, "uuid": "2d24e544-4f79-417e-8cdb-dab5b3e7c77c", "value": "3072:kNulV+GOAc3YSmDEjdX/VuHVv3WDRGGRhaUNZkP0ZdBa:yulo2ubIVv3sXL5NZmOdBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768983023, "uuid": "f4e9cc00-7cdf-4af2-b90a-45f0ab778c56", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768983023, "uuid": "126fd9da-a1e9-4ea0-99e0-d05c1b6e20a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983023, "uuid": "3637beb4-179e-45ae-a2da-6f5f5d3886db", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7226d99-f6d1-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1769004076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004076, "uuid": "daadf2f6-cb57-4058-a060-2bce5867c75a", "comment": "Malware payload (AgentTesla)", "value": "c875ae6705f32fcee499b8b07487fae6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004076, "uuid": "5a76cf18-424c-4ad2-b91a-5d4e43461da9", "comment": "Malware payload (AgentTesla)", "value": "78168fbd64d236009f1bed15cfa73ad47bc838c34cc453a4c29f7e2a9fda99e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004076, "uuid": "2b6773d0-5cbf-4a30-98ea-b19beb1b7db0", "comment": "Malware payload (AgentTesla)", "value": "3e8c9c10a12baaf6e6c8ad24d2b4fd5df24cddfb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004076, "uuid": "9ea198fd-8f5c-4618-8388-deee0f1d4346", "comment": "Malware payload (AgentTesla)", "value": "f53b374f4437b49b36777953ce317df6dd28aca57e4f7df969969477457c6efee602e00b2f7ea1df4e63a3268f5ab47c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004076, "uuid": "2dbe5278-58fe-4b31-90dc-16c3c3873281", "value": "T109E412823378DD6ACA3B03708CB76A246679DF5D89F647172322B9147D732938A4F247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004076, "uuid": "2f1beea5-450b-4289-b803-806de1d00441", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004076, "uuid": "c42466d2-db7f-4508-b982-5ea154236d72", "value": "12288:FAt1p3qO2VmwdLBTAOtSVYkks8803v0g2OLvtdBj5b18Rnq/SFstBNAWjIr9Jq:FAtb6OufTAOIVYkk53j5LvnBdb18RnUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769004076, "uuid": "af915bb4-a128-4eb6-beba-5d050c917186", "value": 707048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769004076, "uuid": "176a474b-7a1c-4c6e-ad30-d272acface50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004076, "uuid": "be97caab-7a31-4922-9df4-393a9a3d36d0", "value": "STATEMENT OF ACCOUNT 20_01_2026_________xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25448e85-f69f-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768982383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982383, "uuid": "11a9a007-3e87-4108-bfb7-77666f23da27", "comment": "Malware payload (AsyncRAT)", "value": "3d768714597aecd53f508a34ffe85c84", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982383, "uuid": "a686747e-a53e-4d92-a336-85ef8b200068", "comment": "Malware payload (AsyncRAT)", "value": "788fdb30772383915292750888a58bab9693bd2c486032e3bcb2b811f3c01cf4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982383, "uuid": "00a8720d-707f-4048-a866-ef860a518317", "comment": "Malware payload (AsyncRAT)", "value": "49a471812e918e100367f9eff6efb667a2bd565e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982383, "uuid": "d045a2fe-5ebf-4442-93f2-d3eb40dac942", "comment": "Malware payload (AsyncRAT)", "value": "23cedb1cfe9089c7f1474f513ea623fe2dc3161554439e2fc4dc46cf4577e484626e4a5d9de0dd241055ded75badde61", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982383, "uuid": "f36c017e-9b8f-4a7d-b1b8-d42dc0f3fb84", "value": "T1A5D21A04B7E48A65E1BC5BB98D7292009376E9474C67DB9E6EC440DE6A237C9CE10FF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982383, "uuid": "9df9172a-fd37-415b-b6d9-209ee39a3ccd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982383, "uuid": "9a805997-296f-4ea0-8e0b-311c21f0ed17", "value": "384:psXWAybmwADSe1+QKIcj1h93buUsTQxnCJf+jJGIjJ3Aov/+:pyWjbeDSe4QK/jbRbVB/jxv/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768982383, "uuid": "beda4a3e-4c5f-4d6e-b399-ea4b70f681b6", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768982383, "uuid": "27cbfd28-8a35-4236-9d56-64f334402d47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982383, "uuid": "c1a8ef20-0947-4a03-b587-86563f2aa4cd", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0747bf-f6a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768984033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984033, "uuid": "5179be20-aadc-4f27-a7a1-2d1787273377", "comment": "Malware payload (Mirai)", "value": "57ce02e6edb3c7c2b803887a44ea2ead", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984033, "uuid": "2ce0c575-eb7a-467e-8cb4-e7e4ec9509d6", "comment": "Malware payload (Mirai)", "value": "78b30c10048387bf7255a785339d1f6001b8e67d2a63ce8781a45ae6fc784c82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984033, "uuid": "d870403f-c171-4a07-91c5-9e52b972106b", "comment": "Malware payload (Mirai)", "value": "d40c5ba16579dc2078d4db49597f2bfc40eead61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984033, "uuid": "bff5ffa2-944d-4e99-ab64-a8695ff34108", "comment": "Malware payload (Mirai)", "value": "83a11ef3ec4fb70b440b6b4e25dfc8b258bbda4f2a104a88616916847d44fa6414c4bf1ac76a6cb300e815bb640fdfcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984033, "uuid": "454b244c-9ae7-4127-94c1-fa78aaab522c", "value": "T16372B0F1B622A9E2D3604C79EEB88A400DA701BCA1E7752511F0977979C741B79F8347", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984033, "uuid": "061bcf16-ebcc-422b-813e-86c863f8f8fb", "value": "384:4j6ZV1NvnrFE9JNwFuj6Hl+9iEzBO+gDhymdGUop5hm9:46nvpEPuFc6H0ldEDs3Uoz89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768984033, "uuid": "25b03e21-18a4-440a-aed1-b6d9ba0880e0", "value": 16640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768984033, "uuid": "aab8f317-28c3-46d6-b208-1aa2f06d78e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984033, "uuid": "918be4b4-bc30-4986-a86d-0a1843d4ca3c", "value": "ub8ehJSePAfc9FYqZIT6.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf4e941-f69a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980594, "uuid": "ea619b45-4017-4e42-912b-8f3ce2891280", "comment": "Malware payload (Mirai)", "value": "e227b22a8c876289101b08caba48f086", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980594, "uuid": "a4d3c5ef-8a7e-4003-8157-861edecbc1da", "comment": "Malware payload (Mirai)", "value": "791c77091b18dd025fb1270b5e49916b93f9310692530f293531a48e0c91e48e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980594, "uuid": "165b1f93-2999-41e4-a1a4-4e4cfa14cfb7", "comment": "Malware payload (Mirai)", "value": "8d010987b65131fe8ad456bcc3e02ec06a4df03a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980594, "uuid": "e1c7f4d7-33e9-48f7-a12b-3f25511f2a99", "comment": "Malware payload (Mirai)", "value": "f97aad58b414bed39963416bf7e870068eba0d77b5e614a4760d11d461c4b2a8291777208f1ef38885cb4d437f03a4c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980594, "uuid": "015653c9-7e5e-49b3-aa9d-28746bccafd4", "value": "T185E3390AB4CCC4FDC8D9D1785BBEB526E931FC5D127CB21B27C4AA221A9FE601B1D614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980594, "uuid": "01ca917a-8a86-4742-affc-803432307063", "value": "3072:6uFWknspPXz4YBAqWie8E4Y/AqRyv1e5aQxaOnG:GFw3/bRT/MO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980594, "uuid": "1895195b-f8c4-45af-b565-3b081b28d3b5", "value": 155688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980594, "uuid": "6738ad0d-ccc3-4a84-b4bd-b75d29fe2dfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980594, "uuid": "a31891d8-a320-496d-a8ff-405599065862", "value": "Orbt.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca523bfc-f6cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769003276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003276, "uuid": "6826fba7-3a64-43b7-906e-b5d804118309", "comment": "Malware payload (Mirai)", "value": "c4fd2ad1fe208cfd249b6cca74bd1fea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003276, "uuid": "3aac51b6-224c-4f3b-826c-117c2b1f4cff", "comment": "Malware payload (Mirai)", "value": "79934fde8a1f1e2e1600b7ee38470bedaf298cd0ae2e8a3b8932f213843e2617", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003276, "uuid": "03e758d4-30bc-40d1-80e9-b0f96f810b82", "comment": "Malware payload (Mirai)", "value": "766772b509f8ac51bfa15d44f62cc382963d25b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003276, "uuid": "9ed2c661-155c-4b42-bc62-8f0ac1908e41", "comment": "Malware payload (Mirai)", "value": "6e7e2f969d91bafa3fe1c0b1007224c186003811122ac6fc60301ee2dbc509ce36f748e9904aedf33a6cee7e54713eed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003276, "uuid": "2c9862df-54e1-4ba6-9e40-807d16442ad1", "value": "T111B309CABC818B11D6D565BAFE0F518D33134B78E3FA7103DE145B2A678A86B0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003276, "uuid": "ccfc5f33-26bc-4d22-acac-2698533050a6", "value": "3072:H38SqnBXrW2EpWfYy3viCLrZnz6RHRo6cjHZJAVWZaZPT2:GrG1y6CLrGHRo6cj5JAVMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769003276, "uuid": "24ce2216-e58c-48fc-bd8c-fa990debfacf", "value": 117128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769003276, "uuid": "04cd8a97-6198-4ae3-b77e-e6dbf87fd2d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003276, "uuid": "d070ce67-676d-43a2-b937-f249de56609f", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2a1725-f6e2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769011417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769011417, "uuid": "67d64aac-d918-46f8-8721-f6df18e61b92", "comment": "Malware payload (Mirai)", "value": "6813717de943439ccef28833a4a36ca5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769011417, "uuid": "d67d5aaf-0684-4551-a32b-eb4a075fae92", "comment": "Malware payload (Mirai)", "value": "79c7a1e51b55044b5d69fa102835abdb1cd75675750c4b06dbcad4e558a88561", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769011417, "uuid": "273ec7c6-cbe0-440e-ad30-1e3e478f127e", "comment": "Malware payload (Mirai)", "value": "b0d8e8c420302eeb391c638813514882524f304e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769011417, "uuid": "ce9c7ef7-37fc-47c6-a3e2-b2348ee330ab", "comment": "Malware payload (Mirai)", "value": "3972f52373d07d4144a85aa665a4421a66cf98a707d693d0ec88c160061c2bf16a86441a9b9a4241afe11b76f6c6a1a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769011417, "uuid": "3b9ddc41-a156-4dec-a0b9-d94ff47073a2", "value": "T10A833A07F58580FCC48AC174176FBA3AD923B1BE1238B15777D0EB122E99E216E1DE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769011417, "uuid": "317e1d2d-9c98-4abd-bca0-29c9e1142083", "value": "1536:tLTm7waIzerzviesibxGCKDSdOFjzzsAbvUpe1/7jfnvfkccJ4qWJ:VAIzgzadbCKDSU3sw8e1/7jHfkccpWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769011417, "uuid": "cdd6d947-ad10-4ef5-b4ec-83932048909c", "value": 87232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769011417, "uuid": "bf81d9d6-cc2c-43aa-945b-825c72b2bf1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769011417, "uuid": "541eb003-72fa-49bb-9f75-f43e19c3fc76", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a227a52c-f6e2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769011369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769011369, "uuid": "52994a4a-5cb4-4c7e-9455-c7b62dfe09dd", "comment": "Malware payload", "value": "8e7b0d2efce769ed5e3f6b8e480dd84f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769011369, "uuid": "902c1b38-da69-4776-af0c-18ce6bfd372d", "comment": "Malware payload", "value": "7b0d154ca12e3ca2d9f37403af4b161501fa7db2ab67aa56c66cfcdd9fea09b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769011369, "uuid": "0ba947e3-bfb8-4d0d-8670-9e43f37ffa7f", "comment": "Malware payload", "value": "59a5406d344df25f1630841673707ec702f894b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769011369, "uuid": "00a4c5c6-6e0c-4f4b-86ae-e6d870cc4348", "comment": "Malware payload", "value": "53233ffe78446c5a3f0390c163c435919607936402568ddd9e6102b3a01663cba51dd3af5456e9307b206976e893f0f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769011369, "uuid": "a5d9b3fa-c931-4333-a6cc-b6a48d92d687", "value": "T1C34423C4F85E595AC07F04D61206B23947BBDC94D284E8E2361F74B2BABBC24BE67C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769011369, "uuid": "60ff3c21-e95c-4628-aa85-2f7246873f9c", "value": "6144:YIG5UmT2avNWpuzsNYTvEONnewj1C2JZkTCygUjKX9d:YIUUmia0LNqvEOnewhragUjKX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769011369, "uuid": "ac294e0c-16ff-4131-8235-d62b7b18254e", "value": 256123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769011369, "uuid": "326bae61-561a-48ad-af73-f514e427f084", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769011369, "uuid": "6b4f0bdd-ffd8-4d27-a77e-ddcb6ed962b9", "value": "bizy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f451361-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034906, "uuid": "06f29669-d148-42ae-970c-901fd208825e", "comment": "Malware payload (Mirai)", "value": "d0e062474d42b026d6f1b4b8d6e65bf5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034906, "uuid": "7710a003-fe8f-4026-9b1d-47c93f3ed09f", "comment": "Malware payload (Mirai)", "value": "7ba0beac45386911c93984140ddaa7384bf5ac637ca404359f4fae04943fca59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034906, "uuid": "792b64f3-e65f-47fa-b392-22ff312b58a4", "comment": "Malware payload (Mirai)", "value": "79442e09fd27702e927289693ed7ec8959e6ba36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034906, "uuid": "0ed4037d-c546-42e0-bc0c-718e044528e3", "comment": "Malware payload (Mirai)", "value": "e2517c38772b9a601a5af004048ad753a5127749328b1de59c993db44f8074516a71bc6da01a4536b2e25afc15a20e5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034906, "uuid": "6386a699-2d91-44fa-b8d9-e958bff8c6f8", "value": "T157C32903F5C184FCC086C1301B6FB63AA935F1DD123CB6E76BE4AB126D4EE615A1D9A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034906, "uuid": "d338efb0-961d-40f9-915f-50ed31a599d0", "value": "3072:iFJfIJYfJ6x55ys8Xm4xtF00a7lWxONj7LgAZ6SVcOiTZOwP+x6:iFJAJYfJ6x55ys8Xm0tF00a7lWxON7rE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034906, "uuid": "2429c2c8-cab9-456b-9ddc-2bfe75c932df", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034906, "uuid": "c6890112-f3cf-48d5-9aff-c2052cf8f65d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034906, "uuid": "a0470e4d-1e8c-41c8-bd0a-f7adddf1214a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fcf7bb8-f6a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768983313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983313, "uuid": "72476972-5448-43d7-85c1-e5c43bb0ab45", "comment": "Malware payload (Mirai)", "value": "e462b0bb5dfd14d45df779c32ed6e8dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983313, "uuid": "c40aef19-6fc8-4cee-b7ce-e6b7612df821", "comment": "Malware payload (Mirai)", "value": "7c6bae9d2a4bc7864ec022913a39694545f5de13a532ec4bba4ebffccfad4047", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983313, "uuid": "bf82c600-46fd-4e6b-9b0f-ef6ca6e36c65", "comment": "Malware payload (Mirai)", "value": "8bd30f5aa739d57a4a901f830bf1e8c8b5fdd3fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983313, "uuid": "670786f2-6fee-4cad-bd0f-c335f18621ac", "comment": "Malware payload (Mirai)", "value": "ad44abf64ebe144d84f374772026e0b7d1d13dd1b8f78aecef4557ff81f91e93058b8c6b61d7ec3196e8757fe1cda501", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983313, "uuid": "7cc6faf6-d746-4f4e-ad54-3f508851f983", "value": "T17F04855D6E229F7DFAB8823457B34E20975923E623D1D684D2ACD2001F3029E645FBF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983313, "uuid": "62274c4c-a597-49ff-a3d6-858ff9cec335", "value": "3072:Y2e+VrVslZZp7ndFORhv1+7LOHTvYO3AQmchAREkNwBtN568sO5N1dJkInOCJGyy:YnvZp7ndFORhv1+7LOHTvYO3AQmchARf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768983313, "uuid": "9fecb77c-f911-40c8-97f3-3321d61d6f2d", "value": 174124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768983313, "uuid": "d96d8d87-1234-4b68-9d47-4c72aff674a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983313, "uuid": "413a56ab-11d9-447f-94ea-62b89b4afc30", "value": "ub8ehJSePAfc9FYqZIT6.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63cceaf3-f6c3-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1768997950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997950, "uuid": "d5bd59ce-4f46-4f67-945d-0ea73c19d3cf", "comment": "Malware payload (ValleyRAT)", "value": "7d8823a59f6739655c2c545a18963bae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997950, "uuid": "9f4d8ff4-2b90-4fa7-9e6c-ac2653b8204b", "comment": "Malware payload (ValleyRAT)", "value": "7d5d33252d90dadea4f89912e4124fe56b8ad9daeb34f6b45f21d07785ba6c62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997950, "uuid": "bd004875-3bc2-4eaf-b2b2-c6c4b6f553f3", "comment": "Malware payload (ValleyRAT)", "value": "fecc61d5404810d8fc7928ec05bb73e400e74a03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997950, "uuid": "7174d07b-a4a6-4e76-85eb-37e1c044e73d", "comment": "Malware payload (ValleyRAT)", "value": "73d7cf42c52752aed6a00bec57fe6e4de239c1a6e822c981c399fe1c71f9e140325e8675c201b7189ef56ce583dcf334", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997950, "uuid": "f7001642-8811-416b-a3de-5d4c2d062717", "value": "T1092833CF50B078C1F6D76B3595B645348A8F5F2042A18BAFA2677D0934F9AC4A3948CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997950, "uuid": "1eb5191f-e295-4ff5-b11f-18b198112849", "value": "039d1617d5f0788dacbd04b35a141ebe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997950, "uuid": "c5106548-93d9-4378-8e70-e35055feb6a7", "value": "3145728:hNF90y6l8X1fnymJFvry4MeiE0q5kHOoRtudcp:hNwaWE+u78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768997950, "uuid": "f1a58a45-e0b7-450f-a443-eccba99677f2", "value": 101299639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768997950, "uuid": "0a4636cf-ce7b-4950-91f4-e4e6f25aa894", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997950, "uuid": "82fb5cb7-9d77-412d-9528-3f029c6340d1", "value": "Xwincvawbugvrfjiasnud.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2415d02d-f6aa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768987105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987105, "uuid": "062ba25d-a7cd-4a9e-bb90-ca65ef36069f", "comment": "Malware payload (Mirai)", "value": "3cd55809336bb3564bcf736bff73f601", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987105, "uuid": "4228752c-3927-463b-a6ff-53449cee72f8", "comment": "Malware payload (Mirai)", "value": "7e9f6d938f9a646812f5689172c76d7268fa6408b4014dc5f0c3039dd5dcb43c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987105, "uuid": "1aa92bd0-c5e4-4c5e-b232-913651c4272c", "comment": "Malware payload (Mirai)", "value": "e7f57357310e4f14f137ea7659ca6d1c89a66a95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987105, "uuid": "e451089b-f625-4696-8f63-a4e3322136fa", "comment": "Malware payload (Mirai)", "value": "9bfb5195fc6e8166ed23166d7f9f624f8bcb40826120a66f1186fca76e73792ee74ec4e1b3c6b0dba8d35bcc2737e9c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987105, "uuid": "21334d9d-6fc8-425d-8abc-411e3072d1a4", "value": "T14803F14071E52654E24F203F125DEA340CA5B7AC977CBF4BCA66E2775836E5534F8382", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987105, "uuid": "2e94ad08-d84b-4004-a946-32af0cc9eb96", "value": "768:75zGYSTbh7UYV5nw7dZf5K6jMFhnt5krp7jvxh7qa0nEKnbcuyD7UHQRj8:RGRPwr9jMzt5kr9v37N0Dnouy8HyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768987105, "uuid": "076df750-7b7e-43cd-8d87-bbaa33a11df7", "value": 39980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768987105, "uuid": "1591eec6-2300-4f25-9607-a965672ad01b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987105, "uuid": "41439ec3-d1d6-47af-97d1-c2b632c2f580", "value": "ub8ehJSePAfc9FYqZIT6.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b762138-f69a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980407, "uuid": "12361eea-0712-4adb-9440-a6dc0562f32b", "comment": "Malware payload (Mirai)", "value": "4262f5d538f470413295c74e2f18b01e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980407, "uuid": "858eec8b-c3a4-4431-8ed9-f3eaa1d3c32f", "comment": "Malware payload (Mirai)", "value": "7f602b7a2d5994fea011550a7eef299c31f21fc3134f244d5e05b127f1e24524", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980407, "uuid": "d4a7c9da-07dd-44a3-b578-e9a2f403ad61", "comment": "Malware payload (Mirai)", "value": "616fdf2458db5993c3a1f07d302b518f486a10e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980407, "uuid": "c15606a5-5d9d-42dc-b971-5ead02e6676d", "comment": "Malware payload (Mirai)", "value": "b313c7bfd7aa9cf0764fc7b3517cf5db0c34dd710ccd9e85dc5858d3adc5034741087db3b04198c4abed2ea0ce4c0042", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980407, "uuid": "e9af923c-4fcb-426f-a09a-822ab7f70abc", "value": "T158D37B22D964AE98C225D879F021EB395B539E9241870FFE1A67CB718043DCDFE053B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980407, "uuid": "64c90cba-2145-445d-8598-6120a2b07559", "value": "3072:Pnee0PI6OldA5m1crCsWd7FnZxiaWO4AIGeTa:mMGm1crCsC7EHOoGeTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980407, "uuid": "6ca950df-a434-4e24-84a6-5d1ace3912a6", "value": 132356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980407, "uuid": "9e7b9689-9326-464b-9e30-380082716530", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980407, "uuid": "dea09143-8450-44ca-84b0-79987e957370", "value": "Orbt.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15acf7d-f670-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768962512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768962512, "uuid": "a8ad9ea8-0b0b-443d-bf55-cb77a81b7755", "comment": "Malware payload (Mirai)", "value": "b4cea1147c3fbee825e1e8b488f52f19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768962512, "uuid": "2aad2adc-f2bd-4745-ba70-885ebc2603fd", "comment": "Malware payload (Mirai)", "value": "7ffdf595bda2970ad75a965376f205e12b6336126b78b128fe423d21c4105b7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768962512, "uuid": "1ba11ddf-abd2-4435-908b-1cae0e15f094", "comment": "Malware payload (Mirai)", "value": "a3cb412caa10edf8208f72853a8af625237777d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768962512, "uuid": "44c7bac8-de46-477d-900b-6d0c0b2a5631", "comment": "Malware payload (Mirai)", "value": "1c05b06901990a9cc9c971e14345ddbe426fe3989e80067ddef1dd3128be808f71b16eb9840d1e38b500b8b89057e353", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768962512, "uuid": "3b264bc2-0ffd-4e2b-a648-1bf18b86fe48", "value": "T1B0D30785B881AF10D6C625BBFE4F418A33135BACE3EE7213DD141B2427CB95B0E7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768962512, "uuid": "f65c66e7-e0f4-495d-970f-431fa5048fda", "value": "3072:e27HVBLB3tb7hJst3FzS4mqrmZ93rVnhaneh4a6cxOfwEFc/BUOo2CiOi+tnTE:eu1BLBdb7fstVzS/qrc935hanQ4a6cx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768962512, "uuid": "aed9dbed-de56-4b4c-9b3e-c58941deeb0d", "value": 136692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768962512, "uuid": "7bf82502-4c12-4f94-9eba-ae45062b2c53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768962512, "uuid": "d0b7c439-f53a-428f-899a-689ace7c6a9e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd769824-f6a9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768987041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987041, "uuid": "4230c293-62a3-4f64-a0ee-dab5b119d29b", "comment": "Malware payload", "value": "24037b3ff6ef53715c478a5622d541a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987041, "uuid": "475f55a9-598f-4ae1-9a34-ee8b4507a5b6", "comment": "Malware payload", "value": "817f7f2238e8d3535df190f6349aac6a033e18a88f1fcf7a195867b4d6c836b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987041, "uuid": "7f06d834-9abc-4a11-b4b3-46544ca33951", "comment": "Malware payload", "value": "f64bab1fc97d9dacdf9f3a62b6441033151852c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987041, "uuid": "22834132-9aa5-4903-8346-c09b0491de6c", "comment": "Malware payload", "value": "3a5139d13046125352a671c6afb6aba907cfa221b09e1d13791d3f9366645d21ee400d2b207de9bcf364f444c65c7779", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987041, "uuid": "d914ead3-f88d-473a-851d-470d34c79736", "value": "T17A04191BB3A348F9CB578070869B9372E532F8210330AA3F2754DF366E62D645E6D764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987041, "uuid": "8925736b-9f7e-4784-b595-a921e8647aa7", "value": "727613bb6491557282c51045490de15d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987041, "uuid": "78a76739-8a59-4b5c-af60-b4af9066e929", "value": "3072:toYMtrekcvk8lMPwCfbdK6lmOEDWp8WGpdfIbGcdUEwPV9A:toxTEWfLbpnGpd6UEwrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768987041, "uuid": "da836ddf-82db-4e78-88de-c5294e00d894", "value": 187904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768987041, "uuid": "d05f25da-a7dc-454e-916f-609bfacc2107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987041, "uuid": "eeaa2500-fed2-446f-9634-95801c959167", "value": "ramplant.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef1aaa99-f6df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769010209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010209, "uuid": "f57c5907-3231-4601-a577-20e9974f1889", "comment": "Malware payload (Mirai)", "value": "3077d99809c03b4d62d724c499db0c6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010209, "uuid": "44b01b58-8c86-4fa2-9375-e6897f7b3ee6", "comment": "Malware payload (Mirai)", "value": "81e2298f75e8434b5f31792559cb5e406939ca687ad03048f50e575466b75f00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010209, "uuid": "c6552cee-4ec2-491d-9d5a-aed0676c85da", "comment": "Malware payload (Mirai)", "value": "71c7ecab029da177a64d545f343e8d5f87ac0796", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010209, "uuid": "3f77a829-85ac-41ae-8263-61aa2de0640f", "comment": "Malware payload (Mirai)", "value": "be73bd32e2dd8dafbb8caf697c19e56050ae8c87e5c6428e13f3d70c6bb2bf79172a2199c706b2e8c1955ad9d825e580", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010209, "uuid": "93faefa4-8520-4529-b25c-370c2f61ff79", "value": "T151D32A06730C0A47D2632EB43A3F67E193AF9AC121E4F640355FAB8A95B1E335586DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010209, "uuid": "6f622b2e-6ecf-4878-9cf3-ecaa0d8bcbb6", "value": "1536:9roGHNTUZN0MIBUiCxfytiteQInJ7abwko7lj0JvAhhHr5+5uQfqIcv7Z8:nmmUiCx5t26wN7lDhLvt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769010209, "uuid": "eceb2d52-a20f-4515-a856-a096947161c3", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769010209, "uuid": "907e37dc-9d33-460e-8af2-e752c2d3eb4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010209, "uuid": "65607876-13ea-4a0b-a645-ae40fbbe2d3c", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03a4109-f718-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769034693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034693, "uuid": "8485aefa-26f0-4ff8-8817-03c1f5bd68ed", "comment": "Malware payload", "value": "fdaff5a7148be6d4eaec58d4bc52e295", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034693, "uuid": "a34f5831-e119-4fdc-bfe3-5af9c88f55b0", "comment": "Malware payload", "value": "81ebdc7930fc303622b8038439b608172be0dd977f240574ee0832e5e70f3f11", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034693, "uuid": "25bcddca-dd14-4e0a-a86f-2bf225fad988", "comment": "Malware payload", "value": "72a6a0120dd07ba4ee15eaeddf9c48c3596cd06a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034693, "uuid": "f03739ed-040c-4cbe-98bb-4e65a76f3071", "comment": "Malware payload", "value": "83901892fd3f6be2ab11117a8bf57cfabfbf336bceb7be404955c182b7d698c9cff66598f29846f137b81bcd8081d172", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034693, "uuid": "23530d8e-41fc-42ac-b82b-dbf912cb263b", "value": "T198F01DECF4F7A543EA288E88B0E6802E9000D1CA3CB3CE95E82C4C3948FB5043154F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034693, "uuid": "9ff26b80-15b6-4760-a601-6271cbe310bb", "value": "12:3J3UUA5UU7ALKZUUP0LKFUU5eTt4xUUifWUUAjIUUcRUUuOqUUWTUUSMUn:3J3m4K3yt4AZ1wSsn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034693, "uuid": "74f494f7-fd9e-482d-9c0b-7c5dadb7d76d", "value": 600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034693, "uuid": "436acf19-a1e7-460c-930b-06ce9fc1678a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034693, "uuid": "c646c441-5d59-4ff6-a7e1-078999beaa7c", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d00bbf-f6c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768998646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998646, "uuid": "c7005ce3-755b-40a1-82aa-4d5191a18e80", "comment": "Malware payload (Mirai)", "value": "9cfd53ef52c0accbbbb79271a5d5973f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998646, "uuid": "ac12364d-2cde-4bf3-882a-8273866e2ade", "comment": "Malware payload (Mirai)", "value": "83e0d0a7c00ca8f81c745a2f126828872faed27c892da5748036c48d768195b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998646, "uuid": "43967d13-ee8d-4b54-998a-bc4e7756eb5a", "comment": "Malware payload (Mirai)", "value": "491eb3d15c4f3aaa847e8fafca7fda93ecfeacc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998646, "uuid": "f39191ce-0320-445f-8f34-e0663025a987", "comment": "Malware payload (Mirai)", "value": "523377647e87bb1b94b63f114edd3656cdc211a8bb9703a437fec94b7e072ce4493154b51fa4fcae05c8c2789d8898bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998646, "uuid": "581db49c-fd9c-4aae-a83e-4d2180ec5d5b", "value": "T1C9731895F480DB72C6D1267AFB4E528C33230F78D3D932028D15AB3467EB95A4F3A906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998646, "uuid": "a042525f-d3bf-4182-8909-b6066f8a97c2", "value": "1536:YuvG0ApSZ5ch0Y2EJV8JqIAMh6d763yKOMlMHVUjge7sg8cX9bDI+TxONlO+KOZo:YuvG0MSZ5c0Y2a8IMh4bMbgssgvXZWXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998646, "uuid": "c532448d-7856-47c4-9e20-70fbf672f57e", "value": 79268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998646, "uuid": "080fc510-e132-4e91-a7d7-12c30438a63e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998646, "uuid": "57f6cbce-e450-450c-afb2-1c8716ed5b65", "value": "kk.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13eb8805-f6ac-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1768987937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987937, "uuid": "4d69261a-3c17-4c5a-b7f0-d98529dbddd6", "comment": "Malware payload (Vidar)", "value": "52fc3ec7a9d9d5f36f12379f951c2988", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987937, "uuid": "3110cd10-37fb-4e99-9fe6-1c6d9b0b570f", "comment": "Malware payload (Vidar)", "value": "83ed271c8185b06101dab842451730e8ddc9f5e8560e7e74a860e6579efa7ba4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987937, "uuid": "e4f8ceda-e425-4061-a2d4-a6212e079b25", "comment": "Malware payload (Vidar)", "value": "5e68d16203db05482b6fa47e81db15c03035c142", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987937, "uuid": "0c64d3a3-aab9-4a4f-9f23-e899960e8da4", "comment": "Malware payload (Vidar)", "value": "9583bfcbfc1efe547238f43562e2152b34aee06b470e513503b457bcbf01135c59a0950c074259b591b14916763356b3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987937, "uuid": "24c9d065-ff6e-4bd7-9ffb-cde5b8002520", "value": "T1D0A64C92FE440725DA9BF23AD4B162852230F184073515D7BAA9179A4C6FAC8173FF2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987937, "uuid": "85a4117a-2eac-4d44-a193-f8a03918a64d", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987937, "uuid": "a6d0013b-9c66-487e-9809-c6c2a1eb1abc", "value": "49152:AKIHTNzrb/T/vO90d7HjmAFd4A64nsfJxLjO5e4hmwYi1IXKhKRMFG/IXZMeXVVK:AknXCGwMGVfWCv4wO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768987937, "uuid": "78ffa39a-76c9-41f5-8e8b-0fe55fde8603", "value": 10121856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768987937, "uuid": "1e7fb32d-e915-4aef-acc0-5ceb664c58f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987937, "uuid": "82ed7dd1-d5f5-4623-bd90-3574bc5dfed1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d19f69c-f719-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769034902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034902, "uuid": "04963c87-3346-4318-9d20-5306e5fef396", "comment": "Malware payload", "value": "2a6d4d3d6a00630ba563fa3f7ef6977d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034902, "uuid": "1b0c6367-bbdb-4fa6-a24b-3c946145d648", "comment": "Malware payload", "value": "83f9407e1aafa9ea82a3320a4bbe85c31ef2cb6517e706b255d47d05b7ad6c73", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034902, "uuid": "988fe966-a63b-417d-9b76-2edba1fe59c0", "comment": "Malware payload", "value": "71206dd0a307b30924dc5d3eca3ac7ccb883bd9b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034902, "uuid": "205b853a-14d1-450c-8047-a889b6f0af1b", "comment": "Malware payload", "value": "f049914d7d7bf0be85ec561bdc5c6bacc422ea8acb5cfb766f1c160e83b46a6168f563e542079395ab7aa71bb9c73fa6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034902, "uuid": "0975cfa4-9f91-4f8c-83c1-c27f863ae8c9", "value": "T1EE019ECF63245EB0C534AF2CB9638A18760BC5D1F46B064859C7083A8EE4B657558F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034902, "uuid": "1576e31e-c7d8-4441-a0aa-66d3cda8e9b3", "value": "12:xVHtVHiVHjIW3VHyebgVH6tSVHnSiXVH4V8VHdWPVHEXVH3bXVHTgOw4jn:AIuvt0sVOxGyjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034902, "uuid": "44736c88-a7a4-496f-a8de-211d83900492", "value": 740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034902, "uuid": "a2ba118e-4005-4615-997a-65843274049f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034902, "uuid": "999d73d9-0863-4589-b860-1b15df95fe9b", "value": "s.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64556562-f6d8-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1769006970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006970, "uuid": "3a1747e0-97e0-41fa-ae12-2b80d0b6eae0", "comment": "Malware payload (PureLogsStealer)", "value": "2d66939837d53fe6210574ffc844f28f", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006970, "uuid": "46927244-67d0-48ff-80ba-7891298cf968", "comment": "Malware payload (PureLogsStealer)", "value": "853cdac85698a8044d4ea80f86297e09c039c0caffc2da15e5f42e66212380df", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006970, "uuid": "c48744c9-bf2f-4a82-acd3-8f1ddeed0507", "comment": "Malware payload (PureLogsStealer)", "value": "ec0542553665a97e53ba04c8e3f2f5d05118f717", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006970, "uuid": "d4716775-9d2c-4d0d-ae6c-e61af6801dbc", "comment": "Malware payload (PureLogsStealer)", "value": "67bbb76de3d9b8b06f1c006bef1ad79ea67ad6b4b7318cf6bac5b9df80c62bdba219b3485caaa7d523d3dfe383e866ea", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006970, "uuid": "5e212786-7a33-4f69-80f5-e04969912993", "value": "T1D3F38D5A63E420A6E4BA577498F603839A31BCB19B7586FF12C4D57E0E336C0A532F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006970, "uuid": "36e2904f-9c97-40f8-ab3f-ef75f1cfc829", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006970, "uuid": "e22d6be2-6632-4c84-826d-e52302803787", "value": "3072:wahKyd2n31B5GWp1icKAArDZz4N9GhbkrNEk1xvTNPCLT:wahOdp0yN90QEeJPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769006970, "uuid": "139c6f23-bb51-4f60-a674-3f033347b4b5", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769006970, "uuid": "e4ca3304-a6f8-4512-9350-376085cb6a19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006970, "uuid": "88cada1e-9860-4ba3-9dd4-d533844c4ff6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7e9394-f718-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769034691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034691, "uuid": "bec16bf4-ad22-4b5a-9590-e375e853af12", "comment": "Malware payload", "value": "1e6bf5a16b7cadcbe173f10f5402b4ea", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034691, "uuid": "68e09294-bcbf-4d42-9c85-686205eebf76", "comment": "Malware payload", "value": "853de318d47ef2b20741dc9c8b4f14fefac5e1f320992773ad88036a588b729d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034691, "uuid": "0ffa9de1-ae52-4c5e-a25b-f72a688a1883", "comment": "Malware payload", "value": "0eb2fbf8c40c518963257f8eff7339ff917d0468", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034691, "uuid": "e0813abe-909d-4960-bf3e-edd98546c04f", "comment": "Malware payload", "value": "cf104026fd59293e28abf11808d6c64dbc4619f8414b58c92acd685dfc572304d328a0738c6d272f5fe96037ee867670", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034691, "uuid": "9ddcd9ce-c4be-4a77-8ede-ec5c8e5bd59e", "value": "T1530100EE58F9755AC4B8CD84B1AE4428D00DDAC53EA3CE9DDC5C24725EC7920B215F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034691, "uuid": "1ed6159a-2219-4dc2-8ab0-f989acf84441", "value": "12:dUPmMU6/K3MUiNIl5wMUfKHMUrMBYjMUuObEMUAj63MUc/MUVSwMU5eTtuMUWljr:obiaNI7gQf7VxytThv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034691, "uuid": "aba88336-85ff-452c-bbb2-b6609ffa6a88", "value": 850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034691, "uuid": "245bccc0-c803-41d4-aa92-890895fc65e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034691, "uuid": "a89c5f94-3be4-4a68-99b7-e6c61d66c6de", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479216da-f699-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768979863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768979863, "uuid": "c4d691dc-3c7d-4f00-9b33-2efb47792c6b", "comment": "Malware payload (Mirai)", "value": "3260260989ce0d9a42180fcbd84e8f7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768979863, "uuid": "e8dca9bd-a186-410e-824d-f0b2007b6b8d", "comment": "Malware payload (Mirai)", "value": "8559a2a4b9ebe51f096a49cce3a70536b9db169bc593351fc25853a1fa329eaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768979863, "uuid": "cd779bee-f5dc-4ab2-ad13-c0ba9e9961f3", "comment": "Malware payload (Mirai)", "value": "d1b6ff446878f77d92ce61dec47ecb8607a34bdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768979863, "uuid": "b2023a69-107b-4ee5-9404-405bc08beae4", "comment": "Malware payload (Mirai)", "value": "47ff70d387dedcf9d9b77771b0b9b4a57ca9d6dfd7e06cb1e28e060854706ee2423ba46e9be8fc9c92639c8b2eadac03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768979863, "uuid": "de584c11-7a9d-4c8f-bf2b-2d69199f6cd5", "value": "T13EF329DBF800D9BAF80AE7374C53490AB130B7B214525A337257397BE93A1E90567F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768979863, "uuid": "f4d8c65f-85d2-4cff-8741-92a23ed3173f", "value": "3072:uwVQzoGGOV59qYhe8byNy69ieeIoPwATv5B3pVKjbiVLg2/ZXrV7HC:VjGNVqCyNx9ieRozRB3hLf/pV7HC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768979863, "uuid": "05ad3015-73cb-4325-bdfe-fe92d9aca36e", "value": 168544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768979863, "uuid": "46bd1e6a-75e3-4277-98f8-d27dcfb1307c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768979863, "uuid": "917cc2e6-da69-4c92-9b0f-35aafa577a89", "value": "Orbt.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71113787-f68e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768975209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768975209, "uuid": "f07a69a2-bc6e-48d4-8ada-f5051c17a0b1", "comment": "Malware payload", "value": "1044323ed585fc865598831f1a06f961", "object_relation": "md5", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768975209, "uuid": "d857fb9f-381b-4296-ae2b-e5ea5cc8c05f", "comment": "Malware payload", "value": "85b3240a8d0a3ea1a3f161ce7bf4a1a391bcb38d5bcc687c1c56ea22a52d7bfd", "object_relation": "sha256", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768975209, "uuid": "0f30149a-d888-453a-9ab7-e3d8f2a6a391", "comment": "Malware payload", "value": "d6ad39a750416ffbcc45d372277b3b629377211a", "object_relation": "sha1", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768975209, "uuid": "d10ba5ec-2ef2-4f10-bdd0-5d9ee3fea1ba", "comment": "Malware payload", "value": "9f5c8befdb1780ac7fa90e8966bee0e1365d1f7f228e98cfdd35e5730886036bc266fa05896494b6dbe21c9f2bf1a94f", "object_relation": "sha3-384", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768975209, "uuid": "259c586c-85b6-4fa6-ba3b-70e5bb8aca4e", "value": "T154816C5D1A8E069525350E33B0F1A688FB40ECA75EEA794036D11E9FEAC23A1DA2D714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768975209, "uuid": "8ece28dc-6228-42a3-87f2-f5fe8e6e501f", "value": "96:4eus3cXQe+dLyBDSC5aaMC5n45Vg3TUL/F8GUQI3r:R3FL0Dn5lMy45a3Te/F+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768975209, "uuid": "1a2dc0bc-ae1e-4fea-b3cc-80a20de7f345", "value": 4012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768975209, "uuid": "333fc406-7607-4386-823a-5df536224d64", "value": "application/x-xz", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768975209, "uuid": "5ea36c7a-66b9-4f6f-96a3-e69cdbfd5e3a", "value": "nPO_tar.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733783e6-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034912, "uuid": "692c132c-9704-4ebc-ba7c-279f1987bf5e", "comment": "Malware payload (Mirai)", "value": "2a07098743362300b3d0c57c9f1ad83d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034912, "uuid": "1652f4d9-222f-44c4-97d6-02fe678ad9c9", "comment": "Malware payload (Mirai)", "value": "86414e5dc4a6412453c70c42545f1b17ca423a27739825730a4aa5c26b57f19c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034912, "uuid": "95af098e-0c33-46f2-b867-32f410707b5f", "comment": "Malware payload (Mirai)", "value": "eb12be3611b59d7b54827f4ded011f8da77b6738", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034912, "uuid": "bcd7bd3d-6731-4a19-80b1-2d903b827c41", "comment": "Malware payload (Mirai)", "value": "7e62c52438b9a55042ddde4430e3ef484590faca9c1fa2ed027a56515c514909e9c3d89fd8a30161f772d2b54ac6ccc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034912, "uuid": "16f34e4a-ffea-47a2-b2ad-cb8bf116d5cd", "value": "T1FDE32881B8829A27C5E623BBFA6D028D332563E4D3DF32178C215F2177C695B0D77A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034912, "uuid": "c619f05e-1178-4c53-97ac-308b274e9e90", "value": "3072:2RAt0txhbKUnimuuQQO4FEalczL+KbiG:2RAMhbsmXQQOgrcHJbiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034912, "uuid": "2074aa58-dca5-45df-be34-104d1d5e5394", "value": 144852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034912, "uuid": "8ea7fc07-55e3-42b9-b455-3494499334e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034912, "uuid": "2e9326a2-5d10-460b-aad9-4ad9d084d984", "value": "4rm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3227ade-f718-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034697, "uuid": "bb8875f4-c4bb-4e4c-b6d5-cc31c8795b72", "comment": "Malware payload (Mirai)", "value": "8c5567b90dcb54183891ffef98fc0452", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034697, "uuid": "ee9c1771-96b6-477d-b3d1-82c66fff3051", "comment": "Malware payload (Mirai)", "value": "8697ad9fe4465d5cbe17a1f08ee606d011a25b4a7d103693e54922836e332a10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034697, "uuid": "3a4aa6f8-8db5-46ae-9027-5aae821cb71f", "comment": "Malware payload (Mirai)", "value": "e5fdc12dce57306734a7fb2831e9b766d6deafb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034697, "uuid": "7be6a4d7-fb24-4dcd-a929-c4ef9956316c", "comment": "Malware payload (Mirai)", "value": "6d09f7d62097cd638792503b5c7e0d3460c7ec1ba6cf2259fefd300b8c016da6870ca0070c088e5db59f0dc074de04a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034697, "uuid": "66b891ca-4aa5-4c2a-9e7a-f66a8aa6cd94", "value": "T1EE234BC49A43EAF5EC120A7420B7FB335B37F07A5159F987D3659932AC42B11A20B2DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034697, "uuid": "32073841-8371-44b0-a2d7-67676cc494aa", "value": "768:c8/MjSNW4GBs82WELXamRfWzqNYeZjcdFEwaK3g+ZdG:c8/MjSNW4GBz3ELFdNYe+dRaK3hZdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034697, "uuid": "7298bb81-4172-4477-88b2-8268028c847a", "value": 46640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034697, "uuid": "8817234a-5336-4542-9af4-3c62364892cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034697, "uuid": "b29ab28e-50c8-4da9-9d10-9dcd757473f8", "value": "StormStresser.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edae8e98-f718-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034688, "uuid": "923ff555-b2e3-4b4f-af50-d2ee4949cfe5", "comment": "Malware payload (Mirai)", "value": "17d7e63a792d60798b1dd286d9b88e60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034688, "uuid": "e870e52c-76cb-4848-b332-1fc511bbdd5b", "comment": "Malware payload (Mirai)", "value": "87e8e56fb63bd00b0ceb34c453a514d35b82754a870f7ee53011470368c25e8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034688, "uuid": "5a679af6-b7ca-48ec-b959-182ade02a8db", "comment": "Malware payload (Mirai)", "value": "5a08733582cbb00c51a127359f1e98f4950d3a40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034688, "uuid": "7517cc2b-8660-4e6b-a84c-236bc5370be7", "comment": "Malware payload (Mirai)", "value": "c1bf44f8f8f79f6af0dd0541e3086bcdbf33c88e7fb0c5cb4b4711879d67980278cadce4e09b22c1f4599752b940bcae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034688, "uuid": "a4f9f86d-c841-4407-933d-6ecb3583741f", "value": "T102334A21AE752E27C0D1F47A12F74724B2E6574E25E8C71E7D720E4EEF04AC061576B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034688, "uuid": "9797f006-8ba0-41f8-ba1c-6c3291b087eb", "value": "768:h00ozmq9oNZFbTldF8867xpAxMHNtoQPRQRmO+HdP4OK7hK:h00smSoNZFXldF8867wMHMeRQRkHdStK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034688, "uuid": "397b0d3b-8718-470b-bae4-3b85e339fbc2", "value": 54600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034688, "uuid": "5b862afc-a4a8-432b-bf0d-31cf877c8a6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034688, "uuid": "143f1982-30b7-4eaa-a9fa-8dfa7c3d0e6a", "value": "StormStresser.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7186c0-f6c7-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1768999660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768999660, "uuid": "6e15d810-d401-4562-b80c-faa950568778", "comment": "Malware payload (Stealc)", "value": "160c6283f45dab4333a892ad268abd90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768999660, "uuid": "7eaa30f1-288a-455b-ae98-b5a7b50fb812", "comment": "Malware payload (Stealc)", "value": "88355b9a8f6d8ce8d6a86c42474e21a3adf4695d678880684bec6c9be8322e26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768999660, "uuid": "fac96473-cac6-4b4a-b168-56a69efce8a2", "comment": "Malware payload (Stealc)", "value": "2e5afb56d9a974dda8cfa14504b4d3204c1bbf4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768999660, "uuid": "88f4f31f-2ed2-4698-a262-be4f08d2d415", "comment": "Malware payload (Stealc)", "value": "320bcc0a7d4a3a261c43d7d4cf7ce9424a329d635fb3656e6d8141b6b023d8be21d28f88077c3b23483da113f9218ff6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768999660, "uuid": "cdc495ea-68c4-484e-b811-8328c74f150c", "value": "T15FD56C176CE049D6C46AA276A8B22192FF75BC580B3137C32E50777A2F7B6C05C36768", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768999660, "uuid": "edc1c443-7540-4962-9f6f-d2a879d7c52f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768999660, "uuid": "59c6c944-fc06-4cb0-80c0-96864f2f1215", "value": "24576:W52B5YwZBeth31wQKDVJm7GfJaMPkmWt3lMfKIXJRvx3nx18CRe/zLcMmjeleN4w:W52jbZgheQMElM3x2CRe/RdvwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768999660, "uuid": "5596bb3a-7cb5-487c-b3d5-694d85a5c5d2", "value": 2964608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768999660, "uuid": "f8f32359-1823-4bcb-b6c6-2fff0a07d582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768999660, "uuid": "61191da9-233c-4740-ab22-833d939e8d27", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa37e303-f6d6-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1769006228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006228, "uuid": "7b49b881-d534-4e89-a6a6-6b675589472c", "comment": "Malware payload (RemcosRAT)", "value": "5634c0bf9b3ed72940c1be7511a22b76", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006228, "uuid": "16ee41c4-b8b0-4457-ba9b-05581adbce6b", "comment": "Malware payload (RemcosRAT)", "value": "8848e239974fd64817049eb47c0fe8075b14a54e02cd5c83362589648c9b2c09", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006228, "uuid": "bd9d38c9-1ae7-4531-88ab-ad5767578a99", "comment": "Malware payload (RemcosRAT)", "value": "7e6a787ccfa9b4ef3bb44951a3d1c2f824da4a3b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006228, "uuid": "e6f654f7-4e14-4e84-9ab3-19755a52c692", "comment": "Malware payload (RemcosRAT)", "value": "f859b01ace3f659d61749ec8550d342d7a40b1f63ed23396a0b98c560533c2f1a08db0b44ec8315380dad32834a57026", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006228, "uuid": "9a659c83-ec2d-4c41-a260-382eb36e46a0", "value": "T14955EC836321A03D9D27921CAA2CB7B3418F9BA1D598CCBE00BA35D4EC3D54C55FACE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006228, "uuid": "aa1f9e38-464b-408e-8d21-c772b44b93c9", "value": "768:CSPMKkTN2ZPbsJ3tIYZuNdH971YxUMYT80KGY47J4YUy/RKT4qBTTW1gQj7nY4lF:6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769006228, "uuid": "c2babfc7-b42b-4c93-97c8-0beb4f2d2c09", "value": 1369181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769006228, "uuid": "0372a996-bf87-4dc0-8a9a-7048baa8007f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006228, "uuid": "def71a77-0cc7-4470-a52c-fab75a10ce6a", "value": "sd9898f9d89g89349894389df8g98df9g839493499g348989d8fg98d.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ab3e36-f666-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768958147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768958147, "uuid": "3fbfe8b3-83ff-4729-9035-e4634a290e66", "comment": "Malware payload (Mirai)", "value": "a7afd9ee45fec73d78230d84641212cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768958147, "uuid": "525337cd-3dcc-4e37-b5ef-130113092f45", "comment": "Malware payload (Mirai)", "value": "894c51ad8d25ed6b6ddc5aa6293d25472df09205524e37a5a850d3951dd3a72c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768958147, "uuid": "9d0b16d7-4005-4c77-bd50-cf0cd87a1af0", "comment": "Malware payload (Mirai)", "value": "2f95e30f9496866a76c32228620654093cc9eec5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768958147, "uuid": "3e884ae3-6fc6-49a9-9e3f-39ef4a10647b", "comment": "Malware payload (Mirai)", "value": "d0567d33195c876b8e12b4c14a0476b4f8e8c76e35e908d8707224c0dbda004f49a712f8a42a916cbd5019264d3fa927", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768958147, "uuid": "5314565f-2986-4632-aee9-8a5a83bc4f50", "value": "T18DD30945F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768958147, "uuid": "b98ded19-878a-4310-91d9-c1f6df953123", "value": "1536:wKdzElm18uZJNb4A4Fa8eAZHk4VB7fzTTfHh+gYSvvqeqZfB20ly+wyw6RNP8TGI:wKp50XU8e947LPHh+zS6thBZ6xKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768958147, "uuid": "45a9a791-eef3-4cda-b1f3-d8fb16fbfa9c", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768958147, "uuid": "5aa31bd6-57b9-4cff-8831-2cb293bbe029", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768958147, "uuid": "7d877736-f465-4e6b-855a-afd95a9ebd65", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b999c103-f6a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768984779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984779, "uuid": "4f2a3d47-38bf-4cb5-9bdb-b5d9970bcd33", "comment": "Malware payload (Mirai)", "value": "1f27c5f23230180287061fd79f9b08b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984779, "uuid": "cf71c755-13ed-4f52-ad9e-de26afb057ab", "comment": "Malware payload (Mirai)", "value": "8a2d2a9af9000a54bbc479ec2471eb6032c435ee6c0754ebedd3781cc2ca3407", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984779, "uuid": "951080a6-949a-47f2-ba83-6dda14bab504", "comment": "Malware payload (Mirai)", "value": "6c266f1fc58c672a31aaa601425f3945e9994631", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984779, "uuid": "69bbf6a0-f6a0-48f2-ac05-e9227ceabe58", "comment": "Malware payload (Mirai)", "value": "f7abc52c078fe7a0dba6e90da2ecc89ca954ace097b24f13615dac6b2c1f933dfb646a5cf893bc2ccf695cb888ee8f46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984779, "uuid": "69227532-d890-4729-8812-647829c9c1cd", "value": "T1BFD32905734C0847D2673EF43A3F27D197AFDA8222A4EA41254F9A8E9172E730589EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984779, "uuid": "eb68a544-23fc-437d-91ec-b463d2e429c8", "value": "1536:iPaEuILt9xzKrd6VsKUWvAMgiZHbBT2hOXxW6qJOCvVz8INly:iCEuILt9xK66KAMU+4F8IDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768984779, "uuid": "8d0ac1d1-4a06-419b-9d7c-94289029e760", "value": 131412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768984779, "uuid": "ec787cbd-79e0-4f57-955f-f239e551e10f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984779, "uuid": "c5b34a32-b0da-46c4-8b92-d8f8849eda0c", "value": "ub8ehJSePAfc9FYqZIT6.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88050ab-f718-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034680, "uuid": "04194e19-de39-4428-a6fd-04643c2c4ae5", "comment": "Malware payload (Mirai)", "value": "4b79515c9b765fee7e465e56c2746618", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034680, "uuid": "b4f46883-bb7c-48fa-84bd-46243afc696f", "comment": "Malware payload (Mirai)", "value": "8ac208bd1de621126acdc03e939eaf2a9e346fb2b19fc707426aca1e83b112c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034680, "uuid": "653aa3f5-e6d4-4cf1-91f9-e4c9b5fe2445", "comment": "Malware payload (Mirai)", "value": "6fb0edd13330efd2cb6a20f20ea4f69683079ad5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034680, "uuid": "42185d02-cd6f-45f0-85c7-6816fa3bd012", "comment": "Malware payload (Mirai)", "value": "58e98af3c65fe91786e9eb4fb24f8c5e6bb0718ca4aa6c1ff9fe973c0e66995a931604ca15bdf217db94bf98e43d0463", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034680, "uuid": "920af39d-1fa2-458b-b449-1e516972dd0a", "value": "T1A0A31952BD428F13C5C222F6B7AF068D3B126B69D6EA3242DC20BF5133864DB0D77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034680, "uuid": "08b89cf7-a3bc-4235-a709-1416cb1fae47", "value": "1536:hbvFo7ww2+sD3k1iLsVyjxrDbxFEtMfAOnKpM+w66u46bvcY+Pkr:hbvFo7P2+sT1jxrDPE6fAZPH68Ukr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034680, "uuid": "726bf7c2-f549-4681-9b40-76e2aaf87197", "value": 100628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034680, "uuid": "0df9508f-e28d-404a-92b7-b238112ef6c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034680, "uuid": "28841303-a64f-4a85-8bbc-831664a5f352", "value": "titanjr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99a5efe-f6cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769003274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003274, "uuid": "0e8376dc-f493-445e-baa7-ad1697a8fd9c", "comment": "Malware payload (Mirai)", "value": "2e739cf0805ef5311e29be90753d220d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003274, "uuid": "69b6c15f-ec06-4242-bfea-5a7b01c36b2a", "comment": "Malware payload (Mirai)", "value": "8af63d8670d02852e25c3c55911512cb662f0150a54636c9f442965b2dd27088", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003274, "uuid": "fb8e1635-e0e8-4abd-b95a-01bdc31c7be3", "comment": "Malware payload (Mirai)", "value": "75a2f9cc6686955ff3f4b18d453d59c022ee7198", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003274, "uuid": "b3d3e2d7-9c75-4b41-a0fa-8753240592b3", "comment": "Malware payload (Mirai)", "value": "4b02c756c65212595f4155b347ea707b8337939cb4542d2141867eee7a8349e84797bf3aadf4400304c215e7c9d229e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003274, "uuid": "cc6ce0a8-cbc2-4561-9a1c-84ddc85724b1", "value": "T1C7148120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003274, "uuid": "fb20d4b8-5abc-4ad9-8522-b94b8d710974", "value": "3072:BcHZcggFy1tJmajThwnKBDMOzsjJjL1lCR0UKG:BcYFAJ9/hjzsdjy7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769003274, "uuid": "42ac0993-b542-4325-b85d-7379fe423b9a", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769003274, "uuid": "969fdffe-82f9-4731-bc9c-31a1ff3a8a65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003274, "uuid": "db6aa50f-a9b0-40e7-80a2-c333e9a621f4", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0a05d9-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768998638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998638, "uuid": "4718198e-0f25-462e-969b-7be28dee81af", "comment": "Malware payload (Mirai)", "value": "2ac398a425afeabd6aeb59dc214be10d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998638, "uuid": "a256b841-b2b5-4eba-84c8-2ec0b41cfedf", "comment": "Malware payload (Mirai)", "value": "8b3387630ec307d58e78d21f0e52da62f0ff801a9d07018fa63bc732074974eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998638, "uuid": "adcf845c-88be-465e-b5cb-7d83d2268b58", "comment": "Malware payload (Mirai)", "value": "4b40d87b2bebda632fa7e7ea53d931648450fd23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998638, "uuid": "75e3da71-39b6-4d41-9882-943b6974fc72", "comment": "Malware payload (Mirai)", "value": "e8c36594fd3675fabb2138e8d1a97537422b87bc0ad4d7040949745be0622bfa6dbe556247fba74759209bc427648951", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998638, "uuid": "d3c32130-160e-4efd-97fe-a724174f2f9b", "value": "T17E730894F880DE71C6D5657AFA5E568833630B78C3DA32068D10AF3527F796B4F3A902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998638, "uuid": "11901ef2-340e-493a-824f-c0e53a66e0d3", "value": "1536:zjLwf7vpB8JYbuCbOHKDzgJfgbGtr0CQcMDu3Osl+F3q8TXzeUyoG317xBgOgvp5:zjLwDvpB8ibuCiH0sAT9sKDze/F/gGMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998638, "uuid": "72ed8a52-4245-4d81-b45c-ca38332f4e00", "value": 75020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998638, "uuid": "c727e013-1ebc-4686-8ea8-2cce21e2f3eb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998638, "uuid": "b020d183-127c-43df-ba25-8fe5952f3e79", "value": "life5.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9068559-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768998603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998603, "uuid": "5b35a0fe-2701-4d45-8a55-48e5f3381f06", "comment": "Malware payload (Mirai)", "value": "f760e58c43f510e39e0d0d5b2ffc89b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998603, "uuid": "48ef1b6a-0a69-4a50-bd48-805e696c3fae", "comment": "Malware payload (Mirai)", "value": "8b78ca9d9451324264d707570cbf1a04affc229d69fc281e801c5047a7228a39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998603, "uuid": "3d7cc394-c54d-47b0-bbb0-249512a99910", "comment": "Malware payload (Mirai)", "value": "db59a22fac0f0b1e64c93afc954100d4484c5b94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998603, "uuid": "7a601480-3cd1-4d38-ad14-9fc0d9592650", "comment": "Malware payload (Mirai)", "value": "9fc131debdbce3cdb45254d6fce29f144a4bf2c0fb687e45f5fd327dd8d0c2c229280f188c4b65a0ab9806d3f2be4f30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998603, "uuid": "9a7ee464-ed7d-4ad9-a3d8-b7d27fd1b1f4", "value": "T1CB048E11FB1C2553C0825D305E770367A335D6818AB9E609A60C7B252B33AF65E87BFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998603, "uuid": "deca0c74-0f2a-4b77-897f-365d470cdc15", "value": "3072:26PqB0y5ywVIvLsAIZtJtuhAra+nQiP4Bqjy156oEWcuDEYlHhk:2XB02HyQAIZtJtuhAra+nQArukYjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998603, "uuid": "283fe833-990a-4e82-80cb-807b6bc3bed8", "value": 175188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998603, "uuid": "e61368e7-07b3-4aa6-a906-f76382e16aa1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998603, "uuid": "dffc1b27-419f-4456-b70e-ae89fa50da4f", "value": "titan.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f740a57b-f6df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769010223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010223, "uuid": "9c1332f9-c3e2-4562-8171-b97782ac3688", "comment": "Malware payload (Mirai)", "value": "3f617d1c9f8ada459a44c0a7007bc3fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010223, "uuid": "3756660b-de5b-4113-9442-4a5f7c84efb6", "comment": "Malware payload (Mirai)", "value": "8b8ff44220ed546ee9e4b70226d3fce06bc70e01484c33c0b2c5c52df8ea21ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010223, "uuid": "c2d43662-0800-44fd-a775-145acd61adba", "comment": "Malware payload (Mirai)", "value": "10aa99fa076c48027953b35b103bea6864a3b924", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010223, "uuid": "9d4afefd-5708-459a-aabd-d69d0e0258e0", "comment": "Malware payload (Mirai)", "value": "25bd353136fc158f4d8f5fd8f154ffd54420b7de374e155cb8575be075691244763a7f89c11e7d507e9fc42c8bf62e01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010223, "uuid": "130d789e-cf20-4a5a-b295-a19bdb9a602c", "value": "T19DC31B45FC504B23C6C612BBFB5E428D3B2A17E8D3EE720399255F60378685B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010223, "uuid": "3b0ac467-f79b-4353-a5e8-0133c4e13a59", "value": "1536:p3Ka0rG5yC/cMChygtXOBdWFAcJX4VlgXTAjcFAaUGxrf851WhXVVlnKwywEReQe:5KaprMh7ROXWFh4UXwcFAa5xovW5kKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769010223, "uuid": "b4d50316-2ad6-4c1d-98fb-8b72c83a928b", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769010223, "uuid": "9974f357-5b77-4309-9ff0-e00176bed507", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010223, "uuid": "46415d44-b9ec-488e-8ab2-be52410e4e08", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc695ed-f702-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769024917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769024917, "uuid": "054846b5-2588-4146-b601-1e5ea5b79072", "comment": "Malware payload", "value": "9f525e1c222ce4787f37e968895afa2b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769024917, "uuid": "c0ab2981-76e3-454d-90d9-e57deb8b7da8", "comment": "Malware payload", "value": "8d02d26723c270467bb9877b815726611701a744fcae335f5f61fc2a9eba1193", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769024917, "uuid": "a5973aae-4165-4c04-9e99-471c7a6bfb82", "comment": "Malware payload", "value": "a0f40c2f0bdad563eed28a78f885bd8480c2ba9b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769024917, "uuid": "fb3a9ed2-42db-40e7-973d-b5e8134ad8bf", "comment": "Malware payload", "value": "346be1a5edaba4baa5ed4a733fcdf00a3fd7a3317ae2853822591a5d804facb22a84158c211f53ca6bc46df27bcb1315", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769024917, "uuid": "3b6414ae-5623-41d8-af8b-e7250958b1ba", "value": "T155570219D15F403ACA57D67928EF4BE6FF30829F8220571F23F839198CD2B990B62759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769024917, "uuid": "66d04160-c9af-4306-a8b0-12b47cd7ed88", "value": "786432:LDNcvQGN5q+feL1rC8Mk4CrpPXjstm97IDEzjmzS:LDNc4Y55eLVC8MkDtPXWu7I4zjES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769024917, "uuid": "0422b9b2-f8f0-4326-98b4-2331b82ac57e", "value": 29332381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769024917, "uuid": "49d7bb47-ee3f-465f-8d67-09dc5b0bf6fe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769024917, "uuid": "26ed94ce-f964-417a-8507-9fc66c99733b", "value": "soft.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e1c719-f69b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980881, "uuid": "e56ba1e8-ee31-429d-badd-f971efe98a65", "comment": "Malware payload (Mirai)", "value": "6748b88c1273ee54cfc06b50c07c819c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980881, "uuid": "c0a13a6b-9afc-4185-9370-aa6df0d3c1f8", "comment": "Malware payload (Mirai)", "value": "8d3676288c62e00648f9549e1cf06866dcd929d596d68fef98ef184ac6da6042", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980881, "uuid": "a6e099b5-bcef-454c-b8ea-72a4b3bc7620", "comment": "Malware payload (Mirai)", "value": "2f317f6a48ef69e48101b1c98dafb39587e5646e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980881, "uuid": "885dff5e-0d59-4222-835a-66ca2271d0b2", "comment": "Malware payload (Mirai)", "value": "1416142269b76286a609e0ff0b0564f9c49b994238ff2a6d0a235e35e93f8e492afd10ad5d99a1b4cdb6fa2e058828f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980881, "uuid": "e90e73e9-1e97-41e3-8bc9-06830e962547", "value": "T16D834B41FD815A12CAD42377FB6E018D336653E8D2FE72139E216F11B7CA81B0E6B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980881, "uuid": "65ef1d1b-5e18-497d-b57c-41dfb6d3f2d5", "value": "1536:vnLoGfXnSG57jn21NaeAW8nf9K0UUc04dNwY/eMgjJO/wbZnU:vnLoGf7/aaZn1ZUUcb/wAwbZnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980881, "uuid": "99422478-bf40-4866-bc46-0435ed388d3d", "value": 81208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980881, "uuid": "bbc3b4a0-46b3-40c6-a5de-51b557206b37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980881, "uuid": "fb8bc3cc-6b21-4b28-9634-f964e95319f6", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff4fcf8-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1769034907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034907, "uuid": "fbe41932-fb89-419a-a93b-915ccdbf2960", "comment": "Malware payload (RemcosRAT)", "value": "f7423d210f1756163d2d44771821994c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034907, "uuid": "e617699b-7ced-42a2-a80d-91dc8e584a5d", "comment": "Malware payload (RemcosRAT)", "value": "8d6d8acf9fbfc27ef473eba3eedaa91054dc778e425d9d6efe7cae023db4a047", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034907, "uuid": "4e38c3cb-fc77-4f87-87ac-6598f18759e8", "comment": "Malware payload (RemcosRAT)", "value": "d1bbfcb5a081a4c9655a59c754c721552ca66987", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034907, "uuid": "07cf5d72-4abc-42fd-807d-36ed241c32ae", "comment": "Malware payload (RemcosRAT)", "value": "e04d30aba9007eaf3e52b1e7b60c89e595547eea2c18a09ac4c9a57974a53651450bef58cbab59df882878c666c63dff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034907, "uuid": "34b463bf-77df-4cf7-ab9e-4e4b3c6e4b45", "value": "T107B4B001B9E2C172D57654300D2AE776DEBCBD2028358D7BB3D60D57FE30190AA39AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034907, "uuid": "409909d3-8eb2-4973-bb1f-fc405428499a", "value": "41e05d591d7d93bdd5bc6d5da04da74b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034907, "uuid": "d7806c0e-4890-42ef-8586-5c9f1403b2a0", "value": "6144:cIlSCa0RPvRz+n8Qr1D0ZGESuHabmvHOE4mCp6qtydBnP+Y4+3sAORZ/FXvXc6YJ:c200OFp+G0imvHn3Cp6qyBP+YdsvZ/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034907, "uuid": "4c136a39-ba11-4449-9122-15f9f2e24613", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034907, "uuid": "74284050-d9ce-4efa-859a-e9b627f47e4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034907, "uuid": "c2a79bc6-f8ea-459f-90c1-fffe21520ba3", "value": "8d6d8acf9fbfc27ef473eba3eedaa91054dc778e425d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b498c2dd-f69a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980476, "uuid": "29c15625-88af-445f-ba77-4313396501b6", "comment": "Malware payload (Mirai)", "value": "d27b2a4108467530f686b6b972c26edf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980476, "uuid": "48abc48e-766a-416f-b217-7864248b2163", "comment": "Malware payload (Mirai)", "value": "90608edd8eabac855f3eb52ead9a2c245f3266aa09fa4e4eac2b677d97414e5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980476, "uuid": "0ca2a5ec-07a9-4b9c-8a11-b7f95c553202", "comment": "Malware payload (Mirai)", "value": "8a7abfd8291846bb051483a1712b57522ae96465", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980476, "uuid": "6631a0a3-68e8-4c68-aaa1-e1503e8ff2fb", "comment": "Malware payload (Mirai)", "value": "c01cf21d3347bf0babc1eafcbf23061f7af9a526bd7a9c148d76c4d260a27e6fc4ffc185c758116937ef78a0e0dd5e02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980476, "uuid": "199d76eb-a3f7-4676-9e66-a8bed10863d4", "value": "T1D4243A46EB804B13C09727BEF69F42153333DB9497E77306A929ABB03B837994F62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980476, "uuid": "5cc8c031-ed50-49d3-a6cb-cdbff559fa06", "value": "6144:nGJwy+Wyf/aUtRk9cEckNLYMf3nJ/V/Gq4V3:GJaBf/aGRk9cEPdJD/34p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980476, "uuid": "cd445f83-5f01-4f9f-bef0-3dbfc2b56bec", "value": 221016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980476, "uuid": "0bf5ba46-946c-41fc-928a-bba58fc92a8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980476, "uuid": "89b2f51f-b687-463d-985e-28f7d1b8f4c3", "value": "Orbt.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "023cedc1-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034723, "uuid": "3eaaa842-f654-4859-9a57-608798844e54", "comment": "Malware payload (Mirai)", "value": "dcbe918b32ea7b46b120d0a22f3c6501", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034723, "uuid": "10c96393-cdac-4eb8-bd76-5eb289e69a5e", "comment": "Malware payload (Mirai)", "value": "911f54971bce91bd384ad1e66296f0baab373b3bfdba78a21baa0b6fd1f7f358", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034723, "uuid": "3a878e8e-5615-4d37-a0e5-81a80f0bb28b", "comment": "Malware payload (Mirai)", "value": "32a4731a33d7d7d8fdf143ed3530adddaf504a5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034723, "uuid": "78b2cec8-b565-49ed-86dd-9ad7c77954f8", "comment": "Malware payload (Mirai)", "value": "24cd716cadec5e645c59d0a7373ec622c2ecf7217d4adb2c46adfff682384fe6cedda7d1236f28652da9bb18736ffbbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034723, "uuid": "ff6c623b-5627-48a8-b024-361936bed8ea", "value": "T17E934A22BA7A1D27C0C1A47A21F74B21F6F247DA25E8891B7DB10D8DBF256402157FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034723, "uuid": "50789f91-3620-46ab-9632-e1d1e9466227", "value": "1536:ZOXSQ1pxh1OIKtsasJZ7tlHwRhOYCF0VFtqSMGN+b5E8ZnkaZRthFs/:ci+p/g4ZYAaFESMGNOE8RJm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034723, "uuid": "2c1ac48d-d62c-4260-b34e-9e5491495797", "value": 96528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034723, "uuid": "8cbdb1cd-7839-44ce-8a77-da73c5957ce6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034723, "uuid": "f826c4fc-29f8-442a-ab9b-0b726567465b", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b41ad7-f6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768984927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984927, "uuid": "43cb5f5a-66f1-4c68-a57f-f38fedd1b15b", "comment": "Malware payload (Mirai)", "value": "a7708c7a504ea8ab04532de1c0e8d9d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984927, "uuid": "b7b5dfbf-26b0-4d62-9ae4-d7b0f8870084", "comment": "Malware payload (Mirai)", "value": "9144f6f4e70bf9aa0c81f776a03c6db4a24b20f1ea8d2bbca61c2e4afacfd753", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984927, "uuid": "827e5602-0522-45ef-8350-85c35eb20262", "comment": "Malware payload (Mirai)", "value": "f0dba5c8b002511de91a95fdb03dc5bc2bbfb7c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984927, "uuid": "39dfcc38-f69e-402e-b243-30c11fdf8ca7", "comment": "Malware payload (Mirai)", "value": "7431fff1b48474ddf36c56c410671e357c9b617a9f4868cc42ed4d364afdfe6cd5958bbf472989c0fe68fedcae3ef018", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984927, "uuid": "7c9ef7b8-9e1b-4387-86cd-cbbcddde146b", "value": "T152835C89FB43E4F0D94A0AB0116FF73AB671DD361134DD3ADB84BD63DC61A12A09626C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984927, "uuid": "7bff9e08-4688-40b8-8e42-4873a231c584", "value": "1536:f56Bs4fSg5Z+pvwYcGsQRnS8GMoRusUi31kP3zCoOvYhwbZnfr:Bh8zY4fxQRS8c/W7CDIwbZnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768984927, "uuid": "c4865f5e-a1a8-46b7-ac9b-ab02d20e25d8", "value": 83708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768984927, "uuid": "f232c9e3-2b6b-48db-beb2-04331344982e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984927, "uuid": "25002eaf-b4e8-44a3-9c02-a00c17625b05", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5bea89-f6a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768983843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983843, "uuid": "0295cff2-6a3c-4521-8226-33401a7401fe", "comment": "Malware payload (Mirai)", "value": "13c15eaf8f4e9faf51ba2bfa07b452ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983843, "uuid": "18da2d2d-7e8d-4573-a6f7-80b1888e243e", "comment": "Malware payload (Mirai)", "value": "9174f7f76a63123654b1d36f740550be451881eb68f0ce9dd36ba6530db264d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983843, "uuid": "2d9cbdad-440e-4830-8eb0-bd0abfd174da", "comment": "Malware payload (Mirai)", "value": "2146d1dcfee1e99cb3c754bbcb85bea744131439", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983843, "uuid": "6ac0f3c7-d75b-4a60-8b54-66a244db07d7", "comment": "Malware payload (Mirai)", "value": "bc43b7487a49ed3bd0e75e73a5b365bfbaf3f3eb6a5edbfd70681d0a0405252e4a6e11983eacf1944c478b4b6890e3ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983843, "uuid": "9d1dc000-3307-4639-91e0-58bd008cd62b", "value": "T1BF638DF5C62E4A64C0484678A8F19A342B23B50897B22DF5DDC78D56500FEECBD147EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983843, "uuid": "af1b8862-73e8-4ea6-b6e2-3aeb81379b26", "value": "1536:z1VFfVk3bVsOV7luKb4x2uUcbC7B3vZCH71:TFfVk3bV1V5u4pcbC7B3vZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768983843, "uuid": "518c5115-75ae-4b55-bd23-1c42d37617a4", "value": 68000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768983843, "uuid": "df30b27a-0112-4ed8-84e8-5e09e34790ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983843, "uuid": "0227c23f-e075-48b3-9693-997272ad3a3f", "value": "sdxkzX_UXA229x.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3782d6bd-f67c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768967381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768967381, "uuid": "304c31dd-bce6-47b7-97bf-939a6c50b5a7", "comment": "Malware payload (Mirai)", "value": "d53e6425ed4737d7ae8b7b73aee1bbe0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768967381, "uuid": "1476b8b2-0f4d-4987-9697-90983fff83b0", "comment": "Malware payload (Mirai)", "value": "92488635744d2b775edb6c085344bbb58f61fdfb191166dddf2b4e7c7b1b142c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768967381, "uuid": "c48c110e-42e7-4317-a99b-ec7b2c5d5de2", "comment": "Malware payload (Mirai)", "value": "18d94f66207eacd41b04a85e8b0f11e5cb30e5a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768967381, "uuid": "018809ee-e7f7-41b2-9d6e-861fca92db4b", "comment": "Malware payload (Mirai)", "value": "727049f95fcca20b9b359a5932b190e76a2896ffc14d4efb30c439c227570aa5f04400c5cb830bfbc9b7a1252409cb08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768967381, "uuid": "f4708f7f-8864-481f-a4ae-efc158a819fb", "value": "T14A933A46BC814E11C9C503BAFE2E118D331357BCE2EE72229D106F24B7CA96B0E7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768967381, "uuid": "1dc79a04-73fc-4dd5-8c86-83c3cc7c71ea", "value": "1536:r8BnE/Cir+fPyYqOledZ+ONmhprR8SayXpQQMLim6Cav/kNPr7MS5pY5UwbZnZ:rNCiKSY9erNNkR8Sat6Jv/kNPrASLTwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768967381, "uuid": "adfe2ff5-5880-498d-8a23-5945b7c633c0", "value": 91380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768967381, "uuid": "2e96b3ae-6bca-4b4a-83d4-cb65bb5de56e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768967381, "uuid": "eed1bd45-1253-4ecd-a214-1eaeb5d7b3bb", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e778115-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034958, "uuid": "e4dc7a53-dc2f-4328-a310-7f0975028f2e", "comment": "Malware payload (Mirai)", "value": "c631ca2100e474d675425b1fce7ad109", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034958, "uuid": "a1bbc62a-963f-4ca6-8ec0-7892a99f9b19", "comment": "Malware payload (Mirai)", "value": "92c26520a7c037036c0ef2c8e09618a905b41ee64da4391b3e07535888e20e40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034958, "uuid": "2a48ce00-48ad-47ff-a774-969ec4a6167c", "comment": "Malware payload (Mirai)", "value": "74b177d628b5193d4c236ab7891cc48b39f2afdf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034958, "uuid": "c2d8530f-6fb0-41e9-a6a6-a37b16ad4544", "comment": "Malware payload (Mirai)", "value": "9bb785fc2b5b62883ec0828afd886a61164331fce97da00b8c635d9fb3ef182148d46d1c21dc78305de551d846d0e0bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034958, "uuid": "66d1a71c-7889-402e-9364-b8b4d1019d2c", "value": "T1D5D32A06730C0A47D2632EB03A3F67D197AF9AC121E4F640355FAB8A95B1E335586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034958, "uuid": "d3ae3d0b-d7eb-4287-a6a0-33b74e2e5f76", "value": "1536:troGHNTUZNilIBUiCxfytmtewMDNna/w4o7lbEJvAhh3rp+JuQfqAg87V3p:3mNUiCxttqCwZ7lLhrIx3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034958, "uuid": "66d5b12c-8d49-4778-a25e-be09b0683438", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034958, "uuid": "068ecca7-260a-4e3b-ae15-bfb2df9d5777", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034958, "uuid": "cc642744-f724-427f-a17c-d467679181d8", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5567020d-f6a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768984611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984611, "uuid": "7306653d-8005-4dfa-bdf2-a1cc50fba8d5", "comment": "Malware payload (Mirai)", "value": "71f28ca6c0738dc6149ab1ba404b6c65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984611, "uuid": "fe0ae8ca-e2c0-428b-80dc-256e937f1fbe", "comment": "Malware payload (Mirai)", "value": "94128c4fbc307381663168ed550d070ba13dfeeb3a33e292328d3072d6780429", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984611, "uuid": "411ee49b-5bd2-43da-a198-04ddf57dbf1b", "comment": "Malware payload (Mirai)", "value": "070ad4f2aae4d2c61203f680cf281bece473c03a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984611, "uuid": "56cd0c18-7ba6-4aeb-ba32-615b5d1931d5", "comment": "Malware payload (Mirai)", "value": "203bddcb270f9cecf578ed88f79c1379f779d8a7e6e89d9240a9aa8de3831e4f972cba4e3879a1abee0dd53375cda811", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984611, "uuid": "c07739e3-0877-4e06-a706-fafabcf868ae", "value": "T159A34AC8E68FD4F5E94210712026BB36C773ED29113EEA47E3AD9A3598A3480D71B75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984611, "uuid": "7e7e6908-3feb-4de5-9eef-e6f186c6aa54", "value": "1536:RDJy+rpz0sN76xb0mZPToRXaCKHWgkC8ZSb1CCwMfANSaDEM:tJFrpIsN7UTURXa/vkC80ZF3IkKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768984611, "uuid": "3a195dfd-1467-4bd2-b513-f26ecd102a25", "value": 105068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768984611, "uuid": "532bfca2-fe26-4468-8bf3-2325ca6ebc41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984611, "uuid": "fc625c4b-c2ee-4715-b827-ba476c2c95d4", "value": "Orbt.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fd642f-f69b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980956, "uuid": "e3c46c88-39b5-4448-bd4c-678be0630afd", "comment": "Malware payload (Mirai)", "value": "2bf5f49e66e4b8d62fc5b5f7863da4ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980956, "uuid": "87a03cd9-6cce-4765-af66-1205bfa65423", "comment": "Malware payload (Mirai)", "value": "9415577d91db635b0420048f83a21121dc5b4e8c173ad5b39ba4924dce1a5273", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980956, "uuid": "5fb19ab5-f760-4d2d-a269-566ce6401def", "comment": "Malware payload (Mirai)", "value": "56c46bf2832819c0606d035f11d29df8aa5a4217", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980956, "uuid": "897f094f-c9a3-4366-8124-15881622835f", "comment": "Malware payload (Mirai)", "value": "c8da51b6c46d39ae61c882a612bbef0505cbee63334a020dde07dc34011e3865750c66fdc0d56235c6d1e60868e886ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980956, "uuid": "cc009dd1-6c6d-474b-a45f-63f241069db4", "value": "T1C4D32905734C0947D2673EF03A3F27D197AFDA8221A8EA41254F9A8E9172E730589EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980956, "uuid": "c65d8f11-8ada-4efc-95b2-1ad843a2f6ca", "value": "1536:E+FKKbpduILR9xPKrdy6NK0SvAMgjZHbBTJh3O9WiqJOCvVz8I4U1:rIK7uILR9xmymKkMsyQF8Ib1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980956, "uuid": "850666be-bf53-4371-8790-8083afbbeb35", "value": 131412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980956, "uuid": "2b7f3d74-4840-4a93-9e4c-ba0e7eb9c515", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980956, "uuid": "3e7a94c3-c517-4011-ad10-422d86526126", "value": "ub8ehJSePAfc9FYqZIT6.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8035d82e-f703-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769025485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769025485, "uuid": "60a2233b-bbd2-4275-8e68-8238121336c2", "comment": "Malware payload", "value": "bbe45fdb41de571a643b7708cef5dd59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769025485, "uuid": "9f817cd5-60e9-4703-8355-1124b163c1e8", "comment": "Malware payload", "value": "9457a4add92725ab3678b301c9e40851ce4218f2d80dc1e51687ad355dcfea4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769025485, "uuid": "821f485c-9d63-47c3-bd1a-4b9c81fe69ff", "comment": "Malware payload", "value": "f31177880a7d3d3e9dfb326b721209ffbb61b667", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769025485, "uuid": "74260968-64ca-4fb8-8958-02ca8f34a1b0", "comment": "Malware payload", "value": "8c5ae20a2d229c0b9de1b416dce1da502fa89f2181ced35841174559078871fa9f681df678533816afef5ae61a96499c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769025485, "uuid": "558fd36a-9eb2-4cb8-abc1-f77ebdaad0c7", "value": "T1EF665BA2BA4046A5D59BF239E8B191897330F048073501D77B691BA54DBBBC8173FB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769025485, "uuid": "57bdabd7-b17c-4114-aad0-d96a4c636eb4", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769025485, "uuid": "f0b4d948-05f7-420c-9167-3dc827eeeeee", "value": "49152:i9Qi+Crrb/T8vO90d7HjmAFd4A64nsfJc5m20zNjyuLbkSBK2xK1s4xdCCCEMKyY:269AgREsrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769025485, "uuid": "46d0c2a2-994e-41e4-810a-d8c263c290e3", "value": 6763136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769025485, "uuid": "ecebfa34-f9f5-4200-aa75-2d4b4cb37c8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769025485, "uuid": "05e0085d-9dba-4ee9-98b0-e8f4dabc09f4", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d13c431-f6a9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768986879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986879, "uuid": "6e4e24a6-d62b-4e8e-936b-9235584e94cc", "comment": "Malware payload (Mirai)", "value": "113e524167807be50b1c857136bc4273", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986879, "uuid": "335a35e0-f4b9-4f27-a060-78b407f12756", "comment": "Malware payload (Mirai)", "value": "9525a55a76aef8e3a463acf01c34dc6cdc49b182c8647186c6f54a541ecc8301", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986879, "uuid": "d31b68b2-2451-4f64-80a2-3cde0aed70c5", "comment": "Malware payload (Mirai)", "value": "3b124596a25affb6e32b777511e67111eaf3d623", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986879, "uuid": "e957d626-467d-441f-a98c-7aed9c6c2159", "comment": "Malware payload (Mirai)", "value": "5bc8676f958ef1580053212b0cc9eb37d14f2b381339dfa81c517becaac003d2273f95e54f67231b08bfa1745da6e745", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986879, "uuid": "a76b0c83-f01e-474f-9c0c-91eb4246d8de", "value": "T1A35349C09543EDF5CC1546B72477BB358B32F53B103AE9A3D399ADB3AC40642A4272AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986879, "uuid": "76d59ed1-79c4-4a4a-88b0-21b3fa7d0ab7", "value": "1536:c19GmtTLekTDVpcD/bmixBEUlnxsqVqGxBwh+Cvci6XiHFN0mMmMm0:m9rTLekTDVpe/bmixBEWnxsmVBwh+Cv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768986879, "uuid": "cf27849b-9954-43fa-b6bb-68ac8d7f59b0", "value": 66576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768986879, "uuid": "d6e2a58f-8c4a-4be0-af02-ceee01880e10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986879, "uuid": "a35cd630-ae83-4d33-b74d-72ff9b0b2346", "value": "sdxkzX_UXA229x.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8f6f14-f6a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768983841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983841, "uuid": "baad2464-0857-42a1-9da4-b73603790de4", "comment": "Malware payload (Mirai)", "value": "6d9d092efd9f2379739eb96f1a4606e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983841, "uuid": "ecfc3232-b9eb-4276-b852-ff21d702b29c", "comment": "Malware payload (Mirai)", "value": "95310aaee0606753bc2cd5e9e9b4cbf7ac79e5f8eb27eec6de99e40f4838a246", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983841, "uuid": "3fb51dbf-2d2b-4d9a-aa6d-4e83b01c77b6", "comment": "Malware payload (Mirai)", "value": "8e768746c9e14d751808ac4df69d20d2926aef3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983841, "uuid": "d62fd133-493e-442f-9be7-ec0a3ed7b00a", "comment": "Malware payload (Mirai)", "value": "29e3f18e75e68c272ecd5c10805180cc0f33cfabdba0cd1eb9d37e360a47cf51814429c96a919f61ae58608080f13214", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983841, "uuid": "ee3118bc-f7bc-4f93-83de-eb03532b7317", "value": "T1CBF22903127D6517D4E8A63902F39757F2DA7A9CA054871F7E3A0ECBBA613D00F6A670", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983841, "uuid": "90dbd657-d31d-4625-bf4e-91653d812151", "value": "768:vyQIH1RjyptP7ehBxXOIma2MIh34DqSM2/Sb8B6YPr:vyQIH1RjyptP7e/lO3LkBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768983841, "uuid": "3be5e9bc-153b-4e24-9924-6f5a4fd6f8fa", "value": 34648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768983841, "uuid": "ce8c40c6-0875-48e3-8ab0-1107d3865089", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983841, "uuid": "c4ad10ad-7fa1-4de2-91d6-e4bb7d79ed3c", "value": "ub8ehJSePAfc9FYqZIT6.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cdeb751-f6a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768984570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984570, "uuid": "94653955-147a-4f94-b118-422e372ef3b3", "comment": "Malware payload (Mirai)", "value": "3e927dbdc2072acecf7cb86908b3b9d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984570, "uuid": "fc8065c2-536d-4b9b-b184-32d49f6a86b5", "comment": "Malware payload (Mirai)", "value": "955c8992a9f4377d52d5eaa260768bcf9219d965d69e335ba8a7bec2547116e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984570, "uuid": "e220e576-70a0-4fc2-aa78-f6b4d503ed00", "comment": "Malware payload (Mirai)", "value": "8854dcc4d4aa5586ce2de2121f6adaa3c448a487", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984570, "uuid": "2f11da95-a685-41cd-838e-19e12a84e94a", "comment": "Malware payload (Mirai)", "value": "e0a470eb9531532aa781e6b91e245ba768a368a09d0e9a3b898aad6b29050a425ff509dc48ad862541fb554a426bff02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984570, "uuid": "00fa5b9b-fd8b-476f-ada5-ec566ee874d9", "value": "T11413F18995CC571BE05E75354E9E5A010A20704DACA610F3CF4D7E295C9FB1E8A3CBEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984570, "uuid": "108a12ac-72b2-43c4-8a60-d94032d17ff4", "value": "768:vxg+LkTsOk5HHUS2+LPa2KtbkAtSDPKqZqzfGcw60ABHotJ7KMlJMbtt0twnbcuG:vxHB7HHUfuaV+AYKqZ2xL0motJz323n6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768984570, "uuid": "9ab1ede7-4512-47b6-a68f-6f267ebddcbc", "value": 44088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768984570, "uuid": "7ddecdac-9e68-4524-907a-2a09644b997a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984570, "uuid": "e4d20f32-f71d-4056-862e-dd53eed75f2c", "value": "Orbt.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb23c336-f6aa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768987439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987439, "uuid": "c64651c7-fd2a-45a0-9878-700e9bbf4158", "comment": "Malware payload", "value": "76a89529b7b40c92348936dfa36c31aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "metamorphic", "colour": "#2AA295", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987439, "uuid": "8699e448-e62d-419e-b132-0f7661af30f8", "comment": "Malware payload", "value": "95d0259be4a21ea6270862128cdaf6fa208e705384c17a1732058bba124758f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "metamorphic", "colour": "#2AA295", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987439, "uuid": "85d82050-c39f-4e53-b131-f398433a93e9", "comment": "Malware payload", "value": "14455ed77c77ffb75c5227fbe8cf6d3e55bdfbcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "metamorphic", "colour": "#2AA295", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987439, "uuid": "f9a1e82b-1468-416d-b503-0f54b2a79f7c", "comment": "Malware payload", "value": "4980a54aa5a83f902e8cbbf80fa1dc7705c3b6f38ba10b5518d00c1138edc296d03547ef4623c513782840feee5f914e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "metamorphic", "colour": "#2AA295", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987439, "uuid": "519a3ad6-0235-4c70-82a7-a4b3adb8d773", "value": "T162566C43EC9515E5C0EEE2318A629263BE717C485B3123D32B50F7386F76BD4AAB8750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987439, "uuid": "6ecc4bf9-34b0-44ac-97c9-bbaf4427f107", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987439, "uuid": "462471cc-6dfd-496a-8ad8-9221151646db", "value": "49152:NGE+a7rVQ76lFj633UVQbOnBDRKAt6Y1W4kf8oHPUxWjRn/hZ3VhHHylwKeK9Kt0:NtHky5nOm6T4EG6SEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768987439, "uuid": "6ee4929e-29d1-48c7-bf19-9692daa28079", "value": 6307840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768987439, "uuid": "428532a7-7591-4b2b-a1a0-4b39758577e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987439, "uuid": "720032f0-70aa-4084-9a85-80816aaa2f8e", "value": "hostage.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0efca00-f718-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034694, "uuid": "7be496e1-f781-4f28-9890-704ade0fe4c1", "comment": "Malware payload (Mirai)", "value": "af95769b8a587322efbbe20a708603c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034694, "uuid": "eef062da-becd-4dc2-8730-a6e29c55c8bd", "comment": "Malware payload (Mirai)", "value": "973e6ca0574bee0109b6062b0c74e8501756631753e708695a79d66b4d28c407", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034694, "uuid": "88c0ec3b-83f1-44c3-8279-8e5aaaf795cc", "comment": "Malware payload (Mirai)", "value": "480dd4efbd76b8dde7c35ce46cb9a3518221d498", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034694, "uuid": "375f7b76-8f60-466b-a83f-854cae400cd8", "comment": "Malware payload (Mirai)", "value": "cb183059feb8377cd8a99dab85828b70c9477f09967644ed5e8291505ffd63968e3da425eeb261679ea29f47f012bf7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034694, "uuid": "8c1a7ce0-a971-498b-bcef-c18039182ec4", "value": "T10063C516BF610FBBECAFCD3749A91B05258C640A21A83B767934D818F74B24F59E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034694, "uuid": "32e3c2c1-9a58-40f1-926a-959e6674ea75", "value": "1536:Hm11yOaISloFIme56nAn4bfjCd719ZAIjID:H61yOaISlKI96q719", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034694, "uuid": "0e4c2cd3-55e2-445f-b9e0-8527ea11a25c", "value": 68992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034694, "uuid": "dd5eed3a-fec7-4040-a4d0-af00976dfd22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034694, "uuid": "f6fca761-dab4-472f-876d-58244d4d1fa6", "value": "StormStresser.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b8132d-f6d7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769006630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006630, "uuid": "db969090-da13-4cb6-ae63-5521a36018c1", "comment": "Malware payload (Mirai)", "value": "6350426b04be26c8e606ad6ea1a88c40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006630, "uuid": "5b762783-87d3-4a34-9eb5-7fe95a7d1c10", "comment": "Malware payload (Mirai)", "value": "98549c9069dc14f3ba37b9a07b219c1b73ae1c023f02d2274cf4d73fb82db23b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006630, "uuid": "2d2c8fc3-9fac-46f8-af68-6fba1f6c358e", "comment": "Malware payload (Mirai)", "value": "2d987fa05652ef01a52f90ddd6cde26b12affbaa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006630, "uuid": "e643a711-e4c8-4fcb-ae7d-c09edb0fde39", "comment": "Malware payload (Mirai)", "value": "f32e5558922860723af7fe03548b701689ada1d9a2a483beb78e24488a0c7eee553039af4b99d74bb5ad5223b898ac95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006630, "uuid": "58a879fa-df1c-48f0-9d82-a53b1cffdcae", "value": "T1DB932BD2B400DC7EFC1BD2B781570B15B134B7A65E422F2BB636FD63DA2A1A41C1AD42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006630, "uuid": "e1ac780d-57fd-450e-a6d8-fc5391d46a2e", "value": "1536:rjbjutqJ2iFgGQVpnIN1o044t/vRNbDaIZ5RHIq2n7Fh2kPa/bJUS0HZbkW8s+cY:rfjut/wgfVpINXbmIynLxCUxHZbkRcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769006630, "uuid": "be685a13-a53d-4c4f-b6ad-0a0be1cd339d", "value": 94840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769006630, "uuid": "ae306b19-a800-4388-8858-1ce60ff34fc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006630, "uuid": "962ce044-e87e-4439-808c-7dd699e29a8d", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e7137fb-f6bc-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1768994800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768994800, "uuid": "90a02973-3f36-4d5f-8bbc-56e6b2cb6f65", "comment": "Malware payload (SalatStealer)", "value": "5a889b23db81b2c98bf62fd73a292194", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768994800, "uuid": "1f8cd63f-fb59-43dd-af1d-78b6f021f88d", "comment": "Malware payload (SalatStealer)", "value": "98ac1ac8f273ad2961ce1bd1a2a5bf60297e490538d2d5ec3532fbdce9c6bd1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768994800, "uuid": "42b2b475-b453-43be-99e6-3d2a42ad0dca", "comment": "Malware payload (SalatStealer)", "value": "febc2ddb72656a1fef872c20e702ecf1c0188269", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768994800, "uuid": "c7344d04-0806-45a3-bcc8-6f377f7c4359", "comment": "Malware payload (SalatStealer)", "value": "456b040f9b5c5a57aee835086ed95ed70a75486a73117a5ec86f68399e331ad07cad82e798c135e7cd884cf686a91f84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768994800, "uuid": "039f608a-57a4-4649-8105-cdcf40f83e33", "value": "T139C65A11FA9B54F5E9031831415BB23F27315E048B28DBDBEB547F6AFC7BA81292B205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768994800, "uuid": "7e47863d-062a-4d93-a368-1e7d994a0dbf", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768994800, "uuid": "22ff28c3-9947-4045-a3c7-f28a54db3c54", "value": "49152:1/J3o0hAqowMuEt3+eDUBjq7azGtR0K8rlCEUg9mNn4178ShrZMHEDYwCouJXjxR:N9o0huuYG3Ugm41RfaEfFAxx3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768994800, "uuid": "4bf12d1b-590d-4055-9dea-ccd2b45fb0b2", "value": 11668480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768994800, "uuid": "eda16e15-508b-4eb1-b51b-75e636d2c3f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768994800, "uuid": "92f4b115-4329-41b6-9e24-08f70d8f5cae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49061453-f6e5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769012508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769012508, "uuid": "ad6b2286-b9a7-4dc2-9e18-544a9d3d9dde", "comment": "Malware payload", "value": "fa0144a749b3f47c5175acfe027d0bbe", "object_relation": "md5", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769012508, "uuid": "93c3c8a8-b71b-46be-9601-a1fb6aa7f3f7", "comment": "Malware payload", "value": "9953113691bbd68cdd1ad64c232a4bdaaf761f9b3ed547b1b1116a6782c3dd0e", "object_relation": "sha256", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769012508, "uuid": "378218d6-5193-4336-bb73-a5b0b423c1a5", "comment": "Malware payload", "value": "00e4219b31bfea0bcfd6dfc7630485b26beb46e0", "object_relation": "sha1", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769012508, "uuid": "afaf3154-312b-4509-bd68-89bce914015c", "comment": "Malware payload", "value": "25c3d86690ba74082b1ccde3dc6e02f7b019eb61580b487b183cd99bc8c5264a3bf3ee80128c947214804cb03504225b", "object_relation": "sha3-384", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769012508, "uuid": "457370e8-ca64-4acd-8e92-c12210dbc975", "value": "T1CCB44629F4543AA2EC4EC5F005B00CA803F66D35127F5BC82374765F9A67E6DAE78A34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769012508, "uuid": "499fad7c-607a-4e0b-84cf-c110c648ad19", "value": "6144:PsIg9BiSQGWl7F1HHF1vaMu8nJcmWpEeva:PLiQ9Ln/9u8nJcmbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769012508, "uuid": "597304ba-4a88-41b9-8e38-e327a1465694", "value": 541664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769012508, "uuid": "85e33901-ea07-4362-adc4-b224273d6bc1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769012508, "uuid": "732df63e-53fc-43f0-bffc-eb331b704910", "value": "BabySrk.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6cbc40-f71c-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1769036429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769036429, "uuid": "568e496a-ee39-4067-b438-6da63aef1dec", "comment": "Malware payload (RedLineStealer)", "value": "6a189522256a6037452f37bb06aaf99b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zobpx", "colour": "#1278FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769036429, "uuid": "dd0546e1-9598-41ff-9c7a-a3e9a1ac211b", "comment": "Malware payload (RedLineStealer)", "value": "99715786340ec7a4cf953ff2d9611b3850fe40d46fb20e78cac98788cf38e679", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zobpx", "colour": "#1278FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769036429, "uuid": "ac5bb6ca-a0d6-4286-a721-e12621ea41a2", "comment": "Malware payload (RedLineStealer)", "value": "ecb286723c8051fae0b2d5ab4b5d8e3c12738001", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zobpx", "colour": "#1278FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769036429, "uuid": "547e9392-872d-4a2d-bc8e-2142c40e2ea7", "comment": "Malware payload (RedLineStealer)", "value": "b723f23f4611e68218d9110ad59d7ecd48d6b8cc610a010c98be2943882e74b554c83dbf875869234e9f68474a5844ca", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zobpx", "colour": "#1278FD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769036429, "uuid": "a0a46a53-ff39-435b-8a14-567f72c826f8", "value": "T1EA645A5833E8C910DA7F4775D861D67093B0BCA3A556E70B4FC4ACAB3D32740EA50AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769036429, "uuid": "c13eba9e-422b-40f9-8476-e0dc8b18d99c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769036429, "uuid": "eda05c98-6f10-48b0-b478-49843de209fd", "value": "3072:WcZqf7D34Vp/0+mACkyI+EQEjgWvB1fA0PuTVAtkxzx3RIeqiOL2bBOA:WcZqf7DIPnGfEtB1fA0GTV8kTIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769036429, "uuid": "ae78d804-7b08-4852-b53e-6822af969bc5", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769036429, "uuid": "7ca3348b-eedd-4973-bc6a-b241fd17d89c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769036429, "uuid": "4dcb9105-cb64-4abe-86c9-cd96bf112451", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aea1a4e-f719-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769034737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034737, "uuid": "61ef6fe0-5205-4173-b987-275e9a95661c", "comment": "Malware payload", "value": "a6f90dcb5d61db2300f8e933487dd57a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034737, "uuid": "2ca6ab4f-94b9-4684-87c2-84ccaacc51bd", "comment": "Malware payload", "value": "99be71633e44f6dfa59b0a23d877db7df58298c588a2666ea767b4c45d99f795", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034737, "uuid": "627dee4d-44dd-407a-bf45-b206c0d5de0c", "comment": "Malware payload", "value": "a0ed93ac1d5468f171e570c7d38aa05b59a63503", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034737, "uuid": "1bd2eac0-3d15-4090-88a8-9bfb31288c9c", "comment": "Malware payload", "value": "910c264fa561e2145b8ee460badaef16b1113f7652fcc0621e2f9a3e6af3ccd08abe568ef177673844a66785fc61b29d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034737, "uuid": "771cf78b-fbe0-402b-b5cc-40fc73c3bfb5", "value": "T118733A4AFD819B15D4D422BEFE5E128A3363677CE3EE7112DE105F2427CA91B0E7A412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034737, "uuid": "a31bd960-8ef0-4e69-bd0d-fb1ce48c90e1", "value": "1536:xznWJ5GtNwdQNpv/JE0XAxOFtAkF8u9z/etnLDWXljBioomL:sJ0tthLwwFtAkF8u9z/etCNoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034737, "uuid": "ac13ecf3-4000-4cf1-8cbb-c5161c94a5dd", "value": 77540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034737, "uuid": "3bc9f5fd-2907-4936-8815-b0f99532d303", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034737, "uuid": "cfe6fa84-95d8-4387-850e-01cbc006d1de", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a64eefe-f6cd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769002309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002309, "uuid": "8a94b5c3-8511-45b4-a042-5253d84358b5", "comment": "Malware payload (Mirai)", "value": "33ee3b93d78ae47d7b4644ada3c9206f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002309, "uuid": "309b3e26-f9b7-4677-a707-a7f14674cc4b", "comment": "Malware payload (Mirai)", "value": "99eb5f01bc42e1dbb61a0f5171c058a6e8fc51d019094bdb5296ee04ebefb929", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002309, "uuid": "97d52c98-8b84-4ed1-a409-1e0a1ea5bae1", "comment": "Malware payload (Mirai)", "value": "60f1ff543f399f2b7b8bcf6f3bf51f0dcbd61c3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002309, "uuid": "e9bbbcf7-fbb7-46a7-8970-ca4cc4e63c1c", "comment": "Malware payload (Mirai)", "value": "8d18bf021cdb6ce64a877aa45e11ba03366ff59584aae3e6ca7d239d409e19bea1d1b21a2eb8d1647707e466dcd2a0b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002309, "uuid": "64c53e33-193f-4e83-9ff8-b3ffaf1d980f", "value": "T164434AC6A693C8FAE818057114B6E3F316B2E4361578EFC3F764ED31BC62211A61A75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002309, "uuid": "69ca2958-9162-4417-b244-7aba63f945fa", "value": "768:aLaYud1PVtSOqVcYrlVi+BJmivTtXabd9jawK5bJy4X5T+VWeXRRV:aLaBPVAOxiNvTtMQwK5bFN1eXRRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769002309, "uuid": "a5c124c9-ce83-4890-9a2a-eef0b71a4005", "value": 58356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769002309, "uuid": "d716a28f-32a7-4e7e-b864-688e2817af33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002309, "uuid": "b3c418fa-ab2e-4be8-a36d-0b63223b6aff", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b2bfc5-f69a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980479, "uuid": "9668b24e-ad03-41a5-8959-2eafd80eeadc", "comment": "Malware payload (Mirai)", "value": "30822392ec0d803760f06e30a5cbce1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980479, "uuid": "eded31e6-10ea-4e4b-9030-942ff1fcf0a4", "comment": "Malware payload (Mirai)", "value": "9aaa77d8998842576ac1faa4fea7403dfce062d993f0afdc60efb3178c22af84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980479, "uuid": "7155fa02-00b1-4747-9278-d5cc584163d5", "comment": "Malware payload (Mirai)", "value": "5d37ad75784e2d8e52bfb62e3b9fcb2fde054e24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980479, "uuid": "a46947fe-49f9-4aba-a8a4-2531d3c08fe7", "comment": "Malware payload (Mirai)", "value": "1117e1618f8a18758eb42b7a4f1c59eaeab378ad970a22cb28961073be18ccb8c79ec3ef3b4cdc379712f822f6a7d846", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980479, "uuid": "258ac52b-2f96-4056-8ac7-5183809b7472", "value": "T13B830845F8C18F19C6E813BAFA2D018D73126BA8E3DFB2239E115F14778692B0E77645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980479, "uuid": "b7158d78-6fa7-48d1-a9f8-2f7c4a27b2d9", "value": "1536:RnnUXZXopgOGCYVZ2xUcfKCHvwWYWI1MB205GKkbg8FgXDUZKmnrPuClhhPrzvW5:IV7WaJL4e7qPupODU1rPuClhFcjQzrR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980479, "uuid": "b7d14d2d-f1ec-44c5-ab02-eb18fa3c2361", "value": 84604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980479, "uuid": "d6e25b30-ea3d-4cfd-b6e3-3a72d70481d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980479, "uuid": "f4d77155-f272-4875-88e8-9526dcfaa05d", "value": "sdxkzX_UXA229x.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5058c392-f6bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768996199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996199, "uuid": "840cddd1-215b-4778-b2bb-378434adbaf8", "comment": "Malware payload (Mirai)", "value": "8f30e224e384d5e450e26fd69dc73883", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996199, "uuid": "b492db27-ceb5-4448-b183-1ca9d4f1fcd7", "comment": "Malware payload (Mirai)", "value": "9ad29cce4377ced652679237e6cace88c22693d25d1bd79781b0c5242e79317d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996199, "uuid": "d9d7de7f-38b1-47f8-a028-c63b28308d7f", "comment": "Malware payload (Mirai)", "value": "f037e0e753fde2e7c1c0fc0def2735719ad03130", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996199, "uuid": "deec5da2-f72c-4b40-8e0c-c61fc8205017", "comment": "Malware payload (Mirai)", "value": "0798eaeacd06fcc1393ba2040776439783108db58b016ce4b5fabec04f13f212860b312fedfff8015b4581001cf120c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996199, "uuid": "4c43e15a-6e76-4b87-8094-ad7862ebf2be", "value": "T1CF53E9627C925A2AC5E063BAF6BE518D332167B8D1DF3217CC212B057BC551F0DA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996199, "uuid": "c5528b59-7f10-4975-858f-47a08bf8fd7d", "value": "1536:omHfUXVywKHMIeVOeKSs2KlkaLFgiZu6Kjoh+tTnS:omHfUl1IFM6KEhqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768996199, "uuid": "59b61428-0bb0-4246-a5b9-fc9abdbd19a4", "value": 62700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768996199, "uuid": "440a133e-14b1-4b2d-84c9-025515ea998b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996199, "uuid": "a0fda0f6-02ee-4155-906d-ef2f22ec6a6b", "value": "UnHAnaAW.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85316b5-f6cd-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769002467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002467, "uuid": "a3c4ea9c-e261-44cc-bae5-61a9ca42291f", "comment": "Malware payload (Vidar)", "value": "988a5eff694c7548eb541e723ba67c37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002467, "uuid": "e2d3906f-64f9-4b97-8938-236afa4028d1", "comment": "Malware payload (Vidar)", "value": "9b24953b0c4a70622de1fa39de8485185bc1a00cf6c35ca822312fe144b98604", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002467, "uuid": "256c31ee-efbf-4d27-bede-b2f3becce837", "comment": "Malware payload (Vidar)", "value": "d87bee0bea6537271380e25af9bb969e70be0bd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002467, "uuid": "296e59e3-cc7d-44c6-bab5-1028f7290b0e", "comment": "Malware payload (Vidar)", "value": "ef585f008b8ec41518cc6746231c44ed68ceafbf778ff8d884a82827d622d120ed256abe24e37e1e0a7e64afe51350b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002467, "uuid": "38eb482c-0e2a-456c-b87e-0a58df673f85", "value": "T125C55B03BCA08865C4AE91398CBA2151B774BC490F7123D71A62F7792FF77C0A53A75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002467, "uuid": "992859f5-8432-4c68-8df8-c286a3312478", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002467, "uuid": "273d5437-529c-4021-ba5f-22fb7a599ac8", "value": "24576:h032IDUvmdlZYIA0dA5sDrugk9DhSdsL4OhQuKx9pDarbQpy6cMmjeleN4842l7U:h039Ivm5YMdQsDrXhsEOhvYefudCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769002467, "uuid": "ef1fddc4-d5d7-40cb-a9e7-b774beea5cd3", "value": 2633944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769002467, "uuid": "f4efd524-6769-4b56-a9ce-90e0435d5427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002467, "uuid": "8480eee1-7114-4c93-b223-ac10ced042e9", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72bbcd97-f695-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768978218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768978218, "uuid": "4521aa4e-49db-41c0-9f92-00a4799a48e7", "comment": "Malware payload (AsyncRAT)", "value": "1427bb6cc3c1134c785d55c28765a6d9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768978218, "uuid": "1324b321-80f9-4f80-a717-708c67b7ee6c", "comment": "Malware payload (AsyncRAT)", "value": "9ceb01ca3ce5aa4bbac88914dd7a914483035ec7fe5011e007b251385b76a3bf", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768978218, "uuid": "573879be-6f49-4d8d-a3b8-39bab6dd9947", "comment": "Malware payload (AsyncRAT)", "value": "24c79a0c26e97441eed6d016d5663cbc6f6a175f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768978218, "uuid": "dbda4366-07f7-45c5-a50d-4704ca6d8f1a", "comment": "Malware payload (AsyncRAT)", "value": "e765bd814b173d3dd92b0ccfbc48170e2e0026810a9433ebe3c400f4ff21ae966bfa12227b515b502b28de835af98ed3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768978218, "uuid": "5c886e39-210f-4c1d-b775-e4e226e9f635", "value": "T1F9E4019866C8CA13D4D15BF40A71D3B223B8AEDEE910D3478EED6CE73439F652940396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768978218, "uuid": "d901860f-e2db-463c-8afd-181d5fa9f6e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768978218, "uuid": "e0ca3f61-f8c8-46d7-b5a6-9a1e09510c10", "value": "12288:D1+vH79g/gDbqWZBmdKnifQ6U0x8zYIskpIUul9y7hqt:DE/79grsBMKnhaIs6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768978218, "uuid": "b107d7e7-b35a-48bf-a161-e1fe072f2cf0", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768978218, "uuid": "14d589a4-11ae-4e19-8054-fd0ad73c2d5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768978218, "uuid": "b65aa70c-c60e-488e-90c0-a744ca81f834", "value": "SO-\u76ca\u52e4-TPE-LAX LCL CLS0128 SO#5102 - NEW BOOKING USA-E2601061.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b31ec9a5-f69a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980473, "uuid": "633f7624-438e-4f09-b164-8a049b7fc696", "comment": "Malware payload (Mirai)", "value": "d0abb804e60a76ada66912ef3349da2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980473, "uuid": "61ea327b-eead-4ce9-b42b-191052adb9d2", "comment": "Malware payload (Mirai)", "value": "9d3ed1827b029c4377904d7150b5f0f9cc41bb4f8b7385576b8b7b899431534d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980473, "uuid": "b0662410-737d-43ce-bcfa-4a5069f94609", "comment": "Malware payload (Mirai)", "value": "4834a4b9c517c6eb1fde904c3e23aca1010436cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980473, "uuid": "93978a6a-4bc4-4d5f-a28f-ee578c51043b", "comment": "Malware payload (Mirai)", "value": "16904b14f9c21a8ef07b2f5ee8eecf3ae86d780d84aa5f2c4136af8ba57cdd283683c79c593a1d8a6b4a695e7cf9657c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980473, "uuid": "652a744e-3a27-4431-a88b-88b2f0ba1314", "value": "T12BF33C47B7208FB1C368D67009B3CB67A6E6269216E19985E76DCD107A3075C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980473, "uuid": "c80d338a-c00b-4c0c-b3ea-e5a15c03ebe6", "value": "3072:o3VJgzikZXyrNo/tqTHmnsHgCtEUQW0l/1wLxpvEcJz3nw0fau:oFJMZBtqCnFCtE1R1WpvDg2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980473, "uuid": "270823e5-61c9-4e37-a070-68ce63e31ac8", "value": 166944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980473, "uuid": "fdfa86e6-78b5-4dcf-9eec-f6ffc501a1be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980473, "uuid": "2c15e824-b8f6-48f9-9a80-6dcd01f50d55", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a6bc587-f670-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768962232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768962232, "uuid": "2cf3ed67-b62d-4155-9b71-3d1c900bd3fc", "comment": "Malware payload (Mirai)", "value": "2d422805d56f72769b83461798acd9bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768962232, "uuid": "b0480026-8dfc-4af3-9136-7ba3594e45d6", "comment": "Malware payload (Mirai)", "value": "9d62ae936d86e7cf655352e73ee30e00f491a07e0ff6408709adf93f2f8dccda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768962232, "uuid": "b1bb667d-d442-4e47-8ae7-bf218a098960", "comment": "Malware payload (Mirai)", "value": "177bb692ef370b92c7f75339892c3e13e88d015a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768962232, "uuid": "4e11c958-32b1-4e78-8662-3f109da13588", "comment": "Malware payload (Mirai)", "value": "f0851af94262dbb3f7f2327f80419633e994eb77713bd17a237d9cf124ea5f9ba5fd56fc368960ac4f1f7b1cc4114a8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768962232, "uuid": "8a151452-85ac-4e8a-9893-febee51f9277", "value": "T1A1E3E90ABB601EFBE86FDD3701E9070625DC651722A83BB53634D928B64A54F4DE3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768962232, "uuid": "60edf43b-f992-4ed6-a818-279c85abe059", "value": "3072:MkuGHG+5beiovumpwU7iXznY505o8xPlQBsnTE:MkuGHGtiRU7wY505o8x0sE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768962232, "uuid": "a604e6b2-fb30-40c3-ac2a-e80975d2ecde", "value": 151612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768962232, "uuid": "be05f712-a690-4a3e-8c8d-7f5935c406f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768962232, "uuid": "8deae968-6b26-49b9-87de-7f41cde22e52", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e53d34-f6eb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769015324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769015324, "uuid": "986d113c-c278-4e7e-8a1a-5a453850cd6f", "comment": "Malware payload (Mirai)", "value": "73fcadcc332eacb2efd69c1a0c17e2eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769015324, "uuid": "c25715ba-003f-422e-84da-aec9f14bdb55", "comment": "Malware payload (Mirai)", "value": "9e74dc5377747bdd06bd70cbcb4325e0218a8dd31f66dcccfa41069b7a11ca00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769015324, "uuid": "4fd60c5d-52c5-487b-990a-3e0f64ebd988", "comment": "Malware payload (Mirai)", "value": "744a3ffc51fb965a9b6fff54c470d5e1cd403f52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769015324, "uuid": "e2ff2647-5ad4-4cf3-aba5-02d9523d6de8", "comment": "Malware payload (Mirai)", "value": "907461c7c3605503df097d0e36778fe232ac28f34b02edfdc5ecef01ac9586df3c63f3f96d069157d940164f5e4a0db0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769015324, "uuid": "9649f459-df8c-481a-b0dc-989011ab415e", "value": "T16213E1B4C5906EABCDAFE870DC64768177E22F8AB2A6DF52714AFD109F0500D12D1AD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769015324, "uuid": "3e2b0d1c-5a6f-4ad7-a60d-cf4feb346064", "value": "768:73R6OSO/wfEg+0LHJtp22AbGI7f2XhS9L1Sdd4Ux9+vLm5A2qZdjN4uVcqgw09d:YOoAa0f2k9ojx9+K5RqZdh4u+qgw09d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769015324, "uuid": "c9bc1409-28a6-4e91-8869-e1649f4bfab3", "value": 42236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769015324, "uuid": "0e9f7e11-2710-43e1-98c2-1a4c14cdc34b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769015324, "uuid": "7fd125a7-b244-487c-97e1-85bd0ef169a1", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3be3d4af-f6e6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769012915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769012915, "uuid": "64e38a9c-38f3-4792-b759-e5a5769d0355", "comment": "Malware payload", "value": "d3f5520574312786dc8d55d9a3c8b062", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769012915, "uuid": "473a5d16-52ad-4f9b-b6b7-966c6d6c2582", "comment": "Malware payload", "value": "9f426ecd568eb7956ce9db397467e8cf5e4915200957f69ee29334ac77f48c48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769012915, "uuid": "0a52232f-577c-4fef-a790-485dadd70d6d", "comment": "Malware payload", "value": "dd2f1ffd7aa573cb8a6583d51917f84b56dfbefd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769012915, "uuid": "7b739ec1-4d6e-4489-9b99-1a9f1c6906a9", "comment": "Malware payload", "value": "37cc1c015aeefb740a2b5aa9f82123aef636c05a9900ae35e8037c4757e3654c6f8f9001c2245ab039f4c3c283687de8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769012915, "uuid": "ef831b30-21e4-4fe9-85a2-2dcbb0b93815", "value": "T12B73C84E7E218F6DF36E833457B74E22979833D627D1C684E25CE9101E6038E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769012915, "uuid": "f5294dff-f983-459d-809f-0d851a6ec4a1", "value": "1536:8ReqT7+CJHQ0FbpoxI43H7xCGVw4C7aEnyC0cGj9:8gI7+kNoxI4Xdlw4C7auyC0cq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769012915, "uuid": "1a677388-54fa-4fa1-b0b9-8924b18209c6", "value": 76840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769012915, "uuid": "86ea4c0a-8cff-4e0f-b477-1abf6bc180f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769012915, "uuid": "f177831b-0ee3-445f-b990-c4c328158b6b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818f9879-f6d2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769004442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004442, "uuid": "2297d490-1950-419f-a1ef-13ca5822a5da", "comment": "Malware payload (Mirai)", "value": "11278713c9aa2b2f19f8159c1405a8fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004442, "uuid": "77db0e25-7207-4f5f-bd58-af9439ad2641", "comment": "Malware payload (Mirai)", "value": "9f52a704bcad797e171872c389abda5e77e4173f44f3a72c70fac09ec568b14f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004442, "uuid": "5008c76a-0416-4703-a70d-d9dad9946297", "comment": "Malware payload (Mirai)", "value": "6e7cba0f0ffb3177f4873d33b8f442765809355d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004442, "uuid": "b5d74961-8d8c-4969-b6ca-8a3380a188b8", "comment": "Malware payload (Mirai)", "value": "ea1455d47121608bdeb08f6bafbb381ad6d05e1b59b6d98eb1a74fd29d5fbd3be8ddd28fa7e9dac91bebcf90f8ea8065", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004442, "uuid": "cd9b9936-fca9-4601-9cf4-b06c0425f4fe", "value": "T1406312FA5635BC5FDFCC9A7C58201279A088D2D1F3B3A95074DAC18E5A1A32FD11C7A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004442, "uuid": "c12a559a-5440-4e0c-89b3-db134a888626", "value": "1536:9VUQ0TcrWCT3gcHB+cyepg1k/zJhw7nWAvnQGUgJViXZjbh5d1LzN7:fp0T2WCbgc8bm/gCAv3Jwpjbh5d1LzN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769004442, "uuid": "e9ada08d-a552-4904-b58d-8bd9423c36c8", "value": 70436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769004442, "uuid": "04f8a927-282d-43f0-9399-62f67b77d35b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004442, "uuid": "6a9b0518-bb36-49c3-bc2d-b2e0fc4d78d0", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ec63e9-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034893, "uuid": "a58a3e6e-42df-4800-914e-dbeb58666dfc", "comment": "Malware payload (Mirai)", "value": "9abf257bb3bf8e68d131a5fcc09a8360", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034893, "uuid": "3b639d54-0a61-4a32-9cac-1f48c65853ce", "comment": "Malware payload (Mirai)", "value": "9f9f1cde25c8a1ae8e6c3386fe9b92eb41dad1f5c54145b87a5012f70f65fc95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034893, "uuid": "4ea37fe6-085f-45a2-a9f7-6d07ab73b9c0", "comment": "Malware payload (Mirai)", "value": "c9fe9925f48ea3ac9fbd4a4b5fbabf16ee7eac74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034893, "uuid": "fb94b166-0b3b-49ba-92aa-f0e83513cf3e", "comment": "Malware payload (Mirai)", "value": "d009a690f25e79d5c5c431c655e5db34637ed9d567cc6bca69220825b368a97056b6231a37ee560ad82bc15c3ed00827", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034893, "uuid": "cbf0f68f-e44f-40a1-b59d-a000d1ead9d4", "value": "T1D7040906BF110EFBD85BCC3B4AF8270614CC685A22E97B36B934D968F54B25B16D3D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034893, "uuid": "bfc37b8c-d31a-4133-b31f-76fd0167c168", "value": "3072:FIwtzJ0pdL9k1FkF8qKYb2pat7QN9ZfjURbyrlfivnQm9BDC:FIwNJ0pdL9mi85atETjUlyrlfFm9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034893, "uuid": "a27e9fc8-00f4-4b52-a267-2db463af3312", "value": 182072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034893, "uuid": "4f458cc6-8b8d-49f6-af12-781d9e6e4420", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034893, "uuid": "48507ae0-d853-4081-9398-7d01ed7c1d2e", "value": "m1ps3l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbcaa07-f6b6-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1768992380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768992380, "uuid": "0d51ec4b-2d14-4b6a-9cc1-6f3168087594", "comment": "Malware payload (CoinMiner)", "value": "216af0b597ece74ad82a392f9bd20c92", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768992380, "uuid": "f08b7122-7f3d-4f4a-8b2c-5249486c20e6", "comment": "Malware payload (CoinMiner)", "value": "9ff62f3e271ae8e05cb2c296bfe39f1e892adb61b350aa8a740539b0301c7955", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768992380, "uuid": "c8c18164-ab7e-4eb4-a81f-a5ca576eb561", "comment": "Malware payload (CoinMiner)", "value": "301462f6c553fbdabc3b7be44683d62668dddb40", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768992380, "uuid": "31f9e5f6-2101-4d2e-a38e-a3b7bb49e751", "comment": "Malware payload (CoinMiner)", "value": "62b238db04cdb2a63fa74e65811685aa8d1ea40cb63e3980fa18d48a010d7fbf03d86b1b872c1e01cc5bf1a3960f5fcb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768992380, "uuid": "11ebcb16-119f-4797-bac1-e497e847f711", "value": "T1C8E501DA2E846AFBC6ADE57890B3737D1B6F99BD6BC39E5DD91B7EA113B100C8400440", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768992380, "uuid": "39056219-1def-4bdc-8a66-41579110c928", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768992380, "uuid": "7174a46d-5c94-417b-9b35-325bc7d3b678", "value": "49152:QjXxOofWjoDBA1QeMoSvEMf3IUhWpmvJYCVhVVQObNr1LaxEuyGkX76eM73/:Q1OoyoDByQe6vLwwvnseN8Ou+X7mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768992380, "uuid": "ba0af63f-374f-4503-98c5-ceccadb0f58f", "value": 3067904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768992380, "uuid": "1351aa99-72e5-41d9-9228-205377cc1549", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768992380, "uuid": "6056481a-ddde-4b0a-bfe3-002feeb5ab63", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0842f4b0-f6c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Ngioweb)", "timestamp": 1768998655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998655, "uuid": "7afcb17a-d5eb-491a-b31b-25ec8b781d76", "comment": "Malware payload (Ngioweb)", "value": "44efcc2a3d7b93dfa17b501d08b16e29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998655, "uuid": "cbb442b7-3835-45c7-abdf-306fb87cf59d", "comment": "Malware payload (Ngioweb)", "value": "a0b2daa18510334da721f08d42bdad19b9badff4ba90043dd9599538ef7758bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998655, "uuid": "318b5465-398f-4bb8-a75b-769de55d2c67", "comment": "Malware payload (Ngioweb)", "value": "23a15021c55b4cace5929e7b80f742fcc289fd2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998655, "uuid": "8c577906-b01c-4e29-b043-52dd512f922a", "comment": "Malware payload (Ngioweb)", "value": "fa10498c44efca980b669bb1d1e69f19cd6534af967f819c403eb7fa47759ffff7876cb299516857008d5464e6a30403", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998655, "uuid": "8ae43944-7021-40a4-81f0-e86625702a98", "value": "T135730794F480DE61CAC5257AFA5E568C33630B78D3DE32068D11AB3537E786B4F3A906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998655, "uuid": "3a003632-833e-4365-984a-9c4c74973b67", "value": "1536:4nskT/lq5NDuZBSL6A0B2hwj5SYnR+F8w2grcNizRMQG61DyumnyCbYfvmOkhzUA:4skT/lq5NDuZULR0fdS6zkzRaYZ7j8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998655, "uuid": "aa174272-39a9-46b3-a2ec-4513989267ea", "value": 75176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998655, "uuid": "81f3da78-836f-4164-a738-673fb83e9a7b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998655, "uuid": "1204e276-0f6e-4eab-8d2d-fa0942b4927f", "value": "plasma.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f585be1-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034959, "uuid": "f8890619-6275-4742-9d2c-3123b92abf4c", "comment": "Malware payload (Mirai)", "value": "a287beb90ef9f76b6ac98b45396d0d55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034959, "uuid": "4c95bea5-6181-4bf0-b450-1dbcca55890a", "comment": "Malware payload (Mirai)", "value": "a13cac5be7cec9f671cea5f395d04a327f032fe1ccb0d1edbecf1082f217cbff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034959, "uuid": "021ec4e0-e5ae-4634-bf90-e465546b1e06", "comment": "Malware payload (Mirai)", "value": "9903f364372309a1a57a1ebbe1f5bddc70ef3df8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034959, "uuid": "07eb8f74-c4eb-4a75-ac3e-00b945adb13a", "comment": "Malware payload (Mirai)", "value": "1db852b85c6749db997449f8199207b3bb94e6ea55531459a101661ae3d21412a12ba832eb945c5066c6ed8a030b15da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034959, "uuid": "ee46c9f3-a91a-4c45-8333-135cac51e392", "value": "T100D35C17B5C180FDC4DAC1744F9BF53AED32B1A91238B26B27D4AF222E49E205F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034959, "uuid": "1bc413ee-c2ca-46d7-86a9-6ff109a12c7b", "value": "3072:79eSuygEPjt6qkWqXdKmDnYMb0gBd/gQyVGsdqml6jaj:79eSuygEPjt6qkWq4eH2laja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034959, "uuid": "005c74bf-0c19-4932-a8bb-423bea092951", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034959, "uuid": "4cb3e1f0-c54b-435a-b2e7-bfd00c2c853e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034959, "uuid": "9b97dd4c-c272-43d0-a963-9dfa1fa38277", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96029a36-f66a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768959809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768959809, "uuid": "cb498bcd-0a99-4927-87a5-fbd1652c4180", "comment": "Malware payload", "value": "98246fe2161ffdfd4b39963302bd4855", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768959809, "uuid": "5a16a2b6-8bbe-42f0-b4c1-c707e024b37a", "comment": "Malware payload", "value": "a2218365a9f104d65c9d3150e5f6c3db26b9303bedad943c9ae2737adac3fad3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768959809, "uuid": "a12aa094-2d06-4817-a44a-1d5b47b0a546", "comment": "Malware payload", "value": "224fb2191b86d6cf6415f53f4d9dd05a0af0c647", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768959809, "uuid": "eb33c9ee-c1c4-4635-9c8f-43541a4942e7", "comment": "Malware payload", "value": "24a620989813604e98804960c47f9f0c6340ba237e299d4714ccea33d84a9cfbad77913af61a4b75eb61a8f8c5dae63b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768959809, "uuid": "bdd4dbf3-1157-4a6f-a69e-0c97fbb2b6ef", "value": "T1CFA633703ADA8017D49B9C7EA068CB379916AD217372D3DFB2484075EAA21D0D17F9B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768959809, "uuid": "4103060f-cd8d-4ef8-8617-894261092bdd", "value": "5939410b96773d14b36f2ddd9c7141f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768959809, "uuid": "35b225aa-d32e-42f3-9f75-4c5a60279ebb", "value": "196608:GAt59kZ6qScGDnZXRs6q7mFMxGKE1eos35Hg5uSXinsnoIXSnair4aw41:GAG09FFK7aeos3pg52nqoI8C41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768959809, "uuid": "dbf36ab7-1346-4fab-8988-737c1003d128", "value": 10370643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768959809, "uuid": "1cc0ef7c-1558-4919-b4f5-cc874c494e20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768959809, "uuid": "f8bc8bdb-774a-4047-a402-4978989c1bd8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f618d192-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768998625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998625, "uuid": "41d9d6b0-bb7f-4232-a7bd-cfebd99c2828", "comment": "Malware payload (Mirai)", "value": "4160f11d5e60f6169bc2525769b6b33a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998625, "uuid": "4f26f6f8-229d-48d7-8b1f-9bc2e4167dd6", "comment": "Malware payload (Mirai)", "value": "a245c14ba8e0c60f166b1ef64b89700dd9a7ad3d268bf4da053ccac9be7444d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998625, "uuid": "98c6c14b-d3b4-4473-9842-93cb13e5535c", "comment": "Malware payload (Mirai)", "value": "f55f0083ce6269e9e50f40305dbe019e6419748a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998625, "uuid": "b168c9db-7718-4e3e-aeae-88f0e4e80848", "comment": "Malware payload (Mirai)", "value": "4bc0ed99e301004f5ab76924d7fa1d276205fbe2e21a293431098d49f1d0ce47f804db15ae22c0132e78863030d1d696", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998625, "uuid": "75d7a00e-86a4-46d5-a837-403c794e655c", "value": "T14DB32A46BE901FEBC05ECE30062F831712DC98DAD3E5732E727C998D39A964949D39D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998625, "uuid": "1b415f94-b3f9-4a85-aa3b-32de1c3dadec", "value": "1536:mMCVkR5eVQUNc/Ij43FbwBoCwt+u3Ii8eolHIW5njcjvYKS4rNd:mVkR5eV3Ncwj9yCJu3IialoMjcLx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998625, "uuid": "87b6528c-055d-4849-b21f-10ac721de20e", "value": 117800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998625, "uuid": "d1ad8368-898f-4470-9568-7ba982c38b18", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998625, "uuid": "ddd98aed-8f17-4c15-a875-fc685f027945", "value": "life5.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b737624-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1768998285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998285, "uuid": "b05ac43f-0246-41a5-9194-3ec26076acfd", "comment": "Malware payload (QuasarRAT)", "value": "dab8a6af87070b517076e902acaeb8d2", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "schtasks", "colour": "#79E464", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998285, "uuid": "dcaa33c7-db4b-4a59-99bc-83eb3741c79f", "comment": "Malware payload (QuasarRAT)", "value": "a2d00c8dfb111caa16f4ec033dd942d0f22c6b76495bd10b22b1977fdfa1f605", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "schtasks", "colour": "#79E464", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998285, "uuid": "c00530e0-49d9-4e83-89ea-b477ee4c4c02", "comment": "Malware payload (QuasarRAT)", "value": "4e1c52da75813eff00c0868cc20ca168af8071a6", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "schtasks", "colour": "#79E464", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998285, "uuid": "a9317b84-0e36-44b4-a58f-7f0899fc76fb", "comment": "Malware payload (QuasarRAT)", "value": "dee1b0c9cf0596f64669a5ef4af4addd1fb6990aea9e7e6c88068e8b0889a0a44a0de556b9332ba90e7929d8a02cc16c", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "schtasks", "colour": "#79E464", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998285, "uuid": "26889e0b-278a-41db-b724-a39c3bbf8370", "value": "T1C4E54A143BF85E32E17BE6B3D5B0501263F1E82AF363EB1B618167BA1C53B5058427A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998285, "uuid": "8f9ac107-4702-4faf-9b2a-5f4dabacc88b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998285, "uuid": "dcb84e5c-77b3-4f34-9f8d-7421f4429220", "value": "49152:FvC2w2tQaqe2lP4lw61ALP4yFl870+hl5OGdi4zTHHB72eh2NT:Fvdw2tQaqe2lP4lw61gP4yFl87H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998285, "uuid": "f74253d6-e8d4-4386-a9f3-293d9a238d93", "value": 3267584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998285, "uuid": "eb8bdd79-38e6-4a99-bbf5-834f57fcb8bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998285, "uuid": "aa169d32-db02-4534-9d67-08c1dca1f654", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074ec317-f6c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768998654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998654, "uuid": "bbc93bd1-3924-4291-ba43-b1600d37bda6", "comment": "Malware payload (Gafgyt)", "value": "8cb5df2a6052ba026412868cbf1d0bed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998654, "uuid": "b9b0f8ac-8f0a-44ff-a90b-945cc0b0be93", "comment": "Malware payload (Gafgyt)", "value": "a32ed09b0224ed8dc2ef29548f6979a53516d0e0d68eea4d509e9517c1242780", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998654, "uuid": "15e0bfea-0c5a-43d6-9149-b11e4d126ed3", "comment": "Malware payload (Gafgyt)", "value": "7bd07c89003d250df37bdb986b6d0827e1d25986", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998654, "uuid": "5dbee0b1-4819-49ff-b656-bf52c30169b8", "comment": "Malware payload (Gafgyt)", "value": "e519954334639503c4bbc98c2539da3bb4eb4ff6e636db35e695aee13ed4f45a459c043a4ad9c3316243a23202cf22a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998654, "uuid": "a576070a-90a1-46ea-8304-ece939ed49f2", "value": "T108636C85FBDBD1F1F5830670002BEB6F9B349D154015EEA9EF093B65AC727528A1B22C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998654, "uuid": "1e3fd778-2973-4895-97e4-2114686636ea", "value": "1536:x54rsuicTROuRYVJ5aXWgkfDKM6G+tTBd+ZNocorts:H7uicThRYVHaXjkrKLYfWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998654, "uuid": "fc5af2a9-cc57-4cfb-a09d-3fd5d851dfd3", "value": 71064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998654, "uuid": "45af3c8b-2ec2-410d-9466-45afa7af6811", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998654, "uuid": "49c86d2a-3356-4e80-bfd6-24770b67f7b3", "value": "kk.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f298157a-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768998619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998619, "uuid": "a964654e-776b-407a-a0f6-9b71e9d39663", "comment": "Malware payload", "value": "6ffbbbdd4260863de8130dd9f899efbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998619, "uuid": "34955633-6d9f-4731-b6fa-1319bd99f34d", "comment": "Malware payload", "value": "a3b95d44e7c0965a8687b24d7d100fecf9ac40f56987fe83bae8a8e2946f138a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998619, "uuid": "a4ca5daf-1d86-45a7-a024-95f4b789bd59", "comment": "Malware payload", "value": "e0714a8f039172d80bef126a893aba8e1df194ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998619, "uuid": "989c517d-d1fe-40d6-bac5-b8bb6ca21007", "comment": "Malware payload", "value": "8b7c01c209ae4cd6570bb851779904c844664745fab58f7a301f3de30dadcc798cc3d47074a49862dfa9c7d74542e932", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998619, "uuid": "8704922b-4c8f-4234-9481-b8c165c7a795", "value": "T1CAF329567B51AF66C229C23009B3C75263F636C227D29509B26DDF1C2F223496D1BFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998619, "uuid": "41e85393-ca79-49bf-a761-7ba6936e22fa", "value": "3072:fuprLAiKCg58HDg0z4ClkWmjj0Nld61sBu1RESWxICuZ:Wa+E0ECl5k71sBc8TuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998619, "uuid": "a6f0e1e6-19e4-4635-aa58-3b629857d62e", "value": 163616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998619, "uuid": "7aafbff5-e565-457b-9af9-9b66ef475c1a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998619, "uuid": "8ce66752-ce2c-4980-ac8f-c6270aa5b83c", "value": "titan.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38aba35-f6ce-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769002808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002808, "uuid": "9507aae9-450b-4cb5-9a94-5a726fc337f4", "comment": "Malware payload", "value": "e092807913e360440715f02109dde343", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002808, "uuid": "7918de60-1b9a-4256-b2fb-2bb66fc140a4", "comment": "Malware payload", "value": "a47cc02a3a74dd4ac11f12b6253a52957a1aefb771fdd31883f14f189575f4a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002808, "uuid": "fbafd569-d10c-494c-b514-2408be41748e", "comment": "Malware payload", "value": "70ebef438a4757675c699d8b84b7d1038199bbe3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002808, "uuid": "47633f9b-50cf-4dd6-86ea-38540eeec908", "comment": "Malware payload", "value": "993b8ba01101462ec03f9a20d7f6817663673d30ec721647eaf80941c86f32cdbfd4486da193aca51ef7b4e32bf16672", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002808, "uuid": "d1f6e931-4fee-4caa-b3ba-c60793eb1e08", "value": "T1ED087B4663EA05C4F9F7DA758AE66617C673BC122F3095CF221C17291F336E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002808, "uuid": "e6756bd7-c078-40b6-bbc2-578a70ac4433", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002808, "uuid": "700177b0-95c8-42f6-b074-a0d241455b6f", "value": "393216:GtxQ1X2CcyJ+SKBmR0nuZeLM8bo1PgayexQu58EASEhoIaE2lShWuIRWVbTBUaaX:GrI8SQJh7DxaikFA5rs3wbvat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769002808, "uuid": "fd1e2925-5b04-4160-8680-ed59b52333ff", "value": 83210679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769002808, "uuid": "fc9ac04e-a5cd-4765-afe9-99a26e6d5e54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002808, "uuid": "c37a399a-e38d-4d87-a4f4-d5a5699965fe", "value": "s\u0435tu\u0440.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d5acab-f6e3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769011865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769011865, "uuid": "805cc57e-9516-4473-9495-10309e70ad2b", "comment": "Malware payload (Mirai)", "value": "82567be1def7a3793ae9ac0fcd425990", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769011865, "uuid": "aaa35a61-0ab8-47af-9f21-3bf9d4ef7d90", "comment": "Malware payload (Mirai)", "value": "a4d03d28364c3c527fb20f3cf9984f78abaef31182f25e106cf7bffb2094cdef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769011865, "uuid": "52259413-6a7d-4405-9d8e-9fd5b43005dd", "comment": "Malware payload (Mirai)", "value": "bfc395ed6c3c86fab7d06dd79061d3ff57c47449", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769011865, "uuid": "6d80167c-18d2-4aa8-bbaa-8d30f9cbd037", "comment": "Malware payload (Mirai)", "value": "ca219be459b9869514eb42db2f43ce66115e10c900ee366c22b8340e09665a731df1d61bbecfc996cf6de2235fcaac82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769011865, "uuid": "c470cb9b-44e2-4e1d-b6c5-e5201cc98bcd", "value": "T1CA13F16A031104EECE82F4F8DFE48F921B282F67C90B9D566463F95BCD4A1A17CE1549", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769011865, "uuid": "beabbec7-269d-467a-ab8d-a952ed42565c", "value": "768:PH63cEtjr/ciLDEPv3PPMRMdZrIopQOKwpo0AycP1/s/oK8HK0JgGlzDpbuR1Jcv:PH4004ZrPpQOKwpo0Ar2l8nVJuuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769011865, "uuid": "9fc84b7a-668c-4150-a5b7-386aada77d3d", "value": 45436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769011865, "uuid": "fc48a2b7-b3ce-4a6c-89f1-a9bea0cdf4c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769011865, "uuid": "ed0e21b1-e485-4981-b67c-f0a182b693bf", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7977f558-f69d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768981665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981665, "uuid": "dad3b6f2-924d-4c1a-be66-dd57903576f0", "comment": "Malware payload (Mirai)", "value": "91476c226f675a9592d90aa2f90f99db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981665, "uuid": "ad722f59-9efa-49e8-93b4-0d45c67564a4", "comment": "Malware payload (Mirai)", "value": "a548b4c0e2741a354df2dcbab6c6b015b37ccc0b87525c11f5c8fef9abc079c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981665, "uuid": "47d610e7-f302-48eb-8c01-2d8ea4b1ae98", "comment": "Malware payload (Mirai)", "value": "a6d72dfb1a7bbd774f11f030d931e32d89480a66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981665, "uuid": "5e1b1961-34d4-4068-b629-48178b743c73", "comment": "Malware payload (Mirai)", "value": "dbc2cd9207e68330c6e179c637988f6b9f6b15a270f89ac7d564f4c1bae1d6c912a155ff816466eef4f207a9910794e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981665, "uuid": "1a679821-3f83-4c32-9ba1-b210ace6236e", "value": "T1FDC32A86F8508E23CAD652B7FF5D428D7B2A1768E3EE32039D156F21378B95A0D3B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981665, "uuid": "72f69825-23eb-41d8-a733-d1e8372ea785", "value": "1536:f5U6SpE/gLMkJrjCf2ilzJ4Vke10TTpXyvKjqXlnT8wyw9433lNp/kIYEJOemMA9:fWPAgLMinCfn4z18Lj6M3lNYTOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981665, "uuid": "46760087-6619-428f-add4-918e6bffa513", "value": 129632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981665, "uuid": "1b02c578-fd56-4ae4-83d3-f6f8be0dbc0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981665, "uuid": "dabbcf44-78b5-495f-ba6b-6b091cec32df", "value": "ub8ehJSePAfc9FYqZIT6.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04077efb-f6c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768998648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998648, "uuid": "497cfb89-ae2c-4a9f-958b-4c790cbe533e", "comment": "Malware payload (Mirai)", "value": "d401fec3990d80c44cce253b2dd54def", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998648, "uuid": "2809caf8-a0e3-4988-a430-58a07a160d2f", "comment": "Malware payload (Mirai)", "value": "a6a417af625bda023896041d0815f119f07ea7d66b987cda8fd4f87651cf2f30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998648, "uuid": "2eddebdc-f9a2-4480-b763-8cfe2fcae9b9", "comment": "Malware payload (Mirai)", "value": "a96819843e48c429c9b6a2456cb16b4f14a4f8ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998648, "uuid": "b623acec-34a1-4d1f-8525-c4108f32d307", "comment": "Malware payload (Mirai)", "value": "89bcc8ddb8fed77000418b6dda962f51a71d067e1221cdbac1147f3c79e4a3648d1c78b63cca3b28990dfb19920878e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998648, "uuid": "23b34617-728c-4faf-8459-e9824d1fefb1", "value": "T12BB309567710DF62C22DC23006F3C7526BEA26D226E29549B26DDE0C6E7134D682FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998648, "uuid": "229d9a5d-e9de-4b8b-958c-1193e6a5a85f", "value": "1536:soOUm4Z2RULIKmcFlHf2uuAliBtaTeXNS/JINDVcEErL6sqDyoFvr8xY:soOUm4IRSjHf2uuAlMtAizcHqDXj8xY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998648, "uuid": "b6c561b8-eb06-4a03-8fcb-14f6158422ad", "value": 117800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998648, "uuid": "9a33b02b-9add-4df5-8e6f-5c3da44a13f4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998648, "uuid": "177ee27a-162d-46b9-be2b-592b93e8bc41", "value": "life5.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fedede81-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768998639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998639, "uuid": "7ef75973-0294-42ef-a5e2-8f8f154d2359", "comment": "Malware payload (Mirai)", "value": "5643ca8637ecbd9c8908cec6032161dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998639, "uuid": "89a6844d-f9c4-4619-9d2e-6a1a584ef1e1", "comment": "Malware payload (Mirai)", "value": "a7269bd1af0fe97b6dc3405f94171d0999b6a69dd63ef5594b2dd075d403ec17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998639, "uuid": "753f832a-b93b-452a-abc2-93701bd54fae", "comment": "Malware payload (Mirai)", "value": "717ff7ef0ddf8b571d5628b2494dad5409ccbea3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998639, "uuid": "1f104363-7968-4d2d-a93e-3d1ab89892c6", "comment": "Malware payload (Mirai)", "value": "1736f93f6da7771e759ff88e70e4b30ea369a70f99ae4d05bdb7ce79a45313ca773bd36aee094c72e22c37131854ec60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998639, "uuid": "8ff08ac0-eeff-43d2-802f-28b3d655428f", "value": "T1248308A5F480DA71C6D1257AFB4E528C33230B78D3E932068D15AB3467FB95B4F3A906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998639, "uuid": "2a9ec40d-75ad-4dbb-83e8-ea86fedd8ca7", "value": "1536:Nxqrpj22X4mtUMZOfxuPWXJAMT6d56Z9KOxPMJUIgeR2SGcH9by6zvONXO+KOB9b:NxqrpK2X4pMZ8WWOMT4mxWgi2S5HxIX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998639, "uuid": "3dc06b06-9c82-440e-a10d-e7d50e530cad", "value": 83364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998639, "uuid": "11a02389-18bb-45b5-b2ee-e76baf55fd93", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998639, "uuid": "ed25a7f3-efd2-47c9-8ccb-204d38946674", "value": "sos.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffdd9f37-f6cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769002077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002077, "uuid": "5f76137d-27b2-4b00-b9c8-29c6795be47c", "comment": "Malware payload (Mirai)", "value": "758225832d26c284c2eec38d271c6400", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002077, "uuid": "319463aa-47f8-4f70-8c46-96ffc34bffde", "comment": "Malware payload (Mirai)", "value": "a81794b1d877ef23167e4b64fea6cdecffd66585cfa377fb2068d5786da24705", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002077, "uuid": "737ea321-9b3e-4655-b960-80705c2d1bb0", "comment": "Malware payload (Mirai)", "value": "2070362a7ae4ef3bb7e171ebd627b0d3d1416d35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002077, "uuid": "c576fff3-bb63-4b7d-b31b-5e3984255459", "comment": "Malware payload (Mirai)", "value": "1ee593ac73be826d2d99066cf13d117814f4bb64a0f7b130d3ad48deb7f98eb3cd144e694e7285fe146fe201f6509ae0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002077, "uuid": "16425936-2e79-4e90-bc2e-d01fd7ddd259", "value": "T173936CC18143E4F1E9090235607AF3376572DDB90178FEF7F7589A726825AA0B14BB8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002077, "uuid": "41698818-2ca5-4bcd-933c-182c978519cd", "value": "1536:FL7tf+q6nvtD2ops8k6JrUN4QRl2H6GEOpb5EAD8u6Oabfn8QshyBFAxubZSAxX9:VxfV8VqoKNCGRw6GbpbTQJhbfn8F8nj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769002077, "uuid": "c8e739e3-ea7d-48f2-b165-28113fbe44bf", "value": 91124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769002077, "uuid": "f7dfd107-0106-4572-9ddd-94e8e5ca8bdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002077, "uuid": "ce9e22ed-1a36-4b4c-9495-3a78b29fa7ce", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e116271-f6bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768996195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996195, "uuid": "12be2894-480e-4c8d-890d-fff97c9c76f6", "comment": "Malware payload (Mirai)", "value": "d4a863812e5039be0cea7847dc9af9b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996195, "uuid": "791291d3-60bb-4cb8-802e-9f03420f5a76", "comment": "Malware payload (Mirai)", "value": "a882deba5870c02014033ff753922fd4f48170463084cafefe3b8d29bbf3f694", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996195, "uuid": "67bb6d12-f42b-438f-b82b-d0a094c6f147", "comment": "Malware payload (Mirai)", "value": "20d8e945fbb7622cfb579340030390cdfaf466ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996195, "uuid": "03037208-e9a5-4f96-be3d-b937e3790ae8", "comment": "Malware payload (Mirai)", "value": "d40cd2e540d70f1ab2a028980e41056bc8da2d4f61b68bba6010c1e2f650bff368322a3e8006092b7ad27de0e28c01c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996195, "uuid": "28f3a113-8bfd-4c1d-82ad-5f2c3bff5e3a", "value": "T1BC735DD9A8025E3CF95BE6BD94220F49E920231557D30F2FA19AFDD3BD731589E02D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996195, "uuid": "58af51fe-abee-4268-822a-e059504d6388", "value": "768:CebJkRKzkXAK8kYiyZbhy4Xp3xsbMW1mSFR1ESAP3qhudgaGxESjzvKPfYN3K8vm:CaC7WiylhyGsxfnKqw+aQjzvKXYNa8kN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768996195, "uuid": "421668dd-96c0-450d-a6b2-18f55d4bd7aa", "value": 78796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768996195, "uuid": "72a9cc22-77c2-4b10-88cf-53cbebc6b687", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996195, "uuid": "c9ff8a5a-fab5-478d-a1ba-d5d06ce8d4eb", "value": "UnHAnaAW.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69c41b2-f718-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034703, "uuid": "2c695cb8-118a-4004-94b3-8c8293968dd8", "comment": "Malware payload (Mirai)", "value": "326f3ffec34ba92cd4dc4b46eec508a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034703, "uuid": "7f2d5d59-32c7-435e-b41f-e579cdf6ed2f", "comment": "Malware payload (Mirai)", "value": "a9ae5ca054f10bb669805144ff55b05cd6680460455bd655a0db01179db91a8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034703, "uuid": "a0e8df66-73de-4fc5-aa7a-fced5c9fb9a5", "comment": "Malware payload (Mirai)", "value": "59086464319bca1724cc272cfffb6072bb2df023", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034703, "uuid": "29476526-2ced-4e65-8875-84cca37715a5", "comment": "Malware payload (Mirai)", "value": "e4676fb26add10eb479e3d30ae0682df9919a72eac4edea36ab29047c9019fed43e7ef88d23c4825afdab347e8c8cb1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034703, "uuid": "d714701a-24ac-4cf6-a0f1-bcf038e556a9", "value": "T1B8130995BC829A2AC2D026BBFA6E518D332563ECC2CF3217CC145B15778A52F0E77B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034703, "uuid": "caa7ad5b-c3e1-4ed5-8080-56f6a7844734", "value": "768:T3AatBfIXkaM20QfUNe3/7bJS7qtyhzdgyCu7VovrbTcSPmYt5Yf4qV/N9rs:vkkat0ObJHIhz+u74bTcaxt5Yf4Ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034703, "uuid": "9bfbedf6-09d1-4751-9da1-a0a0fee0b05e", "value": 44088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034703, "uuid": "868e0c7c-8e6c-4c06-ac75-72d3c16cccbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034703, "uuid": "e84b8431-bb7a-4718-a5a2-0ae9c8c1571f", "value": "StormStresser.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ffe5ace-f6ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769002534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002534, "uuid": "1d9c175b-7776-4552-a8b1-d7b1a72965d4", "comment": "Malware payload (Mirai)", "value": "864f375d0feca804419b2d2b713b39bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002534, "uuid": "81c5bbd4-ed38-47ad-bfd5-a631d77c1a4f", "comment": "Malware payload (Mirai)", "value": "aa0b40ecc16a7db61c1d5f1981b32b452de13086c50af14f6c246c0824622240", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002534, "uuid": "e9a5cda2-a14b-452c-85f2-99d10e75159d", "comment": "Malware payload (Mirai)", "value": "3f0f7faaaa81d13783293215df0446f6933afd8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002534, "uuid": "86b2837c-3352-4912-9561-a11720149265", "comment": "Malware payload (Mirai)", "value": "4f9dd8e2d7dcd3c53bd131d296f9cc3e3cb79c9e94f38016041d6ec39b6168e496db8e25291ba6b004e0087534f7c861", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002534, "uuid": "f415ad75-1035-427f-8c19-1ff16cdf43bf", "value": "T119B309CABC818B11D6D565BAFE0F518D33134B78E3FA7103DE145B2A678A82B0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002534, "uuid": "6f64c6cd-2fcf-48f6-88bf-cb3110c9deae", "value": "3072:H38SqnBXrW2EpWfYy3viCLrZnW9RHRo6cjHZJAVWZaZPT2:GrG1y6CLrSHRo6cj5JAVMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769002534, "uuid": "31aa4ec3-babe-4fd3-abea-31aab165fc5c", "value": 117128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769002534, "uuid": "f1964482-9f71-427a-9153-5e7d684d46c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002534, "uuid": "70f81da1-3dab-4be9-b4da-879bbbb35dcb", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51fd776-f6bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768996395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996395, "uuid": "06890496-6e70-43fe-bcd9-a1f621af6b21", "comment": "Malware payload (Mirai)", "value": "c82a0ff491a41b4f5b525d5178e1cbe0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996395, "uuid": "f9f15046-8873-4f6b-9771-9e1135ffee5e", "comment": "Malware payload (Mirai)", "value": "aa4959d2742fccc49fc802fea008809505927878c04759ef8353128f4fba518b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996395, "uuid": "f9e32f8b-4860-4a0c-af4d-5d5eab83a9ea", "comment": "Malware payload (Mirai)", "value": "078d6470cf90e59e222e248cc35d1931417a1034", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996395, "uuid": "989f86f6-3eff-4bb4-be91-0a68274cfae0", "comment": "Malware payload (Mirai)", "value": "7d0d0cab942a7df8d6ed1e406fdd225a677cb8fb53fd0311b22620cef323ccec79480a18febd591a6d6c64149c0bee25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996395, "uuid": "cf52bcfd-abd0-487c-a85b-b03af64db055", "value": "T1E0733A4331280A57D5924AB0253F5BE083FFF99034E4BA89684FEB5A8635E771086FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996395, "uuid": "fd25af0a-37d6-412f-a1dc-0129da430a53", "value": "1536:WOf3tUQ/CDRj11U02F3NdY7C57ljqjpIfvbA:Wd5yF3tbMpIbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768996395, "uuid": "c23eeb0a-a309-4d64-bfe1-05fd061ca496", "value": 77040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768996395, "uuid": "f65752c3-701f-44ca-b43f-7b644dcbf9e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996395, "uuid": "6e1ae402-5f26-4461-b42c-2f3380e2224f", "value": "UnHAnaAW.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb691776-f669-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768959549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768959549, "uuid": "fc7fbd7e-c6bc-447f-b38c-7324d3a5adeb", "comment": "Malware payload (Mirai)", "value": "2e099883e507bb1e49f4a06fba23fb4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768959549, "uuid": "f64c3285-d632-4093-8710-2b435c69ce31", "comment": "Malware payload (Mirai)", "value": "aa958be009b2837a9753042bf2ffb2532741430a7de37be80ebfe940e63efcb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768959549, "uuid": "5d363a78-c78f-4feb-924a-3b4b1c40a714", "comment": "Malware payload (Mirai)", "value": "6e6ff5d1d0d49efff6680492e25229ccbf76f401", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768959549, "uuid": "93cc476e-efc6-4c38-9f5f-833fc856e5d6", "comment": "Malware payload (Mirai)", "value": "3fed04de41b41af2b3d884e13bf54a38369a15b4b4ebd062b0d0fce792c289280be007a03599f413aab5c1229dc432ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768959549, "uuid": "ac4f39dd-8efb-43e1-81b2-8f6b52534f5c", "value": "T1A6631855BD929A13CAC5537BFA5E42CD3726239CE2EE3213CE149F6132CB42B0D7A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768959549, "uuid": "403f8e91-a3a9-4cf7-bd10-628ded05a188", "value": "1536:t0aCJlu5BIIjZXtsFGE/ZMfl7p8nIVGvuhyN:2lu5Bp2MuKlKICu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768959549, "uuid": "f3b4072b-208b-444d-9d74-e30e569712db", "value": 66776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768959549, "uuid": "7173053c-6001-47e8-88d8-6dbd6d007ba3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768959549, "uuid": "d39d4d41-4406-4224-ba6c-6b4111bf6d54", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee66d5ab-f6cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769003336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003336, "uuid": "a1eb24ba-34d5-4841-94a2-97f9d40832ac", "comment": "Malware payload (Mirai)", "value": "cc744913b06c4d15eec799a4d1e69327", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003336, "uuid": "8c6bcee5-4e7e-4d67-a52e-ad59b9316283", "comment": "Malware payload (Mirai)", "value": "aad946d89879c0b3b461855536bd371dfd3c21102ceb1ef02d774ac73f117962", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003336, "uuid": "1b9bb31b-a045-43aa-bed9-30fa785a05c8", "comment": "Malware payload (Mirai)", "value": "68486020b67153702f5aafb6a0060387e7b7ca05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003336, "uuid": "8a063d43-ae10-42d7-951b-f59b1038db6e", "comment": "Malware payload (Mirai)", "value": "e32de6ddfc3d78e2c21520993e4f9568445a6716e7d18cfe1a8e150e89be4bafb7577f492f6020fe495f41144a108da2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003336, "uuid": "85b5f387-2ed4-4535-bd91-76ebc54cf19c", "value": "T17FC35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003336, "uuid": "18067e6c-a502-4c46-b78a-454e43a13fb5", "value": "3072:36tJsoRNjmj1VGCLUZMIV9Sr+QVrxZNioIw:VoRNjmj1VGc3rRiof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769003336, "uuid": "8b6e683a-7710-4b48-9db0-844337579a38", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769003336, "uuid": "5abb0f56-e1c1-403c-bcf7-b6a33ffffb7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003336, "uuid": "59bcf92a-f295-4bf9-a268-5ea700e2d433", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76103e70-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034917, "uuid": "6df01350-a679-43db-935a-9f6a7ba08b06", "comment": "Malware payload (Mirai)", "value": "33fbb18a6c9296f63495fa1806a61aa8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034917, "uuid": "b3d1b8f2-5ef4-4897-b8c8-8c206284f64e", "comment": "Malware payload (Mirai)", "value": "ab16891ee33ba240c49e98d01688ee0b473df2c1840b3975dd1d56183072e587", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034917, "uuid": "2b3c8cbd-0ca8-415c-bff4-f919d527e751", "comment": "Malware payload (Mirai)", "value": "6effbea75472b10649ec7e7f86ddc9d6e58dc326", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034917, "uuid": "8cbd42dc-027d-4a93-a968-a61245f1297d", "comment": "Malware payload (Mirai)", "value": "642d87b24b62416c55ac4413cfae80def3c58232f01e2e1f3833c540a9758ac9fdf240f565071d61a47e9673cf457c0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034917, "uuid": "16d3f53d-c4e3-4a03-830c-992bb3ec96b1", "value": "T1D3A33A037B090F43E0532CF0267B17E183AABEB124F9E685B519FE8586B1DB25546FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034917, "uuid": "b8e20821-53e6-4002-b954-370bf0f223f1", "value": "1536:h6T+1an9FIolu6adJYpea2F+xmWSXn4OUxt81JygGY+F0loz2xr3TtyiZY+bW:O+e1x9x61qF0lxrIkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034917, "uuid": "e2730581-c65d-4cb2-ae97-6e563bef68ff", "value": 99752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034917, "uuid": "76932147-978b-46dd-af47-d028d7890f44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034917, "uuid": "131e76d9-cfb1-49b8-958b-ac2340c23c4a", "value": "titanjr.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c7fa85-f6bf-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1768996317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996317, "uuid": "089f2681-f6d1-4e1b-9475-319fb72e81bb", "comment": "Malware payload (XWorm)", "value": "7249b91512f6b21df1dfee45b10d7126", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996317, "uuid": "16b03398-873c-4f1e-9b26-00400e536c0a", "comment": "Malware payload (XWorm)", "value": "ab582206dc5682e528a6b1b5457661e5292acfb0a5a3aa4a2bd81f22cb3a1c73", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996317, "uuid": "c5f215f7-b955-497b-8340-5bfe360ea2f0", "comment": "Malware payload (XWorm)", "value": "6b12b8a1c30860ba2ab65c4ae8647b46dafd0fa2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996317, "uuid": "89e865e8-f99b-40de-9e22-c2bbfaf4a2a2", "comment": "Malware payload (XWorm)", "value": "4c963949ce8d061dc5098cf88fe643a28f28a0bf21932d563a84c5b32aa7a5ae68fd58926008f47e2d6aa256c7d6a4eb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996317, "uuid": "1f354c9c-f123-48e2-8035-9bae321f4246", "value": "T1C5136292F74CC98DDD5C0A6DCA39FCFE679A61B9138147112F04D9CACC6854E82236AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996317, "uuid": "80f210d3-86d8-4144-879d-3efbf9df3bb7", "value": "192:Z0n837gLu28vtR/7ti8l4XaJcJUdXlkiUFlXQ7:6838LL8ZiMy4k4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768996317, "uuid": "02a76824-ba82-4731-b7b9-36335dfefdc7", "value": 41597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768996317, "uuid": "1ae71085-b705-42ba-b01a-223b484d1eed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996317, "uuid": "ba19e8fd-d74d-4bcf-8560-7427646ffb1f", "value": "awb_DHL_shipping_document_bl_inv_packing_commerical_docs_21_01_202600000000000000000000000000000000000000000000000000000000000000000000000.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ac04cd-f6cd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769002078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002078, "uuid": "ac7377bc-cdae-4634-bd94-8e2afb8fdbda", "comment": "Malware payload (Mirai)", "value": "c8cdb411322761416cb4003675d49b6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002078, "uuid": "b43ff471-344e-42d3-b3c4-6d831a1d26b7", "comment": "Malware payload (Mirai)", "value": "abb435a22b3624874f150a9c7e18c29419f0710cd1b52908cbe4e7c54b4b628e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002078, "uuid": "f9c50ee9-3f54-4312-a684-3db133688235", "comment": "Malware payload (Mirai)", "value": "def0b18eddda5ed97a6d8c29fac83806957b478b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002078, "uuid": "53e2fdfe-312b-41e5-803e-7e1b1dc1cdf2", "comment": "Malware payload (Mirai)", "value": "cece28a5a80a29c0a8dd002cdb8456f97b236d4da5d9607690d3a0d04b3b357484b5287e3cd103e695bdd2c4acbe5ba4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002078, "uuid": "5d6e5295-2c3f-4fcc-9abe-99d60f275962", "value": "T160A3198ABCC5C612C6E061B6FB0F51DE371643B8E3E67143CD19AB29675B85B0E3B250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002078, "uuid": "6e2f4d2b-51bd-45bb-93ac-2a316a1fc876", "value": "1536:u8b33ukAP7Aat6U5YMWeT4nfVGW1hKU4TQ+DYv/K1PP2XvDT2bVR:u8ruFz2SYMwfVGW1oRQ+O/g2fDT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769002078, "uuid": "acca4164-7263-46c3-bd64-4c4cb5c81762", "value": 103636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769002078, "uuid": "0b4e17ef-67d0-46e6-8a32-c551453faa70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002078, "uuid": "8c0ef625-a8a4-4aca-a578-d61b35382909", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f683a61d-f6c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1768999484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768999484, "uuid": "aad1620c-1ab9-4fe5-96bf-cba8b25d2094", "comment": "Malware payload (Vidar)", "value": "09b7e978f93cc4b5b979ecab5e5d0809", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768999484, "uuid": "77dbfdcb-51e0-4f05-9044-1c1a56531de2", "comment": "Malware payload (Vidar)", "value": "abe2a27215ddb575c47c10b71042293bf3d1c5b8e08e851332c7b5485a19b75c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768999484, "uuid": "d8099753-42a2-4937-8eaf-27ba4a9f2132", "comment": "Malware payload (Vidar)", "value": "fde0a1daf07697aae1f7b87a78280a2e5f120301", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768999484, "uuid": "6ec28680-6e42-4e46-93df-7566c6d355fa", "comment": "Malware payload (Vidar)", "value": "dceed639c1469d6af7ab2aaa6baf99cf913b7d3d3ce39de03d0ebfc5081f1e507f949476721e6343da722a8e5d71659d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768999484, "uuid": "a9257446-3eb2-4300-8ed3-1a9d02d60be9", "value": "T112B65BA3EE500666CA9BD23ADDB252453230F844033524D77F9527A65D6BFC4233BB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768999484, "uuid": "dc838173-acde-4ed6-89c6-cf654dfe82b9", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768999484, "uuid": "ffcdde70-935c-44f2-8be3-bfd211fb2a14", "value": "49152:VR1lKiY0Y20Qhf1S53Tf4qxVK3l6OCbw4r7Zw8KtGSvalXUiZDo33OWr16GddxPW:Vh0K+jw2svu4XZyQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768999484, "uuid": "21c965c1-cd3b-48f2-b09a-d7cf66091e6e", "value": 10582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768999484, "uuid": "eb73b322-0992-4de4-a272-4365f7b388c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768999484, "uuid": "aa15709f-6906-4510-ae0d-5f0fe546cee1", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75370dc2-f6e1-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1769010864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010864, "uuid": "71cbb725-91a3-4d03-8db7-99342c456a71", "comment": "Malware payload (CoinMiner)", "value": "c3a97e83383d8251e8ba36927d26091e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010864, "uuid": "ed406dea-91e3-46c2-be0c-3fa9bd99e0f4", "comment": "Malware payload (CoinMiner)", "value": "ac8c79f497a44a56c66ba08da14c56582f3b3c3f8d3a429faec019af235196a8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010864, "uuid": "a441a222-e75a-435e-b7de-83a71ca09f2e", "comment": "Malware payload (CoinMiner)", "value": "ebdd28e9d619320c6fe2cc5f97cd5b52e807b3af", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010864, "uuid": "2f860dd4-bab2-4180-8be1-606b4598651c", "comment": "Malware payload (CoinMiner)", "value": "b53d5cac20b40d06b03476ec86a181b8d5d988e342280fbd2a31d1606fb6221764824d657fdedda2e18f798411aa70c6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010864, "uuid": "a4cc3c1e-77af-4e98-9d03-0b6d3ec725ee", "value": "T141429E13F769D862F48546719D77CBA91A21FC218E209B4B77903F1F1C30690FC6AEA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010864, "uuid": "b47c9286-3f33-41d0-9234-691f82ac17c8", "value": "25bc7f6ae9c65d9ad1ea7e6d9306c010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010864, "uuid": "9ecd3573-1821-424e-8d79-8aeaabd23dc4", "value": "48:K+Kz3SKiCtAFgr9QVCW7s+mCyIYoWgJSswmEHK2:2jAiyCWZfEq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769010864, "uuid": "cba55f98-8d63-4d41-9790-e7f1d8caaee9", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769010864, "uuid": "24b2baf2-6d73-4d7a-87a7-9d3fcbc52893", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010864, "uuid": "f33c6a9a-6879-4f2a-bd0b-10182a126fe8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c00e2bf-f6d5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769005668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005668, "uuid": "8b111c3f-43da-4b66-b86e-760f9f96cc44", "comment": "Malware payload (Mirai)", "value": "a276db1c3209c727c495e6a6053ed418", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005668, "uuid": "10fe3e8a-7d48-4a9a-b89c-2ae1525f6a4a", "comment": "Malware payload (Mirai)", "value": "acdedd63596c3def36c1c70e4528b5544caa05880a90740c731ee3653ec58811", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005668, "uuid": "ce8ce0d9-3ec4-4218-a746-3573aa6e47ca", "comment": "Malware payload (Mirai)", "value": "19780291bab62aacf395d7c6d89e340f4a144106", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005668, "uuid": "aff29d45-2fc4-4574-a8ba-24ca6bb082c9", "comment": "Malware payload (Mirai)", "value": "59284f8e4aa2945d0701dc6760310ed941ac4780e9a383c2a56bb9133147db26e5e97d3b4d6688065ca811f0c1d9fb35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005668, "uuid": "a6f4e0c4-6e9d-4eae-bbdc-e026d47de21d", "value": "T1A7A33921ED796D2BC5C0713B51E34530F5B6139E1ABC9A5B3EA31D5CEF14220312FAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005668, "uuid": "de6b2f95-fbf1-4b7f-94da-b3beb6767cf0", "value": "1536:xt2/fzOnRJXWu5rGsEJLymGJwcH4piVfFXyZ0hWTnAmDOzm7uhp:A7sm+GTL0ZfFC77YzmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769005668, "uuid": "57e0aee3-be21-4d55-a064-263bd0c891c2", "value": 100372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769005668, "uuid": "038816f0-b5ff-4efc-9fa8-bf9955b625f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005668, "uuid": "2ac2a3a5-13ea-4473-aabc-df3840e207dd", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6172de5b-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034882, "uuid": "5bea3fac-d980-4f61-bcc0-4317dd553218", "comment": "Malware payload (Mirai)", "value": "6b4470d856af900712da89e6715a945b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034882, "uuid": "9d727e00-bd72-4bb1-b271-0ba14ba16379", "comment": "Malware payload (Mirai)", "value": "ad083a1f9186ffc38fbd148fe515812a7ccc82f410ac74ed6ac7fbd88f135ac3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034882, "uuid": "24fb8830-5212-459a-9730-7657c27952a8", "comment": "Malware payload (Mirai)", "value": "1ab39cb5c614a9f8c72ff7040803d842b60f3d7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034882, "uuid": "91e109be-e784-490e-bfec-c6e6eab9397a", "comment": "Malware payload (Mirai)", "value": "984f64880692416d5f072f7da4b8c9fe3d6dc12e8ebcca3ac3fbebc1236af4f84515cbcccb5579abfdbbedc88659882b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034882, "uuid": "28de0942-c4a0-477f-88d5-cfa4ef3c5a27", "value": "T13623F138F1036853C8268A37E07D618E7D0124BAA6CB2C401D654D3DBAE73974AEE45F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034882, "uuid": "067de5ae-721b-4b2c-9d14-22fee5be96d0", "value": "768:3kXsan8kAZvGKG5jiRNo/BkmehwwrGrWvO38ldkRrSxW2sBs9q3UELfj:3kX78kAZuKujRkme5rhvflIsjaLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034882, "uuid": "774333dc-c407-4b3f-a189-626f1a4d75c3", "value": 46112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034882, "uuid": "86859f2d-ade3-4bcf-a604-85b7baf2cd2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034882, "uuid": "d7b41a85-ce96-42c7-859f-1318bfccbe9d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b5b2c4-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034729, "uuid": "93ece2a2-5660-4888-89e9-e07c8d80fc02", "comment": "Malware payload (Mirai)", "value": "81914339707d5112f2aadf8bd3ae8457", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034729, "uuid": "41fba522-65b4-4a6d-b32f-c9044626e3dc", "comment": "Malware payload (Mirai)", "value": "adcd5e80c9dcedbfb122821ca7c4cd11e9598f43107d698c159c935c224988da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034729, "uuid": "f69fa112-afa5-4bcc-a297-ef7c4c7e14d4", "comment": "Malware payload (Mirai)", "value": "2b739e15438a4a893b008cd28196e86dbb808642", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034729, "uuid": "060ea678-d1d1-4700-a124-6ddbde7f39e5", "comment": "Malware payload (Mirai)", "value": "43e5ae0c833d0cae25061495af388c65237c5175050faaf23fdfda16cfd1601c116101c9134e41ed0363d498eaba445f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034729, "uuid": "13eeaede-c061-44fb-8924-c1a106642133", "value": "T19AC31B45FC405B23C6C612BBFB5E428D3B2A17E9D3EE720399255F60378685B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034729, "uuid": "53aa7fb1-5d57-4233-af77-2246a53b5b3e", "value": "1536:p/Ka0rG5yC/cMChygtVOBdWFAcJX4VlgXTAXYFkWUGZrSo51WhrV1l3GwywEReQS:ZKaprMh7TOXWFh4UXcYFkWpZlvWNUmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034729, "uuid": "e15e1e56-1cc2-47cb-9bf8-fe095329412a", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034729, "uuid": "2fa05b37-49c8-466d-8c7e-f2fbabd900de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034729, "uuid": "b68bac0c-e4be-4548-a1ed-2659bccbf653", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ef6e66-f6c8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769000072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769000072, "uuid": "a1429215-8a47-4997-bee9-30e7580d2c3f", "comment": "Malware payload (Mirai)", "value": "3afacc0f17a1ffaa4c7abcd239ef9707", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769000072, "uuid": "61df09ac-7b62-4893-b528-f19fd69a82a7", "comment": "Malware payload (Mirai)", "value": "ae3b9ab03c4bdabc64d6fc3b2b9ab47e769f1ecce73be1dfa0aad6024631a6ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769000072, "uuid": "9150a9a3-55b5-4bc4-af1e-e068cbc2ac53", "comment": "Malware payload (Mirai)", "value": "ec7a345e6c165979854d37440f7aff1b8bb33abd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769000072, "uuid": "f3cca730-7945-4d20-903d-979e7093c9b2", "comment": "Malware payload (Mirai)", "value": "9754e3751a0f2c36e42f50d2ac6466c63d8f54b0eca38b1ce8a3acaf6f330ccbeef17fa4e6f9069b69b46009dcd34ca1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769000072, "uuid": "d28febd2-1964-4e1d-a284-13ca3e0d4966", "value": "T14B6302B873EF8034E09CA532250F22707331DB5AA43B13DD2E99B5E9E2975580967F64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769000072, "uuid": "f1836539-fab0-48b1-8d96-d3949645d459", "value": "1536:hltrI7mDmde7Lletk8cghgLFPjihgulh6DoIzzMtrPf:hl+YmdkLMk8c5PdulIvMtrPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769000072, "uuid": "104790af-849c-4af8-a766-2de26d538825", "value": 70848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769000072, "uuid": "1cc7d866-5f91-458f-a9fe-38f13c5bc2b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769000072, "uuid": "fece5378-21b5-4ac6-98a6-5bd720e838c1", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d4d575-f6ab-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768987810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987810, "uuid": "eeafa256-0224-427d-9af2-daf14ca4b3dd", "comment": "Malware payload", "value": "0370bb7283356df6f996eed90671ff7c", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987810, "uuid": "05203f9e-127d-46f9-85d8-0e9ac1174a36", "comment": "Malware payload", "value": "af088a74c2d683b3c77e4ba46dcc44fc644cf07cfe06d26ccbaa9dcfa808c09d", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987810, "uuid": "c299b713-e084-482a-91c4-73d4fecd92ff", "comment": "Malware payload", "value": "a22c0a5dabda1b3d557f933e7c87d924e5135a89", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987810, "uuid": "a6215971-e01f-47e8-b55d-26c30101cdc0", "comment": "Malware payload", "value": "fed10a7363fbb792e5b9adfbf28df4a6faff598374d7a2a2d6f46692c442353844e1f466b8663ade021fe6f402419816", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987810, "uuid": "2bda2c61-7801-48e9-b5a1-b6cc8a301293", "value": "T12F4633E593BA9D1EC2A1977628A362C51E137EE0232F9451460F41A7B1934FDC7F2B38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987810, "uuid": "36071c30-3997-4765-b659-70296b38685a", "value": "b58258e2297dcb3863be03d7366a04b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987810, "uuid": "b77f264b-ffde-471c-8fb6-db737b16af87", "value": "98304:XNiqunTjbcBLX+bwtR+cLnaUJpvq6fDY1U6MxzY9i+ygIk/m5Gv2XDH:XtunTjkLX+4MWVyeDYKPxzY9i+ybkj2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768987810, "uuid": "f0f4e63f-1f1c-4c8c-b3f1-206cfa73619e", "value": 5696528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768987810, "uuid": "b7cbabe5-06f2-44e1-aff4-c4c20c27a7c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987810, "uuid": "12381f8b-6ec4-4f1c-9af2-24254ebea3e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeea8be9-f6c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1768997217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997217, "uuid": "36808e10-1ff3-49a2-a9aa-65fb727b2564", "comment": "Malware payload (Joker)", "value": "9193f646d7470a0df8496bdf29fa8848", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997217, "uuid": "5c93a3ee-932c-44e7-87e5-2bb71ebaf5af", "comment": "Malware payload (Joker)", "value": "b008e30590725d6a5bde09ebad2cfe6ff0b002b16b3b93fe9150a608a180f511", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997217, "uuid": "037614a8-4eb8-427f-b1a9-304ddf9990f9", "comment": "Malware payload (Joker)", "value": "c4a0d212ac3d34daa4affe7c422e92f12c2eea3f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997217, "uuid": "812cf5a6-c71f-4a0c-ad88-3aef3e522437", "comment": "Malware payload (Joker)", "value": "bb4472a88912979f5399efce58e237c0069702756c6f1cda87694d0763a246606485c63d20005770cb58d6d3e5de7f9b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997217, "uuid": "a7c59441-9b52-429b-af94-c8057da13d59", "value": "T155C601ABFB1CF92BC4364032C55AA132B26F8F118E4297777908730865B35E94F65BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997217, "uuid": "29245944-8758-4d48-81c1-f0fbec09f89b", "value": "196608:46yHFPs0u9beP2aNSDynXmnOIXzWzHliAIb6aqd0KWd5iJcyRtQkGEHjR:46ss0u9bePuyXmOIXzqFiwaRJQUkJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768997217, "uuid": "3d2bd708-9d82-427e-a184-d27871100b26", "value": 12422746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768997217, "uuid": "7090da50-2c2c-47a7-9118-7ff771b0d801", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997217, "uuid": "2974c55b-9070-4bc0-9f39-01502c9a83d0", "value": "Text Chat Messages_1.1.2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33d3cdb-f66e-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768961549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768961549, "uuid": "e8eb10d4-c22c-4fb2-ae3c-98febe371036", "comment": "Malware payload (AsyncRAT)", "value": "823a8baf8b7f0ae5469d7d2c207a6c57", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768961549, "uuid": "95ba1ef5-29f9-4dc8-b3c4-fe11d6c428d6", "comment": "Malware payload (AsyncRAT)", "value": "b074ed95714a7e15a2ee61a81de6b9e4266ed06a4f87c738fc5379ce678f5394", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768961549, "uuid": "d8c54c85-df18-430b-8a61-ce2d5ab5a153", "comment": "Malware payload (AsyncRAT)", "value": "3b8bf20931efc903a3c2628205630e5ebe8bcecd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768961549, "uuid": "23fc9676-e065-48c6-822e-555e41e86f0b", "comment": "Malware payload (AsyncRAT)", "value": "9ec31e8aa332633ab9841a3e7d39849b353ca87c34613f39cc8dcaa4049a65609a455b3c0541dfeee54091de75ef2d7b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768961549, "uuid": "b719cf46-6247-469e-9c9d-497695c362dc", "value": "T167233B0037E9812BF2BE4F78A9F25145857AF5633603D64E2C8442DB5613FC68A527FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768961549, "uuid": "cb499161-e19e-4682-9fe1-f64d490223f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768961549, "uuid": "7763fafb-8b7b-4575-9063-7f9a54f01e53", "value": "768:fuaqg0TJ8RsUWUWHaimo2qgfK3KMccFR2PIgGjbVgX3iZcOfeM0nY7BDZeei:fuaqg0TJCA2Cz7//gqbyXSZWYtdhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768961549, "uuid": "28b0d8e4-e9f3-4d39-b7d5-e022f33bf725", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768961549, "uuid": "1f580ee6-af4b-43aa-a171-189429bab9a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768961549, "uuid": "2a8c67e0-58b8-464b-b2c0-0555a5a400b3", "value": "VSTImperiumStrategic.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed7b216b-f6df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769010207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010207, "uuid": "0755e7c3-3703-494e-8854-cd0325e673e6", "comment": "Malware payload (Mirai)", "value": "4d48adb347d78eb96d7e5857e074463e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010207, "uuid": "7a85f11a-28a1-44d7-9ac2-55c19832b208", "comment": "Malware payload (Mirai)", "value": "b1eca05ac8f0dca29557632c95eab45b6cdedd3a594cc28c6d94ce8f7ef37bba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010207, "uuid": "c1b955f5-ed4f-49dc-952d-611db7a0ba4e", "comment": "Malware payload (Mirai)", "value": "8ef299bd740ed3f0126bc0e1bdc85a06b0e4486e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010207, "uuid": "df01416b-6435-42a3-8357-f72a256187e5", "comment": "Malware payload (Mirai)", "value": "9142175683b44bd6178b0e2f19a00c65c195fc7806c6dd2ced283837c9f97157b51b57f903f2cbde953782ef1c5c4cb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010207, "uuid": "f3c6fdcc-ee7a-4fbd-bd8e-dc3902379f17", "value": "T13D13F1C3D291E3A9D6ED54FE526C288B53C69658308CF1EFA9405279272EF01372EBD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010207, "uuid": "1276f340-31fa-4be0-be43-1f3947f9a286", "value": "768:K1vN4xLQwhaIc6MYAEtyvTIENtSGQeutvF4HHKEVhxGnbcuyD7UHQRjn:K2aLuty5QPGK6Gnouy8Hy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769010207, "uuid": "18e7eac4-a938-4011-b757-910cc8b1cc2c", "value": 41668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769010207, "uuid": "bbe025ba-7464-4424-b026-d6cbd4aec1a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010207, "uuid": "ad0e461d-d005-4b8a-a4ee-0e4334efc694", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11fe44fa-f69c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768981062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981062, "uuid": "f43e30b9-e8ff-44d0-998e-bfcae386e699", "comment": "Malware payload (Mirai)", "value": "f88a222914fd2d31b6a8b3d032ff37a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981062, "uuid": "0d58cad5-4f2f-4e21-af73-f3f7a7102c62", "comment": "Malware payload (Mirai)", "value": "b310a0529262be39d484d45c0a4a503b995cd0fbde1ecc330deaa0b53a5d048d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981062, "uuid": "a0a33830-282a-4138-a591-ddb144605a02", "comment": "Malware payload (Mirai)", "value": "d81099b66788672ac6333b52f8258164c96e4136", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981062, "uuid": "8f1f0837-c225-4637-a0d4-308fd13236d8", "comment": "Malware payload (Mirai)", "value": "38cb6d5b0633ab7b5799e4c984c9d864d1db23cbd2323ded94e35cad5bbf059cb150de1192534a31ea12bef2e4dc46ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981062, "uuid": "c9b7b9da-56db-4314-b648-461c43ac3977", "value": "T184833A41BD815A12C6C513B7FB2E02CD332613A8D2EB7217DD21AF11B7CA95B0D7B552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981062, "uuid": "5b0a1ab8-4ba3-4600-8802-7e0167f5543b", "value": "1536:CjBxPVWi7JyqvGCe1JYwgMeHn80tpwjk7rjg/7leCR/VvN/wbZnU:CjBxPVWyuY7nfbwjkyw8hwbZnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981062, "uuid": "1a6aa8ad-8487-46e3-8113-4a147ccc618e", "value": 84720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981062, "uuid": "fc651774-04fd-4734-9aa6-0ee3b83f7d2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981062, "uuid": "08286e1d-cec0-4911-93b9-23c29acc1253", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "460e01f5-f6a0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768982867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982867, "uuid": "5f9dc80b-cdcc-406f-a14a-7011eeef936e", "comment": "Malware payload (Mirai)", "value": "dc70ddfca53c48babcd48874c32af8d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982867, "uuid": "88c839f3-8ca3-48e0-af02-052ca22dfe99", "comment": "Malware payload (Mirai)", "value": "b3c874e5363d5e8bf05be2833b61aaa2a1e283ad72d0b2493b43c05c6d294b2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982867, "uuid": "b36ee94d-e6e8-4366-9ddf-5bcabfaac7aa", "comment": "Malware payload (Mirai)", "value": "75b74fcd176776eab20249a952a2981a0959a9e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982867, "uuid": "01fc4e09-0064-445b-89dd-89bd013c7e8b", "comment": "Malware payload (Mirai)", "value": "7e6fc73442414c4b185548ddd9629533dcd19013768704d28604e3a2ed8dfa6001f6a42808b25d073a33e8cbd5f8d56e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982867, "uuid": "91c98c03-29ed-4a26-9256-309942477d80", "value": "T168D3F746F8819B12D5D511BAFE1E124E37231B78E2DE73029D24AF31778A9BB0E7B405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982867, "uuid": "cf2fdf75-1ba1-496f-8690-81d8df159ebd", "value": "3072:Gzd1emY0+MxOIXKI+h35E/Qk/vplaCq2ELL:61emYlMPXyh3EQk/vplaC0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768982867, "uuid": "96547e52-be10-4f30-8e25-5cb5bc3a7a31", "value": 142844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768982867, "uuid": "f71a6530-b107-4b46-aa49-2ad4d79f8861", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982867, "uuid": "6ed11f53-1edb-4c55-beee-7e2f7ca33492", "value": "ub8ehJSePAfc9FYqZIT6.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99cd4a67-f6c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768998899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998899, "uuid": "e410496e-f0e0-46e9-8c36-ad86177bbe66", "comment": "Malware payload (Mirai)", "value": "22c1116a028a37a8d907854ee4d76d7b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998899, "uuid": "4a489cd1-3abd-45f2-b556-5c870cb96302", "comment": "Malware payload (Mirai)", "value": "b4a6eb0aec12764e95f22031d9086ec7bc5421dbde97591c172c04ad447d7e64", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998899, "uuid": "da6d02db-5cc2-4768-9312-ac551ba8b97c", "comment": "Malware payload (Mirai)", "value": "30fece1846139e8d68e58b42a6708d5531997ff0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998899, "uuid": "6c9e8ed0-1b24-40a2-b65f-cf123eddd8f6", "comment": "Malware payload (Mirai)", "value": "408e5543d43e80b4563b30ddca2f908af2bdf63c659316004529d6a792c1b82d40d8ef5b3d37f4b9f8b35053a39f72f1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998899, "uuid": "481eef37-496b-46dc-a7d5-9b10bf4195d5", "value": "T1AA5150DA41906771EA06854D77F031F4528BB1875BDF8748EB9C181CCEC9E8C7B85E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998899, "uuid": "8bed0501-7081-441b-b9fd-ce67eb2915e4", "value": "24:pc2JMvZbiBPYuZeENEnE2EhEiPBbwk3JUfgHhM3G:pc2JMvZbiBPYuZeecvyxBbwgHhM3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998899, "uuid": "1c38aba5-3c13-4b4f-a2dc-259033c13269", "value": 2907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998899, "uuid": "b42ffc24-3c1e-446a-8818-5297cf748fa4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998899, "uuid": "3af35f53-96af-4539-b8fa-8ec7dde395b5", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7161551f-f682-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768970055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768970055, "uuid": "5871678e-769c-4382-a843-51e004fe74b3", "comment": "Malware payload (Mirai)", "value": "d239aca025f75e64bfce2dff1e6e6eb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768970055, "uuid": "6699a190-f2fb-4ee6-ac1d-9885a433494f", "comment": "Malware payload (Mirai)", "value": "b4fff2ce77b0970f1359ba7cb7b6df24dff91f911cbcd9195224fedf42b70b44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768970055, "uuid": "9849186e-0aac-4901-a107-0bdcab0cbff3", "comment": "Malware payload (Mirai)", "value": "bc57b2ccee54a0c9166dd6ac8647ffc23fde4b7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768970055, "uuid": "f2f3cb84-d923-497c-953f-0b4673e909f0", "comment": "Malware payload (Mirai)", "value": "bd27633d5b88153b2deaebaa9d7a22cefb3e15f802eb9db36c864a17ba55e7549eb2136128f76279bc27eadcf7dae18d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768970055, "uuid": "ee07d27e-297a-4d15-8081-4bb5e74643e8", "value": "T13D734D02770C0E43D1A75EB4263F27E0B3EEE59021F4FB88650FAA869575E335186ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768970055, "uuid": "d3b3ee06-5f49-4d5d-9ca2-45960469aa84", "value": "1536:cqUOZ5KAjv6aDHSAb8AizPsBI5hG1IU7LmwYXc2UwbZnI9:5UKDj31BIC1mX0wbZnI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768970055, "uuid": "6626a6e4-85f1-41db-a969-da28427bb81b", "value": 79276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768970055, "uuid": "5db5e2a4-462a-47e7-a915-080f09c18a0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768970055, "uuid": "47d37ef0-97a2-4714-91a2-e745960f2baa", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a61ab73e-f6a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768984747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984747, "uuid": "2145716e-196a-47f9-a725-3bfc974cf8e5", "comment": "Malware payload (Mirai)", "value": "0d25a2366fd910cdfa789a99e14fa1de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984747, "uuid": "f1910ba6-74b0-41cd-a36e-d91d98a0e47b", "comment": "Malware payload (Mirai)", "value": "b53d6c3b01bc974d90de9e3c29136632ea0477c4cd1988acf57545682e5d0c9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984747, "uuid": "555c5043-1306-4f4b-a4ae-91de2168c7b4", "comment": "Malware payload (Mirai)", "value": "b31736e2f60e2b0c169c48a1f04ffc1565fb7345", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984747, "uuid": "7fcafabe-e531-41ca-b33d-106845701658", "comment": "Malware payload (Mirai)", "value": "43f32cf5f9358c3e39c5aac4b620a535903acc2169c9c312e0e35f721c3547c241d753bc9d21829ab3a71f8caa1879ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984747, "uuid": "a72b8b7e-9e3e-4099-801b-193ba87f84da", "value": "T17BC3E185BB6369D1C1A342BDA4C00AC387916E318FA313480699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984747, "uuid": "6f5167be-cfb3-412e-abed-31a625568890", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTna:0OCDjXG9qTWywxlxTna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768984747, "uuid": "509b95ec-8f42-45b1-9506-efd49a59177e", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768984747, "uuid": "21bd354b-563c-4bf8-90a8-f4584a0e4199", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984747, "uuid": "c72e4363-dbcd-4446-861e-e5327aeefa60", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a144fa-f69f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768982378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982378, "uuid": "2cbaa9cc-c65d-48aa-971f-e816d8c8e103", "comment": "Malware payload (Mirai)", "value": "fc2472229c3fd3829c73d43f7fa8c1fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982378, "uuid": "ebf9a609-7562-4c08-99a8-7d5a97c12e63", "comment": "Malware payload (Mirai)", "value": "b55690f4f710386027c4c98aeddd6758858112783e55ebb413f4826691ee6dc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982378, "uuid": "d5149bec-e81d-4949-bf7d-361b3625ccf6", "comment": "Malware payload (Mirai)", "value": "6068a18b94d9d7a82da797e6adc087e38efca716", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982378, "uuid": "e07c529f-705b-41cb-8d5e-4430ee9c19c3", "comment": "Malware payload (Mirai)", "value": "20146e66a5894ae67a3e6695f9f59b2beb15eb5c0200a164f85c7d13fc96b7334afb70e31572fa41c0236555a9d293e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982378, "uuid": "c366b9a1-dcb0-4c37-ae2e-56636913dd7f", "value": "T1C1B3D085B210AE56C02272FCB1870A90D3B16E7B4B9A150B4473F5B46DBCCD47E1BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982378, "uuid": "f85c5260-8857-4386-8acb-c1d81a7b04f3", "value": "3072:X5Apzl9NOvXoVLAE375lhYy5SkOXNwu5/:aevXCLr59hmNw0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768982378, "uuid": "e8b78225-aa77-47c1-b06e-1bf4c3fc3274", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768982378, "uuid": "61333245-139c-4e33-b25c-2c1fe79b2441", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982378, "uuid": "0cbe1627-2d1b-4656-902e-e4560f09e3e3", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8ed4a4-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768998610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998610, "uuid": "32812137-1f3c-48ee-9ba4-22d2542ee092", "comment": "Malware payload (Mirai)", "value": "1c9daf3633c115299bb7bb4959d6248b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998610, "uuid": "d0aadf21-1ec6-44a1-abdb-3dece625d0d3", "comment": "Malware payload (Mirai)", "value": "b575139501f0f3628594f7658c27f2ffcc639bd027645d5d9dad65a52742f295", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998610, "uuid": "c06077e0-0758-4afe-b0a6-156564062be7", "comment": "Malware payload (Mirai)", "value": "3f69bea1cd66675b5ea50b9b6271fde87c89a176", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998610, "uuid": "4a347b86-f273-4bd2-9c26-fccf35460f23", "comment": "Malware payload (Mirai)", "value": "b4cf763ca943bc7aa33336ddeab200db03a5f72302675168524815c6e3e18636ceaaa15d3eac11a82b95c6881f0ae38a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998610, "uuid": "620087ba-1b13-44a8-8730-57f1aa3ee997", "value": "T180B309567710DF62C22DC23006F3C7526BEA26D226E29549B26DDE0C6E7134D682FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998610, "uuid": "76a953ff-c785-47db-8d48-17f11c503889", "value": "1536:w8SUD4Qr1a5Qr8mVlH22++AliBtaD+3NS/JYODV8E1rL6sqTyoQvr8lI:w8SUD4aZ1TH22++AlMtQSC8yqTKj8lI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998610, "uuid": "5ae30cb4-da09-4e5e-b81c-7c2b2f9650a6", "value": 117800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998610, "uuid": "153f7c69-5d1c-4bc7-b458-7d3c1ef1f742", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998610, "uuid": "b2b4c24d-c0ad-4dc4-9a39-93970c41656b", "value": "plasma.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b654f42-f665-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1768957643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768957643, "uuid": "1eaf5623-3831-4828-9669-f10dd0b4bcab", "comment": "Malware payload (XWorm)", "value": "95f44cf7f938efe2e219099933a4469b", "object_relation": "md5", "Tag": [ { "name": "191-96-79-215", "colour": "#C135EA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "pluginjsupdate-com-br", "colour": "#848A83", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768957643, "uuid": "61c701f8-07f6-4b91-8ee4-0e66fa8e9976", "comment": "Malware payload (XWorm)", "value": "b57e46c3fa90bda23ffb9f1a5b7d962dc2226734653d92349bef54265e78684e", "object_relation": "sha256", "Tag": [ { "name": "191-96-79-215", "colour": "#C135EA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "pluginjsupdate-com-br", "colour": "#848A83", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768957643, "uuid": "af5c384b-0770-4529-897c-bf64db6f9d27", "comment": "Malware payload (XWorm)", "value": "db7f8764138732d58623ff708a3f4858ec81cc40", "object_relation": "sha1", "Tag": [ { "name": "191-96-79-215", "colour": "#C135EA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "pluginjsupdate-com-br", "colour": "#848A83", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768957643, "uuid": "9a43fd29-dd33-4726-91eb-9209c6c96230", "comment": "Malware payload (XWorm)", "value": "4807eabb35f39b8e0c60624e7da83ac3a537f9d03650882d001277191921e2e88c113818a85303990c14df95ac0dbb88", "object_relation": "sha3-384", "Tag": [ { "name": "191-96-79-215", "colour": "#C135EA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "pluginjsupdate-com-br", "colour": "#848A83", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768957643, "uuid": "dd3b873f-c420-4ad2-a462-f44c7ac3d9e8", "value": "T18D2512676550241CC2C090ECD1D5EF1DCEDAAAE9B60AF5E214A1EFEF93607798C2086C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768957643, "uuid": "a35d2dc3-897f-4263-ada3-551cabaea4a4", "value": "96:SnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnZ:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768957643, "uuid": "7b3b7390-f4bd-432b-b8a0-d5cf87544637", "value": 1049913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768957643, "uuid": "64ef8cf5-544d-4362-bed8-2ba07504a586", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768957643, "uuid": "a6f1ab5b-0db0-4cb6-ac60-35c34d88125f", "value": "Atualiza\u00e7\u00e3o-PDFViewer-v.56.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f5bea8-f69c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768981127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981127, "uuid": "f67d4079-7289-4d9e-8e1e-7e597cc09e90", "comment": "Malware payload (Mirai)", "value": "c1a7744f2a66c950538f28e1e2d4f2a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981127, "uuid": "9b04cfe4-eae5-4e42-b791-7666596d55b5", "comment": "Malware payload (Mirai)", "value": "b624c781abddeb411a18947520a17d21991ddf2c6c82d802a820d2645baa8f85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981127, "uuid": "f2f4a088-812b-47d2-8a8f-593c8ed36a58", "comment": "Malware payload (Mirai)", "value": "8d2620ceee747a7631192d14aff453835145dd2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981127, "uuid": "7804d031-d9da-4e23-964c-5fa0c9c9389e", "comment": "Malware payload (Mirai)", "value": "567aaea803c78f14e399f87e29b92bec82bda65bac977416ceb219d18afd46bc420bf82e423e5e95c1ad8b15c7942aed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981127, "uuid": "80a8ffbb-25d5-43dd-b5e5-a9ee53da88e0", "value": "T11CF33B46E7418A13C4D61B7ABADF820633239B64E3DB33069928BFF43F867990E57505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981127, "uuid": "311e56ee-7465-4eef-91ba-1d04a0318a99", "value": "3072:0K4rgjAE6Zn+8o3b/hsRta7NCkHulbvM/9RW+mew8qri27:0K4r2j6Zn+86zORtaokHulTM/9Lmew8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981127, "uuid": "344632fe-d130-4e79-9a66-b92671d641af", "value": 159066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981127, "uuid": "7b80fc60-662d-4745-8ef7-ab415af595b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981127, "uuid": "febe06a1-2c05-4562-af66-568a7ee773b7", "value": "ub8ehJSePAfc9FYqZIT6.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9083b288-f6a9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768986858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986858, "uuid": "26d34adf-94aa-470b-8504-709565ca2956", "comment": "Malware payload (Mirai)", "value": "69a37f3ec396e0a16a42dee9f6ff6bca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986858, "uuid": "caed13de-8d57-4ed5-92a2-638887ea1318", "comment": "Malware payload (Mirai)", "value": "b6416c2b6acbd2208c0ee0fce606241e27a1dabfe13c2d54926b5c0e01a4ebe8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986858, "uuid": "5b509cc8-810e-4baa-bc68-b321fd009372", "comment": "Malware payload (Mirai)", "value": "e4432272b0a4b643b20605a933d1502462069c01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986858, "uuid": "3acf0c1e-4ab5-452c-b9d1-4d021e97abac", "comment": "Malware payload (Mirai)", "value": "4fa49336560734fa199e3a7b5dd9e8a943de9de4cc871f9a75735f2372c681e7ea6b622dc1d5313e8fcee5516c0f6ed9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986858, "uuid": "a31227bc-d4e8-4b0d-81df-0a4e7953dbea", "value": "T122430250E3879622D9F46DB8CC290AD5B2F34B39F1A6622B6300491DB493E35ED2375F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986858, "uuid": "495f379e-d795-45ee-ba77-fe90d38075f8", "value": "768:Rle+F0sEzBunjXr9gwUiJ6cSOtnSU5go2r0D38buYV+McHgxSP2wT81fkWLLs3Uw:R3F0NujXCwz/XKo00obuK+Mpy6kWqzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768986858, "uuid": "b5f28052-a198-42aa-b243-d5faccc5eabd", "value": 56344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768986858, "uuid": "b19217a3-2a49-477b-a36b-2abcd256af0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986858, "uuid": "e16fc405-f2a8-49ac-827e-0e85f5dc2cb7", "value": "Orbt.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb3729c-f6dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769009078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769009078, "uuid": "74c0d900-6d32-43ed-bb13-1bec1b77e5de", "comment": "Malware payload (Mirai)", "value": "3756fda34fde7eeea298b14597aeb064", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769009078, "uuid": "bb59b1dd-32b6-4a51-b81a-a18a121cf132", "comment": "Malware payload (Mirai)", "value": "b6cd4b3f6b6ad8dc23475229e9fb3ff1e13f712c6e662431f99658d03607939d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769009078, "uuid": "c53ab7be-4f05-4bbf-b5d5-035556e57170", "comment": "Malware payload (Mirai)", "value": "ac37c3bd3e4033ed93962c01efe124d365c45a6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769009078, "uuid": "9c56a772-8c6f-453f-a65f-4098d5bd8fcd", "comment": "Malware payload (Mirai)", "value": "1c1d53728920e6629c250e6415df6b383dc3463b6a2a92ea38d5dcda5575d38c4dff0af3fe0685859af840cde6a642a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769009078, "uuid": "803de930-33bc-4780-9169-4b84a7dcd9eb", "value": "T114338C62EEAADD58D61C55B074348B7A5B536200D7872EF3969ACA798003DCCF24C3F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769009078, "uuid": "983dbdb3-6147-443e-b2e4-ce2c55898dbd", "value": "1536:5/O/dlyXXwJbb1jwXZ3tgC/qhAJT2bVR:VSQwbb1EtgGM6T2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769009078, "uuid": "2204f870-736c-40ea-9061-d5ebe032e136", "value": 54480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769009078, "uuid": "b90577b0-fb85-4c0a-b11b-35369694b14d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769009078, "uuid": "c1f69830-b3cb-47a9-aabb-78a5b277315e", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07500e0b-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034731, "uuid": "90f57fe0-c321-42ac-8c89-bf9324a49f49", "comment": "Malware payload (Mirai)", "value": "088f4af754714a7b59751af0818953cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034731, "uuid": "9a2e5500-c8a6-4945-a4ae-cac6b8211f9e", "comment": "Malware payload (Mirai)", "value": "b704fd1611df32c2c2268493314eef146d109f0031fddf40d9a340149c87ab3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034731, "uuid": "4a5b8159-52a8-442d-a74c-9e72e65032e4", "comment": "Malware payload (Mirai)", "value": "f70e77ed493c4cc50f9d7e3925ac88e0ca6317ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034731, "uuid": "779f70fe-2f23-4567-b4f9-a77a840d7e7d", "comment": "Malware payload (Mirai)", "value": "2a1b246d7d93f0f5cf10823fd18090c885c3bf8662ed545cddfa74294e72d1cb2113d3a8802028ab20ade6ea6144e04c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034731, "uuid": "29ac0ff6-6716-4537-a078-db8b310f40ca", "value": "T19E04B719AB510FBBDCAFDD3702E90B0139CC955B22A93B363674D528F54E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034731, "uuid": "b0ac9e68-0485-4b7d-9bd4-0105d1c34365", "value": "3072:nKpzG1eNkSfcQqmav8SqaRVlnYz65PVt:nKY1eNYQqmeqavlg65P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034731, "uuid": "9540d651-2176-4047-97fc-029765f43e4e", "value": 177760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034731, "uuid": "61320f2e-c1d1-44a2-891c-d0e8a236dc20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034731, "uuid": "ebcbdb07-fb09-44ed-ba0e-e20ce40808b4", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927d6e19-f6a9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768986861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986861, "uuid": "4875b300-e406-4028-a4a3-1dfb236d16a0", "comment": "Malware payload (Mirai)", "value": "f8ecbdb435449d5286e283d78d5eb966", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986861, "uuid": "d5b41938-68ce-4ece-8b80-c935b3af2910", "comment": "Malware payload (Mirai)", "value": "b737664012c4ff04ff9017fb7b0067d87dc2a5f3f6b736bdc720eb72db6df64f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986861, "uuid": "357a5229-465e-4e43-abd3-e673c834b5bf", "comment": "Malware payload (Mirai)", "value": "f9d553d5ecdf754321b2c84d6c4696b082ba114d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986861, "uuid": "dd3347f9-3179-4257-88b4-32da5c15b3c7", "comment": "Malware payload (Mirai)", "value": "c6a4516c5c44ea7c06134afb722e6019001516207e6f877297282c0477889f7162c211d49c76972b515c62956c845836", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986861, "uuid": "52dd7cf0-88a3-4509-843a-480bdd01836b", "value": "T18F833987F800DDBDF80BDB7B4463090AB670A3A15A930B3A6757FD53EC361A54853E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986861, "uuid": "b4e8ea8f-ac82-4d6b-82ec-456a26f979de", "value": "1536:v6WShpqVyOadkFCHjCKU1OTpAQ85NroT+h6Gmek2JGuIQi62ABRTsNBeTBnYY:v4iad9HjrUwTpAJ2fG/kCt2ABhsHeTB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768986861, "uuid": "8a66b417-2cd9-40c2-b723-64fe32811f3f", "value": 88444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768986861, "uuid": "1e8566f5-1b0c-4fbd-86de-c2bf764e2878", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986861, "uuid": "b302d6a5-7563-47f6-a0e4-30b62ce19523", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2865c89-f718-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769034670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034670, "uuid": "2300510e-7a3c-457f-b78f-b562e3d86b1d", "comment": "Malware payload", "value": "b88602a0db0f6700a3a4d62e1c7f964c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034670, "uuid": "784e1545-e67a-4695-b0c5-72bf12e77868", "comment": "Malware payload", "value": "b78899437b963811fcdb7807a1c8e4416fa13ec681023896df3b8d76fcb6dbcf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034670, "uuid": "5a54ee99-2cbb-4921-9313-a23bcbae23b0", "comment": "Malware payload", "value": "1f4ee83ebd9065629d4dddb721dc08eceddafbd6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034670, "uuid": "9d960246-09c5-4e48-a210-c995745b1800", "comment": "Malware payload", "value": "527ac234f56ebc205a5824a8051833093f29890ff0eb49e83e61d57f86426c1bc60152232b5beffc8a9e07497c90f2ac", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034670, "uuid": "0d35034b-2b2f-4234-8933-b20755b4eab0", "value": "T1C301B194313461B075BEDCE64E72AC1831C990D63DC67FB97C67B0DAA5A5D00B8A20B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034670, "uuid": "a416ea07-ee4c-4bbf-b695-3d9266062a59", "value": "12:YkF1kcClZF70TGAf/HFKf/HFTf/HFWjLlRBFSrL8+FM5gFiLEjLlRBFSVL8+FMD1:ZDkH/FlK/HFs/HFL/HFWj5F6hFM5gFiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034670, "uuid": "7a257149-3408-490b-b4c4-067ae341e069", "value": 736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034670, "uuid": "dc5be5e2-191b-432f-b402-77fe31c9cbfb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034670, "uuid": "ab1bbcd1-4132-4349-9c63-58c9c785b19f", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0942b9ba-f6c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768998657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998657, "uuid": "e2d8c069-55a6-462c-8e78-9379957754d0", "comment": "Malware payload (Mirai)", "value": "9aa0fe15784370c1aa9e9bf49ad30672", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998657, "uuid": "205e49ff-ada0-43fb-bf1a-8c03672d0d59", "comment": "Malware payload (Mirai)", "value": "b7ceb57ea8201a722e903ea4737cf36803b34a13f597562358073d05558ad589", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998657, "uuid": "d18d3c5e-08d0-4221-baca-5e3364b910fd", "comment": "Malware payload (Mirai)", "value": "ce8bf508b97cc6930777b8f3f8731e7aea3f0398", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998657, "uuid": "9f98de58-89d1-488f-9255-b787c0b2a9dc", "comment": "Malware payload (Mirai)", "value": "e3d47879831c5fca69b323334514d9e3136a2d250b8b4fdbd6fb08a121eb6ac67f6bcf060da829a885807d2c75937d86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998657, "uuid": "5f8e143d-26dc-4744-9e18-f2c063774e2c", "value": "T17383F78AF9819B11D6D565BAFE0F51CD33534BACE3EE72029D245B2427CB92B0F3A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998657, "uuid": "1092580b-7c74-4298-8053-04aa9f37c71d", "value": "1536:n9nZyNmvfJjbUs00723oeftJ6U6GjRA0aEJrZj8ql0UisCoV3lZ8Ym53T2bVRA:+NmvfJjbUFoydjRA0aE3j42CoV3lWN3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998657, "uuid": "5e91eea4-09b1-422a-8afb-d6f98b6c6034", "value": 83316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998657, "uuid": "2296ccf7-7266-4ec1-9afd-afaa502e98d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998657, "uuid": "ecc7653d-32b1-444b-9389-949426e00760", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a280d46-f6c2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768997531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997531, "uuid": "4e5e282a-cd9f-41a4-802c-259be6b1495c", "comment": "Malware payload (Mirai)", "value": "7cbfab95b7fdaa38740af889d35dd43e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997531, "uuid": "78875584-4126-4a6f-b579-bba184d7b6c8", "comment": "Malware payload (Mirai)", "value": "b7d96798516fa85f5c8d0bc3100236c65771d665ca2b917b95e6f4bf8c98861b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997531, "uuid": "8bb15477-3d1e-4b7b-9862-691653fc5b5f", "comment": "Malware payload (Mirai)", "value": "bb7913d20b6dfcc14f5375ee3e33d62ab1ac7847", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997531, "uuid": "bd00c60d-70df-4f60-a687-04250ef785e2", "comment": "Malware payload (Mirai)", "value": "54a844fcc699df94638a190de0694a6497375ddb52203a338c517dd5db0e55e36ffa188d73014c8005c48cd91af79c02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997531, "uuid": "18c41a27-1bd0-48df-8971-a12274f9c2ef", "value": "T15AC32AA6B9529612C6C625BFFB5E418C37171778D3FA31038E116F21378B82B0E7B691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997531, "uuid": "951b34fe-0956-4b70-8984-438e75b0f63a", "value": "3072:A7UOWyuku5ChijzCInnwgjS76xmthwKxnt:A7RuO4uSBjS76xmteCnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768997531, "uuid": "f33e408a-6fd8-44aa-8940-22886819bd49", "value": 121808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768997531, "uuid": "4b7d188c-d2fe-45df-a716-995f12445a02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997531, "uuid": "92073d4f-c872-4398-b386-0f0e802ae8ad", "value": "goon.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1897c2a0-f6db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769008131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769008131, "uuid": "cf6c5880-4c54-40ef-9e31-385b56c2cbdb", "comment": "Malware payload (Mirai)", "value": "2b2cfca31b77501f75298096cd4848be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769008131, "uuid": "76385ef4-26de-45e0-97a5-20ff04a79e7c", "comment": "Malware payload (Mirai)", "value": "ba804ced09162590cad97403a59518740c1759205b9219d3066252bb5c05e7ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769008131, "uuid": "a949e032-6cf4-4332-a4e5-5898733d11d2", "comment": "Malware payload (Mirai)", "value": "c1981c71ef2ff968375380ab22a1561b1106395d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769008131, "uuid": "40369349-e039-4e07-9ab0-ad746dd88a55", "comment": "Malware payload (Mirai)", "value": "0cf06073018138103e20055e9850b8dcfe9ca1edc461d63a344015d1a4433090a952d8f7e8856d1676a469ed85b78e69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769008131, "uuid": "4a1e005a-5fbb-4684-a658-972bccce84b5", "value": "T199936CC18143E4F1E9090235607AF3376572DDB90178FEF7F7589A726825AA0B14BB8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769008131, "uuid": "ce9f8578-237d-4418-a2b8-2b014c899831", "value": "1536:FL7tf+q6nvtD2ops8k6JrUN4QRl2H6GEOpb5EAD8u6ODbfn8QshyBFAxubZSAxX9:VxfV8VqoKNCGRw6GbpbTQJUbfn8F8nj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769008131, "uuid": "23d43553-faf1-4478-9c8c-a4da5d99de0d", "value": 91124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769008131, "uuid": "3fc434e6-1eae-4fcc-87c1-e0d885b07e86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769008131, "uuid": "550966be-1c9d-4bf9-ada2-daeaa3e756ba", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342ff5ae-f6dc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769008607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769008607, "uuid": "c711073d-8f16-4e13-8a1e-44cf86781aa8", "comment": "Malware payload", "value": "bc176263cf986b2046dd91066ea2f7c4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769008607, "uuid": "efd292e1-dee7-47e1-87ad-04bd346ae395", "comment": "Malware payload", "value": "bad997403e357b55511320a42e29f40cf0fa532aa58c677ad15f6cf1dfa805c0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769008607, "uuid": "6d9795f5-9208-46dc-aa6c-662f7562b06c", "comment": "Malware payload", "value": "85e7b9cbf58110d5b163425df7d0cedf4715143e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769008607, "uuid": "7b766e66-1331-4ebc-9559-0c57f5d6f0ef", "comment": "Malware payload", "value": "bef765a0092aab36d776eaf618f0ba76433adfa508a05f8eb45e44562abbe399618331db3894e94c36b94981e9375195", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769008607, "uuid": "89e95b21-885e-46aa-bb4c-f1edfbb625cb", "value": "T18F11A3CF144499302ACC94F83AF39B5C684016EA39D4A60DA99F817794CFA0CBB5CE2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769008607, "uuid": "8f7b53aa-9b4c-4821-be59-739ce248310d", "value": "24:/xZO6kX3v6g+gykX3v6NtNXkX3v6AdAnkX3v63OykX3v6vJkX3vXw:ZZ/k2kGkMkEk6kvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769008607, "uuid": "7f349296-f12c-4925-9510-c3e1cdd615cc", "value": 855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769008607, "uuid": "661f24c1-5d42-4de7-bb4c-4380f2bda5c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769008607, "uuid": "1b0cfa46-dbf4-43a7-a0aa-59eaacb3f51b", "value": "fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "433c57b6-f697-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768978997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768978997, "uuid": "dd5430ff-4ec1-42d9-a23e-c39bb89d96ce", "comment": "Malware payload", "value": "2aa989463fa9f13af4f8e5085b0aecbf", "object_relation": "md5", "Tag": [ { "name": "BitCoinMiner", "colour": "#69DC5C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768978997, "uuid": "2c16a11e-81f3-4bfb-aa81-569358da28a3", "comment": "Malware payload", "value": "bbb8a7999133f4a545cf79b35ea183c601112a3e9151e3d1f53dbae0eed8424d", "object_relation": "sha256", "Tag": [ { "name": "BitCoinMiner", "colour": "#69DC5C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768978997, "uuid": "e295f3dc-97e5-41ce-8f55-0af2cebafe21", "comment": "Malware payload", "value": "5bc86befb28e49229515a0e3dcf6f75ebcf44639", "object_relation": "sha1", "Tag": [ { "name": "BitCoinMiner", "colour": "#69DC5C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768978997, "uuid": "163d8de9-40d9-47d8-886c-4d4d64d66519", "comment": "Malware payload", "value": "69ce8f314c4218228fb7c19983ec546011b221584b3b866a0d1406648c26e407260cfce4d853c96b63efb9229ea3fa2a", "object_relation": "sha3-384", "Tag": [ { "name": "BitCoinMiner", "colour": "#69DC5C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768978997, "uuid": "35a4e0f3-d318-4754-9037-98fed9b64ce3", "value": "T100572330F99A8980C5523FB8D6A8DCAA7C022C968C540306558CE97F777A7277DB378D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768978997, "uuid": "40fc0874-794b-41a3-ae70-4523f32b49e8", "value": "1cd069a1d0a6220306935daaf0c539a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768978997, "uuid": "2bd6ac87-aa94-47ec-b521-54fde25b762e", "value": "786432:+bXQ5rngbxj5wUtsKKvfqJ2tUzWVSgODe4aJd:+ULglCxHqJ2tUYS/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768978997, "uuid": "9fe29709-84c0-4a68-b3aa-90ed92e3af13", "value": 28340752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768978997, "uuid": "9ee79b86-446a-4f1c-8d53-bc38f36dca94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768978997, "uuid": "3d937198-28d6-4216-a1cc-f9542de204a5", "value": "bbb8a7999133f4a545cf79b35ea183c601112a3e9151e3d1f53dbae0eed8424d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858f8f50-f6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768985121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985121, "uuid": "101db4dd-fda2-4579-9605-19e05ddf8ec1", "comment": "Malware payload (Mirai)", "value": "874e4790855ec6d9aa4e74e95ced5026", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985121, "uuid": "c9afd3ce-bf06-4210-bdc6-b086d0767960", "comment": "Malware payload (Mirai)", "value": "bbbb569969044ab930a078bc559c8fc32efe4635fbb07228070c094cb4b2cb03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985121, "uuid": "5ae6d19f-8989-49c5-bfb7-6e615154d9bb", "comment": "Malware payload (Mirai)", "value": "1f9105004feab7e07968f6ad9d8342ad2a9c36f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985121, "uuid": "854f0395-c7c5-49ec-a396-3eb078933f1b", "comment": "Malware payload (Mirai)", "value": "7534a8b848541fb4d4806656f34dbeebff64368a7cc53c28feadda366dd6693a0c9352a3f87771729ad9cc3e241777ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985121, "uuid": "433dcde2-20f3-47dd-a6d5-748a303e8f72", "value": "T189735B2279762E17C0D4F87952F74B68B2E1175E2AA4C61E7C330F8EEF2265412535F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985121, "uuid": "f545f476-7624-4323-b43e-8f942b76cb75", "value": "768:bvKATjfAIVw9DiXU2IGYQIY/EgaT4h1BAqHvoDa5VsJO+0gZxwe/wSGi:bvKATzfVUDiXU2IG3STYDZv2aDsJWe//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768985121, "uuid": "28f02809-cbf5-41da-a428-a438f01b8c4f", "value": 77368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768985121, "uuid": "2c148733-c76c-4141-b5c0-2883a4884a4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985121, "uuid": "6efad277-dcaf-4487-9d5f-d5d4d747645e", "value": "sdxkzX_UXA229x.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c038ec8f-f6d3-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1769004977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004977, "uuid": "2a662ed9-721a-48f7-8348-72337fd1bfe4", "comment": "Malware payload (Formbook)", "value": "6ff9c5dccd030904d672ced8149bd12b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004977, "uuid": "4a39d307-e184-4682-8640-4b77c5965796", "comment": "Malware payload (Formbook)", "value": "bc6465558acc490cbd746bb80000a98c0bbbabd3eb9d36a95e9bddf9d9493098", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004977, "uuid": "9f9d9e86-b36b-4cf7-9a1e-52ca31f9bf60", "comment": "Malware payload (Formbook)", "value": "c97459eda2047e85c6926f60eae402af9af5d117", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004977, "uuid": "2ca5d2b3-e7e9-46a2-a97f-4db547ccf473", "comment": "Malware payload (Formbook)", "value": "c084f7a645ba46ebed7d61be4fed25ddafd5b63060ecaaba695b4c5e0ab6fc536a87b1cfa69f81511806171a5d6edbac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004977, "uuid": "5dce19f9-d4d3-44d4-9182-f327129235c5", "value": "T19D7385CD3FC6F275435930672A2BA05AE12E8C5072DC80E5E5E394D4BF6C318E6799AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004977, "uuid": "ea59b52e-b097-4849-b797-f412fd3fc1f6", "value": "1536:f0VAvrGXAfFDbVGQqGPcvkL4xtf74zLx+jDO/wORI0Y:y4SwfFDxCk6eJxjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769004977, "uuid": "ec0bdede-8678-472b-ac6e-48466a969c91", "value": 77710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769004977, "uuid": "5e5054d3-1b71-4699-af00-453eb51deb8d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004977, "uuid": "d91b5bd7-7489-4ae4-bc09-b54f5d92e6d0", "value": "Shipment advice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67498b22-f69b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980776, "uuid": "f1390c93-1e64-49c1-b04e-22426b504646", "comment": "Malware payload (Mirai)", "value": "d3b0153eef66223c1b7a245b1a5e9216", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980776, "uuid": "871f3c35-0e36-404e-a43b-2f83407cf7c2", "comment": "Malware payload (Mirai)", "value": "bd60405fe30e29f984e0dbc4a02783558e146ac4feaf431c116345d12b62bb75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980776, "uuid": "7a9e493a-2393-4f59-aaba-103989b3c1fb", "comment": "Malware payload (Mirai)", "value": "28c739ee72ec34b083753ef46ce2b2eadff327a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980776, "uuid": "e6d2ed26-f424-4a1c-8fa2-0ac1000ff15c", "comment": "Malware payload (Mirai)", "value": "71d93c50bcaef5b984b89ff5daffee26af183ab3cef05b65ece9224bb24580b97b1ffc9f6e089463902ecff198b69cbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980776, "uuid": "6679b486-51fa-4476-82be-999bf7ec972d", "value": "T12EA33985FA83C2F6E81B04706062BB3FD731DDA9407ADE59DB9A5E31CA33541C3163A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980776, "uuid": "d86bea2e-3a27-4fe9-b131-f464c4122a96", "value": "1536:obthztlKSAiG4/HlOK+fSbHjIjbPKG8m44HYXT3BpW0ST5Z+MIP:obXBU4/HlOK+fSrsjbr8m5HEBczT5Z+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980776, "uuid": "3d82f808-6251-4674-96cb-fa12e078ae14", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980776, "uuid": "fe602eeb-9e32-4a06-96a6-f6909c9d1fe2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980776, "uuid": "8d77919b-d06f-4066-bc83-830da647e934", "value": "ub8ehJSePAfc9FYqZIT6.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec62c69e-f675-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768964678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768964678, "uuid": "a04564d3-25cc-44fb-bd9b-c48349b396bd", "comment": "Malware payload (Mirai)", "value": "c679f2d378cfe423517e6e46ead50df5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768964678, "uuid": "03bc3373-fa44-429a-849e-542d59e1752f", "comment": "Malware payload (Mirai)", "value": "bd968f1043cb459e875d3ea8480cd42f8871300fae0caa67920158bff0d427b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768964678, "uuid": "93179fb5-86fb-4df8-be3b-de61471441f6", "comment": "Malware payload (Mirai)", "value": "82d2c318755f0e5fcce8c6392d4be1386e60fcc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768964678, "uuid": "dc2a4557-7d93-4073-9624-940b67c18e31", "comment": "Malware payload (Mirai)", "value": "a80f46b0ea1b16dbaac9b7b3047e4b5d44d155ededda7c3e8d0c428d1df2e1d4ad57907add35f5090c74c8a849e3deae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768964678, "uuid": "155c634b-47a3-4908-92bb-7ebbdc5a3fa7", "value": "T1D193D709BF610EB7EC2FCD3716A91B0A348C651752E97B3A7A34D918FA1A50F05E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768964678, "uuid": "de4a8cc5-c78a-406c-ad01-3e40ec238c08", "value": "1536:wUtjoX7TVuLvrahddr1IfSASM2Rd1Bfrq4CzKWr+VD5cLxenC2zZM0YLZM:DtjoLhdd5IfSAT23NYQzlzoZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768964678, "uuid": "d1038fbc-0954-425c-b7d3-37f8a165ba8c", "value": 97168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768964678, "uuid": "a5b9f48c-ddc8-45ef-8fe3-27eca014b064", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768964678, "uuid": "982f12f8-30e9-46a9-8785-8d5628cc8c76", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d1bc42-f6d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769003503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003503, "uuid": "03b74cc5-27b5-46ab-b9b5-38b46d90d091", "comment": "Malware payload (Mirai)", "value": "06b6f8e84c6e3af4e92fb69c086720ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003503, "uuid": "0eae7700-0778-4b8b-9697-de96877946c4", "comment": "Malware payload (Mirai)", "value": "bdbbdd8c8d18fd71eb50f7c2e937b65c11c34bf2fefd50f6bc8c07604a3b79a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003503, "uuid": "f166c557-fd6c-4c4c-b837-68138588f6e8", "comment": "Malware payload (Mirai)", "value": "c7d8d58618c1aa965ed6c94d5bcc4caede19eb7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003503, "uuid": "05e6a317-c6cf-4a67-8b62-6c283a0f241b", "comment": "Malware payload (Mirai)", "value": "cae848df0d84cf3571e3f2fa2c9b564959ce6f91791207fdaacff1c9b502874ff377dd80a16d2dbec8a5f059f226ab71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003503, "uuid": "03555617-fdfa-4ae8-84d2-d8d1ac977271", "value": "T1BDB3AF87B2907ABEF0A45E3FC4135E26A6259F705583273D71BDF9906E3A3503292E43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003503, "uuid": "dfff1bf2-9758-476f-a20c-6975276243df", "value": "1536:toOxCg+uUGWkCqYUqwaJ1XqfXg5AcS5blaZeCtjHXNLdCS2T15OvhSkzp8rSx:t1xKlGWnqTUcXgZS5gZ7CSXhSoUSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769003503, "uuid": "fe961ea7-cee7-40c3-8c21-2120210816cc", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769003503, "uuid": "3e833141-ddfb-4d30-b2bc-6b2e4baef3a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003503, "uuid": "d96d2ba4-4473-4d7c-b68b-8d2b7f476689", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "828c91cf-f69c-11f0-a129-42010a9c0007", "comment": "Malware payload (SimpleHelp)", "timestamp": 1768981251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981251, "uuid": "161ea807-77e7-4ddd-a813-291d51c3d95c", "comment": "Malware payload (SimpleHelp)", "value": "c61696dbe25160bddcfb78cebcdfaa33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981251, "uuid": "59dba6ed-70ea-43fd-9a04-03b6ca1750bb", "comment": "Malware payload (SimpleHelp)", "value": "be5210d8d9dfef2b31b8908e4751b158f55b5a9ad921e3ef516615bee0a8bf9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981251, "uuid": "ded3ecb1-01d1-41bc-8a2a-9d2b2decd4c3", "comment": "Malware payload (SimpleHelp)", "value": "d80f1fc235b9150cac561d77eadd9a503db8f705", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981251, "uuid": "3a51f58b-8cf2-4897-b5dc-52b7b97a3bbc", "comment": "Malware payload (SimpleHelp)", "value": "1dcd0a22debc305299f7e6ad88f5397ff545aa9736d8811f42d8b267f205c4b66d4e9efd2382ef4a38aeedd2091c97d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981251, "uuid": "5bd704ef-d54f-4f7f-b69f-f172bff4d453", "value": "T1B485C034E6A15DBDCF37AAFCD08E44DB979BB9A203C5012717F086D68B613D0542EE29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981251, "uuid": "acb7de19-f31b-43ca-9afa-7f983a84b250", "value": "8e73f0b1ba8e9ea271385585fb4d5c02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981251, "uuid": "8e14b84b-7a5a-4633-b882-537765902fc3", "value": "49152:MOlCQ8msodjHF2bg2h0kSKX15dIpRkud5ou/btq:PXJrVRR75ou/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981251, "uuid": "4d77a88f-cdf6-482d-9f0d-8e74657c4358", "value": 1721928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981251, "uuid": "bf78bef6-fa71-4998-9598-6a202c82c86a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981251, "uuid": "0813ecad-efd2-483a-87ec-349a70acec26", "value": "Remote Access-windows64-online.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b630bc4c-f6ab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768987780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987780, "uuid": "6f9cdb5f-7c96-4aa5-9ed4-a00a005f0e0b", "comment": "Malware payload (Mirai)", "value": "d47e4576295bcd70ee872d917671df7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987780, "uuid": "120b17b4-d669-41e2-af19-977182541be2", "comment": "Malware payload (Mirai)", "value": "be92ec997c66ae7e7b5fff3887f81982e4ce0d28b62af7d9d2a388b657cf0be4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987780, "uuid": "3d157b97-4380-4871-998d-aa394a5a44d4", "comment": "Malware payload (Mirai)", "value": "8573626f0fdbc0cdad8c18635889bf7af84be3c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987780, "uuid": "f76438d5-8247-4dfe-ad47-dfe4cfaa4b29", "comment": "Malware payload (Mirai)", "value": "3103d8ad9583c6650bb4065e9a5c8dd11d8640cfdaad0c0a6458b21871a7cd7c8b0973a280f5bf5690b060671b23dbd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987780, "uuid": "e1a158bb-cb42-44ca-b89d-2b41fdc952bb", "value": "T16A14D70AAB910EBBD8AFDD3306ED0A0125CC555721B47F7A3674D528F50A64F8AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987780, "uuid": "47258477-5f41-4432-ab0c-5bc13cbf9d39", "value": "3072:X2bGdeg/KEYEaL8Znj4nF1Q5Uoaa9MBF3:X2bGdeg/4EaUkn4uCqBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768987780, "uuid": "80954058-92e1-4b94-85dd-8dc7fa7aee32", "value": 198524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768987780, "uuid": "015364d2-cc69-43de-a142-617a68306b6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987780, "uuid": "37cad91f-1208-4558-a8c6-db16df08e4a6", "value": "Orbt.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d7abef-f6dc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769008741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769008741, "uuid": "9167f6be-9a1d-4b28-ba28-4854ea73c37c", "comment": "Malware payload", "value": "1157bdd430885fddfdee8ee1adb43b51", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769008741, "uuid": "a3c58fe6-ca9b-433e-aa93-2f547d35f9e0", "comment": "Malware payload", "value": "bed9b6e8a20ce6388da32e2473f2dd3523782828326f3ea46856cc6c099076ad", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769008741, "uuid": "bea722dd-8862-4a7a-b97b-682e0ceb6220", "comment": "Malware payload", "value": "032826f8892b7da5b9002ac8d5d5a7ade6eec0d3", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769008741, "uuid": "32a3a33e-f797-47ed-995d-9b38ddcd7ea0", "comment": "Malware payload", "value": "5b14fe2ccb843892cc5a1ceef85ed8501d676f2a8979567730c6bd60bf0ec10343cc8c083200d782193b70c5c07f1c00", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769008741, "uuid": "c9dddb02-3c37-4b26-95aa-3b6e87ff77ad", "value": "T119A11F8A7CEF676242F767B5C9365C54F46A632351818200BA7C01E86FB1628C2F7D5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769008741, "uuid": "0ebb3225-1e47-4226-ab67-54e3a3fc56f2", "value": "96:lfu3fyG1sLqFloDojj4AqD4qx3gXVryUVVy6tDcHNdHEXojFurqTIcY832euT6N5:Q3fyG16qFl3kgFryMVy6EtxIu939BSdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769008741, "uuid": "dbdf892d-7435-4969-a3c4-113a364466af", "value": 4910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769008741, "uuid": "7e341e2b-e22f-416e-a3ab-fcf9d7833820", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769008741, "uuid": "7035f9ae-04d7-4388-b0e5-232e508333e3", "value": "seocore.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69dd0a9e-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034897, "uuid": "057694f2-7367-416c-9e91-14ab19646d80", "comment": "Malware payload (Mirai)", "value": "fcbea4830a145021fe41b8556de49d99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034897, "uuid": "396d211a-c747-4a50-902a-1a65329abea6", "comment": "Malware payload (Mirai)", "value": "bfc0640f2489867fb6befa8ffe3d07610d44a47b95602091b342163828297673", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034897, "uuid": "c06c5885-879b-4fde-b9e4-2053067b9c41", "comment": "Malware payload (Mirai)", "value": "f7f2ba42ef4182e7fcab45f0a9df51df58279dc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034897, "uuid": "bb437b88-5384-416a-a733-f938fd65f01b", "comment": "Malware payload (Mirai)", "value": "ce603838d384fdd22f4c11a27312305b1d1b61ae33b19c89e606379a3495b9c1ad1645809fc61a832e27ac4c7c7af831", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034897, "uuid": "71b0d26e-0c5d-4635-81c8-32cd77408044", "value": "T1E3E36DC9F4029E7DFC0BE57E44670D19FA31E76132830B2A629BFDA3B9311960D56E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034897, "uuid": "a26ceb66-109b-4254-b4bf-0ec17b09f7f9", "value": "3072:syRLWDOIWGbgMVPKNeDJ/UPN/bzpKyjLPvELTURNpN:MyIWogMVP+NBvjLPcURNpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034897, "uuid": "54f56b2a-9421-47db-a14d-335b11a43232", "value": 149980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034897, "uuid": "90b533e1-556a-415d-bd81-a650d3dd5712", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034897, "uuid": "80cc99af-9e1a-4bc6-a04e-b4620658cfc6", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1151efd8-f69c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768981061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981061, "uuid": "a6380d35-ae6a-4527-bbd5-1924370f46c8", "comment": "Malware payload (Mirai)", "value": "c3ded5683b8b2d506785580b4d4f0e8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981061, "uuid": "46ebb72a-9a12-4fdc-883d-279076b37b75", "comment": "Malware payload (Mirai)", "value": "bfee630b1aa2a364e6436ddf1559ecbbe858b15b29c70027eae47cb5076b37e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981061, "uuid": "d1b49ba2-95ee-48f6-accd-f9210ac20b03", "comment": "Malware payload (Mirai)", "value": "c7b770503f566a34822c2e79e50514ee6c7f31c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981061, "uuid": "7eae2cc7-7b82-49b5-9ada-b2772447bafe", "comment": "Malware payload (Mirai)", "value": "19306d85a8190ffdef8fd83df7a1848b4884ec5bdad80b4f2d2c17c40e1dc596dbb5e7b267cc6b2a220662bd76d3f6d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981061, "uuid": "99889102-dc6f-4e22-89aa-4c06635ef59d", "value": "T1D4636CC5AA53D8F0E8660771117BA73377B2E43A1038DB53CB65B933DC46A02D5972AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981061, "uuid": "22bdda7b-7b5c-4fea-96dc-fa6713627f22", "value": "1536:HiWLKBDFmwLTkwMfa2s5LLyEhNlruohtqBvdq1QBM/wbZn5T:JLKBDFmwvkwMf/s5LLyANlyofqvdqHw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981061, "uuid": "602675fc-6132-4c73-99c7-6b529d20da28", "value": 70740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981061, "uuid": "e77f4623-8cf6-467d-bd75-0cbe54774f4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981061, "uuid": "6a01f004-7f37-4fea-b84c-7bfadfa5674c", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a0bd5f-f69a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980402, "uuid": "92917844-f709-451b-b00e-13c38e97ee1a", "comment": "Malware payload (Mirai)", "value": "c25ba1dec655e943d9c1b06b067ef8f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980402, "uuid": "a3b84206-2575-4b0a-b9f4-20bb00f1abbf", "comment": "Malware payload (Mirai)", "value": "c07cb98f1ddb2129365e7b30a4c4a3314e9ea63b140d0ba7d67056bb2e79e92f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980402, "uuid": "ad30b096-3cae-4bb4-909e-89cf7fef3ebe", "comment": "Malware payload (Mirai)", "value": "336e168e12b9476d1881f04960f087cf29ac1a5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980402, "uuid": "68ac8b55-8b7b-4cd5-b7c0-e7943d4b2520", "comment": "Malware payload (Mirai)", "value": "e80bc5407cf4ab96526a0d594c44abe4aaf50eceee6b40285e50d3010669d8934e2a3e9b6def4e0d494c3dbf12e234a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980402, "uuid": "fc9bad59-64b2-43dd-af88-ea1631c7115f", "value": "T11FD3C021E4006DD1EC2129F578BA96BC0350EE740BDE1582EFFDE95E747BD98386D2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980402, "uuid": "3241e0d6-8510-470b-93a2-28281d17791e", "value": "3072:PHiBTNkAgcly+hoVpE6AKUjq+8biA7JBd/xTQ:PCdny+hovsmzbisJfJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980402, "uuid": "9f1504b1-da01-4b70-944c-e05349c9df85", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980402, "uuid": "5fc9f463-9187-4065-9e90-5cea9dce9ec0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980402, "uuid": "09c12d4e-729b-41c0-9fc6-d03df08ce7ee", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2a4f05-f690-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1768976277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768976277, "uuid": "674d28b1-0cfa-4935-bed1-3b24453ed31c", "comment": "Malware payload (Socks5Systemz)", "value": "aab9a786c9e23f10c8caff6c660ca2f7", "object_relation": "md5", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768976277, "uuid": "7a74d85e-f7bb-47bc-86fb-8d1df1f1895d", "comment": "Malware payload (Socks5Systemz)", "value": "c0b43fcbf11f551a74a8d204ceae8b8175086babc6cc6776c43da64a93328553", "object_relation": "sha256", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768976277, "uuid": "43b4e76d-5aff-466d-a450-dd8f72e0f75a", "comment": "Malware payload (Socks5Systemz)", "value": "ea3527e70a2c04f51b2d44c2b1ecaae3e9f6ec80", "object_relation": "sha1", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768976277, "uuid": "9f921ed0-4257-42bb-9d21-c09d95edbc86", "comment": "Malware payload (Socks5Systemz)", "value": "cc46f42a0c31eeb71ae4386aa35b80a2b9ddee2666faed8c968ec8a739b52c95ec649d32dac1422526128898fa257ccf", "object_relation": "sha3-384", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768976277, "uuid": "e8f4c29d-f24e-4054-9469-f9bc1d8d116f", "value": "T170063317EAB8D47AD62319B8DC782F2256193E2A3D3C0515318C362CFA3767DC816B9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768976277, "uuid": "5c4bcf1c-6ecc-40a6-a5f0-6fa00f3560b4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768976277, "uuid": "0d98b6ea-388a-4795-b270-65d292d70563", "value": "98304:MbWObdlgEl8YZsaoGPSVfC2DRVU3lKdVambtncOFh2DtOJeKUzx:hOxKk8YHdaZCeRVUoVam5Jh2hlx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768976277, "uuid": "18f6f0a7-abe7-4b17-a35e-def387a286da", "value": 3978489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768976277, "uuid": "8d960f5b-2109-44e6-8130-b1c9087014b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768976277, "uuid": "d39bf0e5-1776-44e7-9436-4ad01b37babb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81854d40-f6d3-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1769004872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004872, "uuid": "bbc0990d-0660-4e99-be43-a5b15400b787", "comment": "Malware payload (Formbook)", "value": "035a0f915e9e69f2067e9355ed47a4aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004872, "uuid": "3aba6a10-58ec-4206-b599-9718c8efb753", "comment": "Malware payload (Formbook)", "value": "c0cc84e8d967fe70569439c2cf9d76f9d5112954d04520eb3fc8634dd75c0db4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004872, "uuid": "96cd361c-b6cf-46a8-b493-35d250e7a901", "comment": "Malware payload (Formbook)", "value": "1074d7f8ca45e4a54688e71c4ed03998b2a147fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004872, "uuid": "10a34f81-74bb-4a3b-9d49-a6bc1fdec805", "comment": "Malware payload (Formbook)", "value": "415c716ee3e27d320c881b548f4d6a54ee59f014698e7e750087d7ce185a56d8eb5951f942c3da3485398196db43e23e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004872, "uuid": "cb190a91-0d6e-487d-9204-ff695a0a090f", "value": "T1E36523718E24EC6B169C4334207F6F0E9ED50FB2C849A9C6726AB0E38F5EF4951A7417", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004872, "uuid": "7d9c867f-46d4-4089-9823-c40ca27394eb", "value": "24576:nGht9SRYZrDI61RFTZkkDl6NMni1UCQxFIMeyBt1TeLv1uFB+4FZQ9udLU7VGHxq:vggC3pWMnV4cgLduFd08RPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769004872, "uuid": "98b0f409-68ef-477e-a4a8-aa2de1e09d16", "value": 1429275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769004872, "uuid": "2849a25f-7e06-4e0f-933c-a76795d94b78", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004872, "uuid": "cb019f95-b8b3-4a9f-bc69-44659e6597cd", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7497edee-f6c3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768997978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997978, "uuid": "95511a8b-405e-471f-8740-374488479c92", "comment": "Malware payload", "value": "1c4e3ae4c121efe33e4c50e0271693c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997978, "uuid": "f3163a34-010e-4950-aa2c-be28ec1bb585", "comment": "Malware payload", "value": "c0ce4d44b991347e886ce00435f646ac23db470461dbdabb88ab044f60c50f75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997978, "uuid": "f7a5a988-b012-417d-a5e4-3e90305fd3cb", "comment": "Malware payload", "value": "4caeebd0fc12cc4016c37ecf3bbcbddcbcfe0701", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997978, "uuid": "75f5c952-c1d1-415d-aedf-00e7a6adad4c", "comment": "Malware payload", "value": "53639592139459b8c123559c3fbfd857d2b0e6522a2cf64322fe9a2698de3581d27f84a714bafeeeb50010a22802f2c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997978, "uuid": "bcbec6ab-7620-4381-99de-e63575d7c1b9", "value": "T17C763312A6B7D0BED9704834DA6DA20049695CB20F9B9DC7F3E4BEBD5536483E620F70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997978, "uuid": "165e1e5a-9ce8-4bb3-a45f-b6bc4f488f34", "value": "c58a6fdd5514cc5114ad09dc07384b11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997978, "uuid": "4c7b8fb5-fe2e-474c-aa11-5e0847990ad6", "value": "98304:GBrlDk/dD5z84KvVHSraQTlYgFgnVhGF6uRyqD9M+2Rs2FczAb3OW66jg5:GBZY/j8bdZQTSgmhGFFyj+wsyccTKwg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768997978, "uuid": "682dab2e-080e-4721-835f-bc64f73eb5a6", "value": 7220957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768997978, "uuid": "cb2104fd-600c-4a56-91a8-61e3c014f864", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997978, "uuid": "1fc44a92-0825-47de-be0a-f4e18576c603", "value": "\u8bbe\u5907\u7ba1\u7406\u90e8\u6625\u8282\u503c\u73ed\u8868.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa2640ae-f671-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768962983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768962983, "uuid": "498dab07-50c9-4e6f-83ae-5711ca947e49", "comment": "Malware payload (Mirai)", "value": "006a87688a54365abb09467e80da925f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768962983, "uuid": "d1e5fcc0-aff2-42f0-859c-af9c0a40e8c7", "comment": "Malware payload (Mirai)", "value": "c1c6e8a8ec3bdc6136f9a29a60697256b8cb05ae25928b3c18e3a5457a35f138", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768962983, "uuid": "c08238fe-b9d8-4287-a6c2-186bb5c93568", "comment": "Malware payload (Mirai)", "value": "044606420ee850fc614683fe699e504074168c24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768962983, "uuid": "45a310e9-2683-49da-9da4-cf4c0a682773", "comment": "Malware payload (Mirai)", "value": "aa8f4aee5e373e652ba22d71a045ec3aff61f6e5302d8360d7dc341d0152ef2026d7ef104111305857a2555e3eb2b923", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768962983, "uuid": "69f9039a-1814-4760-91ba-ca8549f9b2ed", "value": "T1F3E3B70E7E218F7EF268C33487F74A31935933D622E1D685D2ACD9151E6438E681FB68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768962983, "uuid": "33aea0e1-0dae-449c-9590-87ca8e433981", "value": "3072:6BStiySR1jNFH2o6ZJGzysBUG6AdOTafevsuDfo1o+nTP3us:ESIyShR2Tbxs1shEumo6P35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768962983, "uuid": "64cb3338-f048-4136-8819-cc5766c6950b", "value": 151036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768962983, "uuid": "d1562bd9-264f-4938-bc27-79693637beca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768962983, "uuid": "08c8a907-d2ad-4ad6-84f8-46421e818cc6", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866f6281-f6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768985123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985123, "uuid": "27db435f-3a48-4c24-8035-512ac20e0bbd", "comment": "Malware payload (Mirai)", "value": "a6adbdda2f4e55f332dfcb414308eaae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985123, "uuid": "eb3204a0-6238-4216-92fa-0ee6a7597e1e", "comment": "Malware payload (Mirai)", "value": "c22b631e109685d77cef7c70e083ed02aefed9e50aed1d37a440a36e989c2b76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985123, "uuid": "5b855e3b-264c-4672-a42f-6e3f04bda685", "comment": "Malware payload (Mirai)", "value": "d0994c9578c759ccbd12f2896ca317d337d1a4d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985123, "uuid": "01d8fc22-e346-4574-8374-5d2445b46efa", "comment": "Malware payload (Mirai)", "value": "54d83f5ea329969f9df468687d149097db038db010b00b7891266cfc4408b6b020d80dba34b120e9294be15f5264b4d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985123, "uuid": "b2171324-b611-49a8-b0a7-1eeb1448ec82", "value": "T1FF23019351929D1CC1B59C37E732909773AF8BE091EF387E7ED04128E4C56896A380EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985123, "uuid": "9b9413ee-60f3-4bdf-bc9f-ee2763e7ca3f", "value": "768:kJaRYPNoKzYPQzHWZtvx2j6fFLyNWcqDwyFonwauGXNQ3c5T9ps3Uozw:kJauPNoK8PQrItvxueFWFC/onwa3NX5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768985123, "uuid": "2d8f7a8f-5dc0-4929-b221-d818d9194a33", "value": 48380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768985123, "uuid": "e9c92eeb-107d-408d-82e8-c6e0f79dc8d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985123, "uuid": "17900db4-b8b9-494f-a512-2afd2b7005ac", "value": "ub8ehJSePAfc9FYqZIT6.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b954f7b0-f70a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769028587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769028587, "uuid": "ba76e302-ae81-4baf-8222-c59b463889ba", "comment": "Malware payload", "value": "b879d552bcc4dc3ce613f921f59b457f", "object_relation": "md5", "Tag": [ { "name": "Andariel", "colour": "#0DCC38", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TigerRAT", "colour": "#BD8FAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769028587, "uuid": "e706a479-74a1-4179-85b4-9715c76b0386", "comment": "Malware payload", "value": "c296a7ba8645ef6c06162228ca58618dcdc6f1205aec5680a7f355a53d2a0148", "object_relation": "sha256", "Tag": [ { "name": "Andariel", "colour": "#0DCC38", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TigerRAT", "colour": "#BD8FAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769028587, "uuid": "83b4b3b1-34b6-4edd-b6c0-002425e43d48", "comment": "Malware payload", "value": "6dac8eca7ec46b4986a7353eada438d350287c5c", "object_relation": "sha1", "Tag": [ { "name": "Andariel", "colour": "#0DCC38", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TigerRAT", "colour": "#BD8FAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769028587, "uuid": "6421d638-bcc3-4b4e-aa08-f15c324bdf2b", "comment": "Malware payload", "value": "43bbe18bdd4c28fbd89e4f567a3d8da290c88688420fd010f32c365e41cba46594da18e339c36cbe9ab646ab3f63ea4c", "object_relation": "sha3-384", "Tag": [ { "name": "Andariel", "colour": "#0DCC38", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TigerRAT", "colour": "#BD8FAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769028587, "uuid": "63012320-a39b-4723-88d6-c6847af6813f", "value": "T1B3146C0973B010F8F1BA9339C863D566E77278594761ABCF13B443359F236A16E3AB60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769028587, "uuid": "87115a41-9354-45e9-8d57-64a41cd08cf1", "value": "7480b30c10587c5899bfafecafa7322d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769028587, "uuid": "328e9988-dd32-43b7-909c-1758fb3a1e95", "value": "3072:vhmz2j20PGnlLIvFec7qYyW4RsZMwZRVz1n4riucHQC2etqQVf1su8:vh/NOnlLKUYyWmmZbp4oeu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769028587, "uuid": "93e1b690-88ab-4b1f-bfd6-f70c916353c4", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769028587, "uuid": "eae014df-b37f-490d-b6ee-5b2c1066716d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769028587, "uuid": "f4896dba-b1ad-4abe-8f2a-f75876f99873", "value": "c296a7ba8645ef6c06162228ca58618dcdc6f1205aec5680a7f355a53d2a0148.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733bb298-f6f5-11f0-a129-42010a9c0007", "comment": "Malware payload (SimpleHelp)", "timestamp": 1769019450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769019450, "uuid": "ecbf7f24-7ffd-4dd2-8826-edf9388146b8", "comment": "Malware payload (SimpleHelp)", "value": "6a8fa3825042a63b5fa985317df5aaa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769019450, "uuid": "275bce7b-a703-450c-8f8d-9b7969dea9ec", "comment": "Malware payload (SimpleHelp)", "value": "c2bf3df47c2a1192e4be8a5d2f6fde4206a7712ff44b75d8fbf7f40e717769c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769019450, "uuid": "d3fae344-3d2a-4a19-a0b4-27be09b52386", "comment": "Malware payload (SimpleHelp)", "value": "e8a7a1c82f89ea405181eea1447c5752540d3de4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769019450, "uuid": "838cfcfc-7be2-4831-ae19-fc9aa3534900", "comment": "Malware payload (SimpleHelp)", "value": "33b4cddaedf7fb6e84db01b60be6bffc51a54cdfd25be885a0508fa8774b57d4b902ec77ff0ac1c102eaeeef67ff0fb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769019450, "uuid": "e284fa4b-8c17-4b39-bb74-7e0a86668548", "value": "T18B873329F39599FECE33D0FCC0854487EA96B9E54385412717F085EA4E206E58A2FF6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769019450, "uuid": "ff020d3c-249b-4ea7-a5d7-4abcd04db162", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769019450, "uuid": "2307632a-301b-4bb2-95ae-d5b87f74fa18", "value": "786432:/rKU6DT0ucbTbMv22zAeV/X+0tdshTc3XyPteDeCOdeuKF1bd:/uRf+nAu2FuQd73XyFeDMnKTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769019450, "uuid": "4889247e-b82c-446a-9a65-1b1207e1697f", "value": 38833672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769019450, "uuid": "ff0f2d7f-5150-4a21-8652-70208c95fbb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769019450, "uuid": "5c70340a-2437-4a3b-a0fc-b1fa7750ff3d", "value": "invitelunch.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126fc966-f6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768984928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984928, "uuid": "328e2711-e25a-481b-aeb2-204b2e5a57e4", "comment": "Malware payload (Mirai)", "value": "e7652579fae9aee61da700df25ed4635", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984928, "uuid": "64c2e317-8eec-413d-bf1c-db96b35aa312", "comment": "Malware payload (Mirai)", "value": "c2f74d83d6ea88ea9275391cff7d6abebc1689e562aa00a0f083aae191bbae86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984928, "uuid": "75dd1738-ec85-4919-af14-2fb4a1824d55", "comment": "Malware payload (Mirai)", "value": "7af5416fdb3d41ce352b25bc6e6b47fa5c6c7c96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984928, "uuid": "bcf6ca72-8072-4fda-97fd-d96ad3e2e618", "comment": "Malware payload (Mirai)", "value": "acb30069e6d44da9f790d78c77b7f8e36c7cdab79b6c98392b41c6e4acd31d0ae882137dcdce7d90e34d15123063fc26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984928, "uuid": "5d3910b7-c25e-4f81-adc7-cc276355d9cb", "value": "T14533F28EE6D4BC24C17F0F3B814C4AE505886A19B64C6E22F3B3DC95D56F18ACDD0A79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984928, "uuid": "f52dfd3e-4c43-40a0-8d9b-5727f35edb41", "value": "1536:kb/g/o1PT4yC3tO3z2pgAnrV6KFcVq1wiI:kbNPT4VpaVqyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768984928, "uuid": "fd4bb8fc-3296-4406-8a05-672cdaa093de", "value": 53740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768984928, "uuid": "ec240c12-17c7-4d75-8c55-c58c8ca93742", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984928, "uuid": "b5a5119a-fe1b-44ad-ba53-0e758c6eb513", "value": "ub8ehJSePAfc9FYqZIT6.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ed4dc2-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768998616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998616, "uuid": "3feb6ef2-b54f-4492-9dc0-c3fbf14fb27a", "comment": "Malware payload (Mirai)", "value": "4dcc65fdfa008ceddb8a0aacdf77390a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998616, "uuid": "11adf960-c199-4274-ac59-b7cf722f6f14", "comment": "Malware payload (Mirai)", "value": "c3d58b9606024b1c12843b206ce83beccd00f0fd82f43b9148cc47453918b968", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998616, "uuid": "ede2544e-acb2-4f38-830a-fc51b3e97734", "comment": "Malware payload (Mirai)", "value": "f3dc1e664be4bd214efcf460023b33ff3c764ae3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998616, "uuid": "206ee97f-898c-45c7-bf6f-f726ea624bd4", "comment": "Malware payload (Mirai)", "value": "f9392339aba40df1824ac22576c093a89741ac9da79c419d0c4613b4260539ef2f1cc93e92481e9b4b12e57f84238e9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998616, "uuid": "1a86d697-1047-4f47-a46a-4e7d31443f70", "value": "T1A8C33A46BD605FEBC05ECE30462F831712DD98CAD3E5632E72BC8D8D396934949D39A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998616, "uuid": "e007efc2-bf38-4c5a-8751-17259251ced4", "value": "3072:h2tzsp+c838Kzi2dU5VMRCNxAAAAAAAAARAAFAAAAAAAAJz8cEM:h2tzsQc83S2dUV/cR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998616, "uuid": "6f18b39b-0d3c-4a3b-9a4e-3ea69785cf8f", "value": 122288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998616, "uuid": "558e914d-d72a-44b5-9fe3-499dd1e3539e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998616, "uuid": "ff603895-5c3d-40f0-aa83-413ebc65711d", "value": "sos.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c69feec1-f6cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769003269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003269, "uuid": "5c4cc58d-0ebe-41be-82e5-23ec25e7d9bf", "comment": "Malware payload (Mirai)", "value": "76f8d54d87b418a083b29d2ca7163bbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003269, "uuid": "5511245e-e244-48a6-9439-ad9e565bd0b2", "comment": "Malware payload (Mirai)", "value": "c49d92927aabaa9c7516a171a06cfd5f27fd7cb42aeae3aee782c6256e08b930", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003269, "uuid": "7d38dfac-3cf0-4b6c-ab38-7a7bb478e908", "comment": "Malware payload (Mirai)", "value": "b0b72d5134fa53948a741ff894e1d77e0b0c36d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003269, "uuid": "31456dde-dbe3-47dc-8f09-3c1b4e164696", "comment": "Malware payload (Mirai)", "value": "26bef99e59fcba0266007344f15159dea081781a5ebe02329978da197261d0d64813773e85a252f4d4408d25f678fcf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003269, "uuid": "bdf16dab-1488-4e56-be71-7e7fa79d4cc0", "value": "T127A30BC6BC81CB11C6C566BAFE0E51CD33134B78E3FA7203DE185B29674A86B0A3B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003269, "uuid": "6eda0ab2-54c9-4e75-a4c9-39a0ec80226a", "value": "3072:YFxNEjIY9n1RExXfp8ky33AGxHkfwg177U9EKBGzT2:Y8nYR8V3AGE17g9fY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769003269, "uuid": "d16ebef3-1f1f-4583-aa8e-027621dfaabc", "value": 103692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769003269, "uuid": "c10e104c-7b3f-4df9-a4fe-fa304cf92f14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003269, "uuid": "b794becf-24ef-4049-919c-7177d5c4b2e0", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50f2c8f-f718-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034674, "uuid": "09c471f6-f722-4d02-a9d1-bfb91ca06012", "comment": "Malware payload (Mirai)", "value": "a1034542e0e7c0c8f1016154ec143226", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034674, "uuid": "b79961d1-39bf-4a3a-9b10-b4c715c6c6eb", "comment": "Malware payload (Mirai)", "value": "c4acffa3105ae98a93d66d22c5ab96dc5dc191635f601fd6d7e13dbb4805bd56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034674, "uuid": "d1b20043-ee01-46ff-9dc0-6d48c02cc963", "comment": "Malware payload (Mirai)", "value": "7e79aa3a661c68dfa854be8dfe025f79302c8ceb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034674, "uuid": "80149e55-2f55-4c2b-9bea-d62666d0fa1c", "comment": "Malware payload (Mirai)", "value": "f4b67559cd0ee3cd7c4c4b4dc89a9c83d1650b0a004bf3e3b3122bf625029b6229184323408827d6844ad2d3e2c6c750", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034674, "uuid": "2d77bcc1-a012-4063-8765-abdb636d54fa", "value": "T104430846FC93486AC6D057BA772A96CA33A323B5C2DF3353C8180F516BCE64F0E66951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034674, "uuid": "d0f4a41e-abea-4a3a-95ce-ddcc19f3c9fd", "value": "1536:4/rRN+97eo93kJ9+kFjfydvAVjvZ4/f+1L:ON+97e7rjf0ovZ42L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034674, "uuid": "1c3fc25c-0efc-48f6-8b22-f16d0b556754", "value": 58352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034674, "uuid": "6eab1a93-5520-4a69-b58c-a997328d0d4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034674, "uuid": "a0b9293b-f204-41ac-bf5b-e26387aa3a1d", "value": "titanjr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab6ff66-f69a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980406, "uuid": "8c0c452f-59b9-4040-9bb9-94a2a61e8b79", "comment": "Malware payload (Mirai)", "value": "e0368c9c24722e084f1710df020b75bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980406, "uuid": "402b8d03-a876-4abc-930c-a9cf7f76d749", "comment": "Malware payload (Mirai)", "value": "c4dd5b3db895566f1c58556a36568848bd18bbde2efc61525b490b2d75ba2399", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980406, "uuid": "76bae2f2-f79f-4f1d-a86e-b35f96864278", "comment": "Malware payload (Mirai)", "value": "0c4b895b7b30bb66066d59732cbc09b214d1c65a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980406, "uuid": "0b4c6300-b2c5-44c4-9fa4-824f14418fc4", "comment": "Malware payload (Mirai)", "value": "397a0cd402cac64909581b074cd24bd3c346d895ea656b6cd512bb26b2a520bc9481e4d1ea34977565bb4854f5498695", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980406, "uuid": "ade08efb-cf26-436f-8791-8db9d6fd4982", "value": "T1E5F2290301BD6517D4F8A73902F39757B2DA7A9CA054871F7F3A0ECBBA623901E6A570", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980406, "uuid": "edbe05f2-e049-4ad8-b23c-9a06da2af1f2", "value": "768:jryswAIM1cywAvRKaqo/q9wU95MDoFiTYPR:jryswAIM1ctAvUaoBis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980406, "uuid": "b58d7728-ff86-4fc5-afa6-39dce818506d", "value": 34660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980406, "uuid": "fb33c98d-d205-4805-a30f-894c4b4e8f50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980406, "uuid": "d51312d3-ffaa-47ed-bc99-48e3c0918145", "value": "ub8ehJSePAfc9FYqZIT6.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33ec26d-f6a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768983883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983883, "uuid": "5b5c0603-17a3-4fe9-8389-5d2042b7324f", "comment": "Malware payload (Mirai)", "value": "ca593becaa14686045001dd0beefe554", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983883, "uuid": "9c287ffb-478d-44ca-9e65-fbf6b72f71a7", "comment": "Malware payload (Mirai)", "value": "c53e8bb9fa79063b5383d79d21490ab6d62215b23996f7386d86c697171bdacb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983883, "uuid": "1b80affc-80d0-4c6c-b0f0-1309577420b4", "comment": "Malware payload (Mirai)", "value": "ecf4d7566a28326b5a513d6687ba0d5fca70a8d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983883, "uuid": "ada9536b-6ef0-4ad5-a0d3-207d1064dcd7", "comment": "Malware payload (Mirai)", "value": "00379986694ba97154a8182211a3060e9df6822caf5aacf4f2829071ea88e0ca087d8919fc250b288a624d071a8aa278", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983883, "uuid": "82bebbaa-aa5e-4abb-933b-dba35f38597e", "value": "T1DC934AC5EAC3C8FAFC160575213AAB76DB33E17F202BDA47C39D9932A821511C61676C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983883, "uuid": "00024493-e3f2-4407-9296-466f7352b171", "value": "1536:5NllXn3Tq35VUeOywYRpsP6UNw2f0c1f+nvjaI6SQsfT9rTeSgo:5lXn3TqpKHY06UNNSnr7TQ8T9rX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768983883, "uuid": "ce475954-22b8-4fdf-acd3-2ab672fa0e96", "value": 93704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768983883, "uuid": "401eaf14-8565-4f45-a426-3d8d1c8a6982", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983883, "uuid": "bd0075c1-4a7e-4840-9501-c9cc75138cab", "value": "ub8ehJSePAfc9FYqZIT6.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d187a4d9-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769035071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769035071, "uuid": "9d63af1b-7071-4215-b2ec-798d0cadd14a", "comment": "Malware payload (Mirai)", "value": "5467f1513fbb074fc56846be27394a8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769035071, "uuid": "7c667f0c-5b8b-4abe-afa8-f82198cbec58", "comment": "Malware payload (Mirai)", "value": "c5d8177d169497d4199f822aa26831791d29469799020c10457cea63c89ddf15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769035071, "uuid": "2b8c5011-b6e2-419a-a271-97b0c54f3875", "comment": "Malware payload (Mirai)", "value": "fb71cd281457c543f0c84cb4b2f5a8f02d638bd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769035071, "uuid": "5cde8e4b-edb5-4d35-8a4b-42bc8d318c77", "comment": "Malware payload (Mirai)", "value": "7ee1f0b8bfd0b5cb504703887351e946dd1b73617ee1027be185e494a431b278748fa44800835511419bc2d3323627fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769035071, "uuid": "dbe8ce8d-bb31-4a43-b2ee-58351c03b68b", "value": "T146A32A56F8828B22C5D512BEFA1E118D331317B8E3DE72129E205F2077C696B0E7BD56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769035071, "uuid": "fc769672-35b3-4599-af58-ddea285d941f", "value": "1536:dHnma2wfW/bfiGdLqHjC3PU45GjIZiY+garvVYTfuQr5MsQiAw60pZor7kw58YJr:8FwfKfVdLLh4Y+garvmyw1pZorwwKor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769035071, "uuid": "10bddabd-971b-43bf-8888-a485ad044418", "value": 101092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769035071, "uuid": "fd8fe9a2-d178-42d1-8897-d0fc94f5635e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769035071, "uuid": "3a2f7fec-d89d-4cbb-b80e-4f8cc687a98f", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09deca93-f6d3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769004671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004671, "uuid": "7b61f725-12ab-43c6-a8b6-24818820c17a", "comment": "Malware payload (Mirai)", "value": "831c688b326a6852217727f582e5dc28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004671, "uuid": "0d402a3e-26a7-4bfe-8a48-f958db581500", "comment": "Malware payload (Mirai)", "value": "c5e05994f989740946304dc8788d134cc3494920a3075c6ef1698258423ba2d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004671, "uuid": "04e25f27-5312-4209-af3e-60518df1a51c", "comment": "Malware payload (Mirai)", "value": "eaedb224097b01ea026aa6c8ca60e1e2322830d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004671, "uuid": "e28a9c9c-51dd-4c3e-9afa-b18b255384e2", "comment": "Malware payload (Mirai)", "value": "ec70f39f69b699e7978890a15cb456e155dcceec621896bf30a6d524424a6494c268f18e2fefebd807d1f6af5a1c1156", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004671, "uuid": "36c89d62-a3e9-4e62-a1a7-eb5d2ca98f2a", "value": "T1AEC3090ABFB11FFBD4AFDD3345AA0749299C560631A97B7A3674D808F24A58F06D3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004671, "uuid": "43b69605-49b0-4247-ae8c-4243596f4da2", "value": "1536:qhuw5DuOukgm35/Kmol9/vT3aH0UJqhYCRvbRc81OhulO/U+pxpZfqFX39wu7r8a:qgU69/9uxqA32AMEXym7iET2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769004671, "uuid": "89c251f6-c9fd-42d9-8f62-8513e46d1384", "value": 123072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769004671, "uuid": "8e526c95-f968-41ea-b54f-110a0c7229c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004671, "uuid": "c1b1de78-3a6e-4a4f-8109-63422f938e42", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b962b802-f69a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980484, "uuid": "3e96aadb-6b4a-497a-9a43-b5db308100b4", "comment": "Malware payload (Mirai)", "value": "b89020c4d575bfde122060746aef233c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980484, "uuid": "9492e36e-63bb-4aea-82bb-e99fb74e1d89", "comment": "Malware payload (Mirai)", "value": "c65fc8ab14a25ef5bd39bd414eadb307b3f17abf7a6baed00315ec7428092c07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980484, "uuid": "10a0bcd8-5aef-4c19-b49c-6b2b6b139910", "comment": "Malware payload (Mirai)", "value": "da6314e79481c7cfeee38c03f3341a8bc6e62f90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980484, "uuid": "3382af1e-1042-4267-af18-626d51f30b40", "comment": "Malware payload (Mirai)", "value": "13086126a6e594a156a5d39e1dc6f5a3464d2e4aa47d3ba0780359b2e2ff81af1ed4a6c85267d0a28b1eb04078be7fc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980484, "uuid": "d5c2fe80-cd1b-4c96-89dc-eef7fe0fb1b9", "value": "T137E34B46FA818F13C4E9277BB5AF41493322A7A4D3DB730689185FB43F8276E4E63641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980484, "uuid": "532ed9a1-c5be-4a3d-9809-e6670a0d224b", "value": "3072:ga7eixH8aTpjkSPsbp5b/pMWiBwkV5YYk5gECof10cM/92Ykg:ga7eixH8aT9kMGziBwkVil52of1TM/9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980484, "uuid": "840c8aa3-d6b6-46d4-a8e0-458305d5a36c", "value": 149838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980484, "uuid": "31986955-3715-4655-b9c1-28c5c7516304", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980484, "uuid": "d580d369-d386-4a8d-9a5b-b28392866b3a", "value": "sdxkzX_UXA229x.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e512fbf-f6a9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768986881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986881, "uuid": "59441496-7a2a-4b82-9b73-24902d3e23b1", "comment": "Malware payload (Mirai)", "value": "59613289d27feb191455691d01b79571", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986881, "uuid": "563b7699-2949-4d2f-b58f-2863912dc6ec", "comment": "Malware payload (Mirai)", "value": "c671864e5660989c4d72bf6851fc59c08f8a49bbe8f9be68e9d9518e7af224a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986881, "uuid": "48e556e1-cb81-4589-88a3-ef0053726be4", "comment": "Malware payload (Mirai)", "value": "1a2ba46a3fb5bdc2a72be7a4ca020f451bccb5ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986881, "uuid": "2300ee7b-20b0-4f76-8c5c-392d76a43650", "comment": "Malware payload (Mirai)", "value": "e6ad530c9cdb4f58aeb2e9f0c05bec7d6712c9f0868da98358812a6967b10cd222b803c0159aa62bed35c7e4b1565215", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986881, "uuid": "2c5f51dd-a125-4cf2-9027-ad646598d97d", "value": "T1AFE31986F8C14E12C6C212BFFB5E428D772A57A9D2EA7103AD275F20378746A0F3B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986881, "uuid": "f0c5fb2f-bb01-4eba-9cc4-c6a7d87b1755", "value": "1536:uCO6GFZkQI5z/V3v25mUwvHdUsW/CtK4nlMpw4VP/7ioQ8s8wOMAqkpsHdtoLlt8:uCO79MFcFGH6RCtK414lGoQTkUnls+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768986881, "uuid": "c3760020-9e04-4a0b-a934-db758c20146c", "value": 148192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768986881, "uuid": "0a58110c-d607-4dc9-a617-6f1ec5447a48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986881, "uuid": "04257e7a-0f21-4fa9-9110-125ec3c859bb", "value": "Orbt.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3aad11e-f6df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769010217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010217, "uuid": "c2ce9d26-a66d-4546-ad30-483013b2bd1a", "comment": "Malware payload (Mirai)", "value": "fdca71dd7cfb4f565fe2023aa588b05b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010217, "uuid": "f3e66eee-1877-4cfe-a09f-2d375c0d8353", "comment": "Malware payload (Mirai)", "value": "c882771545f4951ef5f483116040739b490e76ea7fb9ef44552de98b285dace5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010217, "uuid": "07448b6f-7a69-4469-81b4-3e1f83578d53", "comment": "Malware payload (Mirai)", "value": "70f8a7a6b227a558538cb347ddd35551c9a0964a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010217, "uuid": "f6d5e054-281b-49aa-9ac3-080eef22b7d5", "comment": "Malware payload (Mirai)", "value": "aae30d64ff9ea0ab38fab7f20b22b43c46452c6c667ab604dceb57f96440af36d70fb7199026eb355b48e6880a762b2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010217, "uuid": "217acbd1-a397-40bf-a85a-119d120c1883", "value": "T162E30B46F8814B12D5D111BAFE1E128E37131BB8E2DE73029D246F647B8A97B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010217, "uuid": "2927b81f-033d-4cbb-ba68-780cb5027d0f", "value": "3072:DHea4CHoUjnwJIXMb6Azz1az/AWdYV8P4KLL:zePCHoQ6IXufzhakr8P4KLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769010217, "uuid": "767a55e7-d74a-445f-92ba-2ef496d2a920", "value": 144156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769010217, "uuid": "51eaf5d9-a2a7-46ca-8d56-cf8d89045b39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010217, "uuid": "af1950d8-d5e1-4428-be30-2ccb930fc285", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148ae7be-f68f-11f0-a129-42010a9c0007", "comment": "Malware payload (SimpleHelp)", "timestamp": 1768975483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768975483, "uuid": "55a48ed2-855b-4e5a-8642-9f1075e99c69", "comment": "Malware payload (SimpleHelp)", "value": "26bd64a4181cd6a9b65f8d262e1bc958", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768975483, "uuid": "b6988ffa-3a96-4e30-84ce-f0112b15f581", "comment": "Malware payload (SimpleHelp)", "value": "c8f6bc3900a17cc0d2ef0a92d2ff5669fdb3cfc962f6384a97060fae3e5b7034", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768975483, "uuid": "f169a5e6-ae82-4016-9e21-c485fa5e8eaa", "comment": "Malware payload (SimpleHelp)", "value": "b9d83549d222a7e99d40f01a231a1a332ccf1475", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768975483, "uuid": "7bb0441e-71aa-462c-a143-234259958b25", "comment": "Malware payload (SimpleHelp)", "value": "24f4c19559e359abcdd14c7055d5250cfc5b42765e26615e668f80768b9b97b60af5fb6122d74e7605c1bedd133ca56b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768975483, "uuid": "cf6de623-0c26-4f85-ac78-85382a05d451", "value": "T1B3373338F6E55CBEDE3BAAFCD09E449B575AB5A603C4012727F1C6D28B213D0542EE09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768975483, "uuid": "f78943d6-524b-4527-8e09-15ef3d6dc717", "value": "8e73f0b1ba8e9ea271385585fb4d5c02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768975483, "uuid": "8f2b29f4-7208-4c1f-a028-666e65b347d7", "value": "393216:+tolZoSUFNgCMOhVoBaAiUNaL70q1uzCJPeT8FJnehMOe5NI+Wb38:+tobo/qEVooAZNKYeJPeTe9B5JWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768975483, "uuid": "48b904e1-648f-44c6-91c6-379479039972", "value": 22855344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768975483, "uuid": "41668adb-4018-4252-acb4-b1049c8d786b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768975483, "uuid": "6823440f-4994-45d4-8e68-e845f0499067", "value": "eStatement565115398_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824108fd-f6d2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769004443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004443, "uuid": "b0fb888c-4e06-4bb5-9044-dc73acf00fd9", "comment": "Malware payload (Mirai)", "value": "39361fa4c44f8b61d5dc9c5d54febc40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004443, "uuid": "68f1e1f2-f5b8-4159-86bb-0864a56c9428", "comment": "Malware payload (Mirai)", "value": "c8fa8e3ea20df3792d97b69bdbfc3be45bf70e85983cd7ad7d2e0fa3c5af2b78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004443, "uuid": "ea87a9cc-3e18-441c-a68e-181cf465224f", "comment": "Malware payload (Mirai)", "value": "274645982b8d1d4e6923fb49eebe5262cb4c3e34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769004443, "uuid": "71e5bb76-90e9-48c1-8219-4b47deebd2d5", "comment": "Malware payload (Mirai)", "value": "e78062c8c460efbf0094b42a7957ace6714ce802733296eb3f3b2a8fa79dcdd6dd3a70a18c27d184633ab623428fc2a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004443, "uuid": "8dc64d8a-97e4-4aaf-95f3-cbf7247077c7", "value": "T113531783E400DDBDFC4DD377849B0E11B2B1B7564E520B67B332A9A7E9710E4486EE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004443, "uuid": "0ecde93e-749e-48d5-b08b-02b1c7abcacc", "value": "1536:P1yhWuu+KxE3w9UZ/qEQsFEjIBZCB9XvVsL0m8AzcgETPZc:9yh2aA9dxUU9fVsL0UcgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769004443, "uuid": "3f26496e-3e82-4446-9255-f561abac7e67", "value": 63196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769004443, "uuid": "e32a4320-97bb-4c49-be13-3e71420bee6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769004443, "uuid": "51837724-aa12-4950-b2c7-1f9fbbc9f43c", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40112f04-f6a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768985864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985864, "uuid": "7bad7b6e-2f40-4f42-b3be-c6fe36bf8c30", "comment": "Malware payload (Mirai)", "value": "80bb68ad17795b22393b5d01aabab47e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985864, "uuid": "d26cd11d-9e75-4b27-967f-14121a470ec5", "comment": "Malware payload (Mirai)", "value": "c936f7918e01eaf3bf1267f3ec4a1f3db2509e7af7ebcb5b4a28adbca944e11b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985864, "uuid": "1565f2b9-a4d7-452d-a73b-b1a5a0e6a939", "comment": "Malware payload (Mirai)", "value": "ee5af6b98ccdd8aaf4dfca4146525565bebcfd04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985864, "uuid": "5e379314-c5ba-4744-8dae-414e7023f6fd", "comment": "Malware payload (Mirai)", "value": "a7b8e2750a6fb2cafb410b8d3c35fef61f700fb463e2d37b51953697f88707afbad527c850cbaa85541e0221e562bbc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985864, "uuid": "09399417-dec8-426c-a2c6-c5d99ecdd08e", "value": "T1A904855D6E229F7DFAB8823457B34E20975923E623D1D684D2ACD2001F3029E645FBF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985864, "uuid": "64ee8b10-01ea-4699-8836-4ce618711415", "value": "3072:Y2e+VrVslZmp7ndFORhv1+7LOHTvYO3AQmchAREkNwBtN568sO5N1dJkInOCJGyy:Ynvmp7ndFORhv1+7LOHTvYO3AQmchARf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768985864, "uuid": "e18c2a39-63a8-4353-a74f-6a0551681df4", "value": 174124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768985864, "uuid": "7c6f9033-87e6-4dd4-ab37-dea6b22aab42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985864, "uuid": "e54574f6-4053-428e-bf7e-2d1b30531781", "value": "ub8ehJSePAfc9FYqZIT6.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f252c1d-f6d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769005190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005190, "uuid": "daef3ecd-2dc4-47c9-b04b-1efe11aea60e", "comment": "Malware payload (Mirai)", "value": "93af6ac1266d49246de8390f67478035", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005190, "uuid": "988dea71-9833-4de4-afba-59b2110ea3cb", "comment": "Malware payload (Mirai)", "value": "c9706034213249a5e980cf1e5c2aa097d03a1f5c31610279487042acd2863d96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005190, "uuid": "2718fab9-1590-4c55-99ae-619735dcbae6", "comment": "Malware payload (Mirai)", "value": "b75c3e267af21dd600fdc8475a218c5af642b6c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005190, "uuid": "c650c20e-10aa-4c5c-b92d-b60fcbb95995", "comment": "Malware payload (Mirai)", "value": "c7bbb8ca96bee17a3381846b32c61a8fe7201868b5e46ef98564d96243194cedf2b8e5fe6783bfc774f22947e40745cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005190, "uuid": "672c3e3c-3514-40f1-8bcb-e7eb10de2cbf", "value": "T1D073B64A6E619FADF76C833187B74E30975973D133E1C685D26CE9041E6034E682FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005190, "uuid": "01a6976f-2300-466a-8d44-b20ece9d10ee", "value": "1536:VemRemUKmRWwoAWynvsMlCFVhONKK76hkOxqWoTP9T2bVR2kv:RwPWynvsMlCFVhONKlkOsP9T2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769005190, "uuid": "537128a4-d099-48aa-97ef-f58332f57328", "value": 78648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769005190, "uuid": "36704cf0-3cb0-49a7-a788-6876163a41ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005190, "uuid": "9efc810e-fde4-485c-b396-4ed7d4283909", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09c39ef-f69f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768982724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982724, "uuid": "adc0eca0-3953-40c9-ba62-ee51103ef909", "comment": "Malware payload", "value": "469d32173ea4313e4ab347d3a272e82b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982724, "uuid": "33e35ca4-2dc9-4b4f-97c2-eb02817ed0b9", "comment": "Malware payload", "value": "cb2dbeaf63911590834f6ed2f3a8712b91b6b179d8b9b61169e52d6c7019503f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982724, "uuid": "8cc38fce-0128-4f14-b7da-9385109aa206", "comment": "Malware payload", "value": "588581a0e7baacc6390babc097f8ebfda2e3e52c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982724, "uuid": "913892c4-126f-4d0d-8480-18e4fe1a481b", "comment": "Malware payload", "value": "d3f52a1b738868f6bb4bd635d5a087847f34f15403557ef4257d187f091d28dad8a84fa8cd31bb8472d3cb49af4aa83d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982724, "uuid": "81398ed4-a468-4839-9dc7-6fc020abba10", "value": "T18F083353778BE03DE19D973759B2A9759DFBA7625603AC028BE450A8CF3A0101C3EE47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982724, "uuid": "580675b3-bda5-424b-8e84-4d43db8c481f", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982724, "uuid": "fdfc73de-2f49-493a-ba01-dfa88f179574", "value": "1572864:24tEijnSAiOCMQ5QmmmDOTGBv2BisVzoBKuBhLTt5AquIs9KknvJyVd4N:2UZSA5QumiT8+8sBGnaqX+nsVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768982724, "uuid": "8ff06f3b-3fb9-48d9-8346-2b2f3bafcf88", "value": 84087086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768982724, "uuid": "0dd64228-6317-4e7c-a374-2dcf460d0f43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982724, "uuid": "a4e56b00-cd9a-40d6-8558-19459f8ad87a", "value": "il314Gw716.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1f94f7-f6cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769002076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002076, "uuid": "37b3a3e1-b8c4-454e-98e5-b4fef09ae112", "comment": "Malware payload (Mirai)", "value": "fed3f4a489681ef3cec5fdb9396da7cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002076, "uuid": "04fc6877-c52b-45f8-ba3c-935f3571c0dc", "comment": "Malware payload (Mirai)", "value": "cb9bef8d87c32350a6f6ce743489c0e39b776ccb4530299e3355e423c345476d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002076, "uuid": "25193981-cf2c-4f94-ba23-0e447bfee652", "comment": "Malware payload (Mirai)", "value": "6f624f180c260ac8ef35c0c80008b884ae9ed253", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002076, "uuid": "74d3f490-fe70-4d6b-be18-ee8abf4995c1", "comment": "Malware payload (Mirai)", "value": "250d70ea3c51656dacbee419330c9c847fd573eda69a34962712be1eb26af11b9180187e2f7b8ecc8c51527c7cf9cc50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002076, "uuid": "615d7320-12c7-4e86-b4c9-13fa78b3ac46", "value": "T1D4C3090ABFB11FFBD4AFDD3345AA0749299C560631A97B7A3674D808F24A58F06D3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002076, "uuid": "f3ec3f23-315e-41fe-a17c-5a1775ac2a0c", "value": "1536:qhuw5DuOukgm35/Kmol9/vT3aH0UJqhYCRvbRc81OhulO/U+pxpZfqFX39wu7r8T:qgU69/9uxqA32AMEXdm7iET2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769002076, "uuid": "26463672-ea54-440a-8fe4-5085740031f4", "value": 123072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769002076, "uuid": "abdc0550-202e-49f5-84a3-84b48d5a3f3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002076, "uuid": "e153eb55-64ba-4265-a581-dada1c7a5252", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67761ce-f6ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769001122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769001122, "uuid": "fd3247a8-2728-45f8-a33e-24515a4e7d0e", "comment": "Malware payload (Vidar)", "value": "9d3405134b21371425d2cc57b432fe3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769001122, "uuid": "84ead6c0-cb85-43ef-9757-1f2e217cf0b1", "comment": "Malware payload (Vidar)", "value": "cba81bc7ea11c3499e7cbb119b957e6b1860ca3a7c3441f7c991e158d62e3923", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769001122, "uuid": "bee87c7a-09df-42dd-84e8-b1c9d8c082cc", "comment": "Malware payload (Vidar)", "value": "998dc522b318298abf47ba70a8ae9d361cb9babf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769001122, "uuid": "3b2f05c3-1576-4dd0-a03c-284c25c1dc74", "comment": "Malware payload (Vidar)", "value": "cae2faaee1fc8b3ae09c7d94b1aa2ac752f09d285788ba2a12bd51070c966c89d079c8a3b16923c243589b1a1746ddc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769001122, "uuid": "1ced3017-a8a8-42c8-90df-49cc2ca58e3a", "value": "T1FE174CE2ED54072BDA9F933AD9B252492230F545173104EBB5991395886BFC8233FB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769001122, "uuid": "9d116147-a3b4-400e-9514-3dd6b097130a", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769001122, "uuid": "dcae7ba2-4afe-416c-a337-34010031a2b2", "value": "49152:o04AC17uEyVQxwYHLCCyaTuThgnea8xz9lY2QEi4+Jjcsv2ErTUo9osJcD9KECJY:ourY289osJc5KECJy+p+062wgtor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769001122, "uuid": "17357e85-dfd0-4aca-a190-3c7363c0fc32", "value": 20126336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769001122, "uuid": "178a8489-2d63-4251-9e73-ca28870e92b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769001122, "uuid": "bdd634e8-62c0-4176-974c-a1bb87c3d43c", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89517256-f69a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980403, "uuid": "67e2bce0-157c-4e48-87c3-1da4c429d4f4", "comment": "Malware payload (Mirai)", "value": "d3965b767f328d3a4a0d9a89b128f1e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980403, "uuid": "8c1caa4e-4d1a-49cc-9a1b-3270c5a2d497", "comment": "Malware payload (Mirai)", "value": "cbfde128904f728e3e7c38a3d3b5ea73b7123afb31d98909c0404e9f1c6f4fe5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980403, "uuid": "63ef8d48-25ad-4301-ada6-120f2bf99780", "comment": "Malware payload (Mirai)", "value": "378ad3f99607690cea505bf77d09db828df5e30a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980403, "uuid": "f22f2d2f-3931-4d78-815a-2b04a8d57a16", "comment": "Malware payload (Mirai)", "value": "ffbb29773de45519af5bbe390198f3431cb96e7582401057beb161465c1a10bf51480234550bd0afde241f8bc559750d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980403, "uuid": "375b6e8e-1eb9-4e1a-b4c0-68fc26b0043e", "value": "T17C73021B109F4BB3C0E99D33B0077B34AF79E053E8E92B06F851A045EA1DDB67244679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980403, "uuid": "cd76fff3-64e6-4d1f-af30-b00c495a44e4", "value": "1536:EOlDJ9nqHLw+ZQeuFvQfPbYGiNw7VI/rW0wvnEJ3gzE94e/ohgK9orj:Ppn40+ZsvaTYbeO/VwP/zE99/oh59Sj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980403, "uuid": "055b49a2-9c6c-428b-97f6-e371f2092190", "value": 74724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980403, "uuid": "0a771c2d-56c3-4ca1-9a3c-da0d4d75c607", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980403, "uuid": "43fae05a-5338-41ab-a41d-6f8559125cac", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a113c9ad-f6e2-11f0-a129-42010a9c0007", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1769011367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769011367, "uuid": "b48d0272-1c37-4943-b5e4-79b708ecc326", "comment": "Malware payload (ArkeiStealer)", "value": "42b81cc82477ee8960388af70c6b4180", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769011367, "uuid": "1d735250-5c8b-419e-9ea3-dc5cbe67a0c6", "comment": "Malware payload (ArkeiStealer)", "value": "cc1de746b577bf949aeeab2db18c07f6be0346e9f519a39c8bb1b7effca0458d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769011367, "uuid": "ae9bf49d-f85a-4dbe-8743-7863a8bcb659", "comment": "Malware payload (ArkeiStealer)", "value": "9e53a2b744b81e3dbbdf405ea80fb9ecb4c8c76d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769011367, "uuid": "59621034-7645-42b4-bded-1be21fb2fc06", "comment": "Malware payload (ArkeiStealer)", "value": "fa54ed26d71ebe5058f62161d0f3eea96512c2145aec3017e1d91f92f6588c7b69ade6c349798ce1559b41b76ac5ae6b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769011367, "uuid": "2a275d02-2933-4522-bdaf-69c1a93ef009", "value": "T1AD468E9B68908EB4C05BD23AC8E5E4C477B1B9D4873723D33B82627D1E7EAD95830B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769011367, "uuid": "ca9485dc-ac67-4d23-a069-463150ef2df6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769011367, "uuid": "335da38c-0fea-41c6-97d6-3d475e0f597e", "value": "49152:myJ0n4tPPoj2bkirZ3yPu+/LCfcNNFNgcKfy35owPdAHS:mXBHP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769011367, "uuid": "ed65930d-74cd-4727-abd4-2f474f097c73", "value": 5542616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769011367, "uuid": "87885e17-7262-4977-af44-b52ac645596b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769011367, "uuid": "3e5f9923-6730-4aa7-89ed-b67116ba8032", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35f004b-f6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768985198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985198, "uuid": "121acde6-001a-4106-83fd-3644d9d2be06", "comment": "Malware payload (Mirai)", "value": "1c99dea8818d033f592e032f68e9b4ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985198, "uuid": "08daaa09-1016-4156-8da7-1ff4c38e088b", "comment": "Malware payload (Mirai)", "value": "cc8d143ea7f2fb9446f3431bb72f82815ddb30820c1b178922886eb26ac144f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985198, "uuid": "56398291-589d-4ddd-87f1-ab0bb2fe1294", "comment": "Malware payload (Mirai)", "value": "b4a035c37a8b4fe3f547a080a22861bbdddfe1ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985198, "uuid": "15e34312-f6d9-4c37-bdd8-0c22451cd116", "comment": "Malware payload (Mirai)", "value": "f6a52553b14e639b0e655ae9cac9327dfc43862cedec8fb7f82a16b2d96157dea362a54bf065b684cce9e121f9eb2d97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985198, "uuid": "ecf8dd74-e2a4-4b8a-8e45-b16705211ef8", "value": "T132C33B49F8904F23CAD652B7FB5D428D3B2627A8D3EE32039D156F61378B95A0E3B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985198, "uuid": "cb050349-3b5f-490e-a602-1080b2c7d461", "value": "1536:jB+hTi2kyKMgoExBJCs2OR414VU24BTNJyY2lc+Kl2z8wywFU0xTB/+uU5E/OM05:j8lKMgp3CsI4POylcWfxTB+tQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768985198, "uuid": "0d668356-e357-4789-a1eb-e8a469d7d4c3", "value": 129632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768985198, "uuid": "6589fa97-f2f0-40c1-a42d-2a3524d700ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985198, "uuid": "910a707d-808c-4901-ba3e-5bfe4449d3eb", "value": "ub8ehJSePAfc9FYqZIT6.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e4615f-f65c-11f0-a129-42010a9c0007", "comment": "Malware payload (Pony)", "timestamp": 1768953609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768953609, "uuid": "b894b55e-a71b-4a46-9aea-f57905ef5e37", "comment": "Malware payload (Pony)", "value": "13814d5dedfb6e7c3a3b5dde40c0f896", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768953609, "uuid": "1e2d8609-aad0-44a4-8ad6-3d7e1315abe8", "comment": "Malware payload (Pony)", "value": "cdb7e330d5d198d8207399452334b5bd1e5b5e7f7c1dbd7ea4eac990c8bef3cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768953609, "uuid": "9eba04dc-c3d7-435a-a01a-2de68cc9cdcd", "comment": "Malware payload (Pony)", "value": "480d1d262a36ed5c9f75f2bb79bb96ee2733137c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768953609, "uuid": "c9d4af5a-fef1-4cd6-ae3a-781498cda335", "comment": "Malware payload (Pony)", "value": "c97cdee0d4d2981d9e7feab100ad16d12b3dd5383789aa076b9d80a9c3dd5f09cb6f6e1ad36e3953765a1defa33c7296", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768953609, "uuid": "f1a5aec7-be59-4aca-adf9-715415fe989b", "value": "T1A9B3CF768BF04137EDF26FB197A68646A595EF4A035019F2B4C78C1CD6B0C786E39D80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768953609, "uuid": "4f1c9291-9dc3-471b-8ab0-8e1081d358cf", "value": "00642bb5d90d8fae6d77405debf3ed3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768953609, "uuid": "3829262d-8dce-40cd-b08a-a919d3a63de2", "value": "3072:bjJZI6mQluBcPSbJeEh86TJUDcjqvbTCIQ:BZ5meuBKoJi6VycCTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768953609, "uuid": "e7813e24-3762-4d56-b469-d12ada662d4b", "value": 107520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768953609, "uuid": "639cfea1-461f-4e23-8e87-34aab57fe8c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768953609, "uuid": "e0c4f02e-bfe1-4675-ba6d-a8f39278000c", "value": "13814d5dedfb6e7c3a3b5dde40c0f896.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6708c251-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034892, "uuid": "577a16ac-cfd0-49a4-b24b-3cd80a55f7c5", "comment": "Malware payload (Mirai)", "value": "32bde5e39126ed2d58a95f70a525282d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034892, "uuid": "808bdc5a-77b6-4f08-bd82-64498cda5207", "comment": "Malware payload (Mirai)", "value": "cdcec3f4fd3d942bbea8523307209f733d6c9d6914e006568a989ea48601d698", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034892, "uuid": "5a69f00e-8452-4f2b-80bf-8cb585441f63", "comment": "Malware payload (Mirai)", "value": "855dd68481966fcf67ec71d8ccba454d48de3fb9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034892, "uuid": "8d10218a-0981-4179-a80c-9fc2808c49a6", "comment": "Malware payload (Mirai)", "value": "8e32012e7213b926d905fc34c6a29f019764206e1668ef4b8f8d57d3543937c1dc73bf9d2f8875259aaec4b763de9d44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034892, "uuid": "3e64eb93-9d8a-4cb1-8f11-62f84d73ff65", "value": "T103B339C1A683D5F4DD1645342237F73B9A32F476123ED983E3A4DB327C92A5199063AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034892, "uuid": "2759457c-7e50-4cf6-b558-10e422336924", "value": "3072:QC0p7O8k9dzyHFdhTaqer706sYEFdzRUIzXe7tL1Uq:QCu7ON9dzyH/hTaqer76pAtL1Uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034892, "uuid": "7f582393-acb8-45da-b853-66563f9c3474", "value": 111920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034892, "uuid": "c388247d-0060-4897-99eb-faa8ec800dc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034892, "uuid": "89b20f75-9833-4149-bbee-99fd3afcbd40", "value": "x861", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d9f92d-f718-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034675, "uuid": "e55c7fec-0b5a-42de-8e64-3ccd5ad275a0", "comment": "Malware payload (Mirai)", "value": "2d4db524db57ff7c1bb66fe3d67d35ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034675, "uuid": "cf296400-c3e3-4903-b4c0-1b22b1a45432", "comment": "Malware payload (Mirai)", "value": "cdf72f36a1cf4b75d84de1aecc35ac3e7fe9649fa91797d93f38d0a731a7c1f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034675, "uuid": "49583d7b-67a2-4a01-8c6d-488bcc5083e8", "comment": "Malware payload (Mirai)", "value": "e68797d72ec01ce60ef2bf1888d568b97c943e91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034675, "uuid": "1b067779-ba2e-4307-a2f9-f974d2199c4f", "comment": "Malware payload (Mirai)", "value": "bcbc9413814a05327d4a4b17c3dd0ba9880e61e7d8ca8fbae074a6f08eda24d45afac0e9a4e3749da939c3e604b7cfc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034675, "uuid": "c075d871-a299-4271-91aa-1a258f3fd450", "value": "T1F7A33982E757D4F4D90704B001EBEB398A31ED721024D95BDBA4FFB2AE316C2A05676D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034675, "uuid": "88bfd970-e737-48f3-bd50-72dd8d3e37d7", "value": "1536:n5ur1W9j4h6YyFU7RzhbiXqa3fTgh6ohefQU931Q4HLaaQnT4r:n5As9sh6YcuRzhbiXqo8wu+ync", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034675, "uuid": "7546543e-82be-4be5-8603-239db33e5ac1", "value": 102864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034675, "uuid": "7028b5a8-7d19-421d-8426-c83851b27cf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034675, "uuid": "f394ebe4-235b-40ee-a555-eab9f5b5ba00", "value": "titanjr.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745a8afd-f6a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768986381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986381, "uuid": "a6ac39ea-f8c7-4a3b-8ec0-2002f77922de", "comment": "Malware payload (Mirai)", "value": "d6c0b041bfab674ec0431d0175a980e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986381, "uuid": "a27dd5ed-dae4-4588-a62b-a269cd4edec2", "comment": "Malware payload (Mirai)", "value": "ce5076d4d2e9354239f653f5cdc6db1977ed0fb94868a5f2c3b432af5cce61d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986381, "uuid": "fd98744a-4b71-482e-a0ea-9b0b235c8589", "comment": "Malware payload (Mirai)", "value": "c589803839b025d852b2fb189a68f3ef0451eae9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986381, "uuid": "ca54bd63-4866-447e-8228-f6a8c3daf88a", "comment": "Malware payload (Mirai)", "value": "2c2b8a53e571408056658c54f3ed598272599bf3699ea252011a23c0412e7d3d6db307a6fbdfbc7a0f0d94cf80eb18ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986381, "uuid": "47bb0ca6-05f7-4a43-a42d-c50f28279b5c", "value": "T1775302F7A0E87DCDC2AA4774020B4A463EC567786099613AB5C5B6A88BF1740CFD8BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986381, "uuid": "7805aa8e-1c33-4fcb-b493-d7f0ed83d879", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASAp/YLkg4azHz:CM5az1Fy0oPgdZX6hTo8RIwLGazHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768986381, "uuid": "11807394-bc5c-44b5-b4fb-e7815568dd12", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768986381, "uuid": "5479f7c3-f8a6-4083-a69d-ae6aaca4fb37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986381, "uuid": "89753c83-9f30-411d-b90a-ae2cae4a5922", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f719df-f6cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Gamaredon)", "timestamp": 1769003102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003102, "uuid": "27f4d6a0-2f7b-46bc-9b02-d1e99fe18839", "comment": "Malware payload (Gamaredon)", "value": "e55188a6da2e3209d8f02f5606ed8b33", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003102, "uuid": "b4d89e82-7f51-466b-adf9-16a0587fb6a1", "comment": "Malware payload (Gamaredon)", "value": "cef405879cfd148a5fcb905d7c4b0f03ee00e10b2e88038f9cd7f4fc295ae45c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003102, "uuid": "8cf41724-a861-4fc7-9f6b-df12168af3d8", "comment": "Malware payload (Gamaredon)", "value": "74796bf9cd7611cd51a2b666f31f35d820359c29", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003102, "uuid": "95a37fe4-3b55-4a26-a40c-b62cea2d7b50", "comment": "Malware payload (Gamaredon)", "value": "5f8a84cba4060df2ef9b0eea5f71cb7fe1aea05a49c4167ea0db1cef0ddbadb2d2a1c8c4887b6b74514dafd3470fbe00", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003102, "uuid": "2680b7a2-0188-4d8d-8de3-787c14d135b9", "value": "T18F53AE37611C5856084B39253858351432993EF894CF0B2599A6EC60EBFC68FEDBDECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003102, "uuid": "a0aa1af3-ac02-492c-a191-d3f2abf50eda", "value": "768:3OkfahxNUUJVDMMMOQ2222SIQhQkjjRi16MyJRxRa9I+I+I0:UrNXfMMMOQ2222SLOqMn9hh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769003102, "uuid": "329fa1e6-53f5-4dbb-ab71-38e9815c78c2", "value": 60690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769003102, "uuid": "23636cab-a0fb-417f-8eb7-3b9294f938d6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003102, "uuid": "2bc4d1fd-13af-4308-a1d5-eb418a0fcaed", "value": "1_18_1_1052_21.01.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66236645-f6c2-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768997524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997524, "uuid": "445dddf3-264b-40d1-b88b-346937ec6996", "comment": "Malware payload (Gafgyt)", "value": "122a99ffdbedaae624096b760a725f49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997524, "uuid": "ef29408b-9c7e-4a73-98d1-6f0bbd7ea1fd", "comment": "Malware payload (Gafgyt)", "value": "cef8a7a53921cf4078b74d06cc8f72e67f70d90734843b5a97cd78e027c22be0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997524, "uuid": "f096fbed-7a2c-4788-867e-076aed7e9873", "comment": "Malware payload (Gafgyt)", "value": "00b8df93170152b6b4ca96ff7178c9735a242fc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997524, "uuid": "653d8157-f74d-450e-9c6a-d6ef7ff9f431", "comment": "Malware payload (Gafgyt)", "value": "824442b61f7d0c26c134f6154815f0e15f47d7111ebb0ae33a8387bb0c79874f66d76e07b482ae667ce5f80352adb6ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997524, "uuid": "cc0d368c-7435-42fe-ac4d-2d4d844f2b1e", "value": "T1DAF3C749AB110FFBDCEFCE3706E80B55249C6A1721A83B3A7574D918F54A18E0ED39B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997524, "uuid": "e5e085e1-3804-4819-905b-ac7a91a1ab1d", "value": "1536:ZYNCDN8O2ztOWGkwE80LApshR/N4yipUlpsh4tLr2NztjatZeA8QiysY2A3XETgn:ZoCDN8l/NwE80LmaR//t/2N0t1Lziy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768997524, "uuid": "b016244a-899e-4ca5-973a-d9f605a2ed1b", "value": 162860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768997524, "uuid": "6f9ba5d9-f610-4ff2-b018-2b93a2d57d50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997524, "uuid": "1b56e8b6-184d-4f79-ab14-e40554329d7b", "value": "goon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a01d58f-f6db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769008134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769008134, "uuid": "eb87e74b-11e5-4b62-b965-4119986d33c0", "comment": "Malware payload (Mirai)", "value": "359e1f3291b9a10a67987be7edc1db97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769008134, "uuid": "892552c8-6ad5-43f6-838f-54bb232f908f", "comment": "Malware payload (Mirai)", "value": "cf40c6e6a5a967e0ecab019e6708db8a903feec62f44dbe288896cc7c993cc8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769008134, "uuid": "747414fb-bb97-470e-862b-11529c299697", "comment": "Malware payload (Mirai)", "value": "a678ff65731915483761cd9e65d81be163e9e2fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769008134, "uuid": "0a04008e-9940-40bc-8bb5-8993dc8afe68", "comment": "Malware payload (Mirai)", "value": "322377f79ec62decc623895d95fc9275bf0aaf5168aa6c7fa18c74368ae97b9d36fe91cd18b404e15b5f8edb81f518f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769008134, "uuid": "7cb6e0bf-218a-429b-a5b4-97df490aa211", "value": "T1AB937CC0F683C4F2E84305B1507BE7379B32F1B9101AFA43D3699A72DC91951EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769008134, "uuid": "4401e3cf-7518-4e7e-9902-077dc7e20576", "value": "1536:W/QCZaxGdvts3i5JPhoeIxPu++ALtgUIKqI4FrS4LSU:WYCZa8dvm3oJPhTIxP5htSKfUmDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769008134, "uuid": "6ce46d98-08d5-4d74-82a2-69abecaf9cdd", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769008134, "uuid": "eae1d3b0-3fe7-4d95-a444-f54ead8cb815", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769008134, "uuid": "807c6dfc-be1a-4c44-a1b2-a0c53a6b09d2", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aaf1eeb-f6bf-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1768996324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996324, "uuid": "e51bb0b5-fe44-40ca-ab12-177c0843b9bd", "comment": "Malware payload (XWorm)", "value": "00bc7f277e337423b670ff514f42d2b0", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996324, "uuid": "8998b5d4-86a6-49a9-b2d3-c1415e57b42c", "comment": "Malware payload (XWorm)", "value": "cf47a12ab207f39bb11672dc366839a72b61ee81d0870edffa2c3c5c058a0e0e", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996324, "uuid": "50673fbe-371f-47f8-9346-d054c63d252c", "comment": "Malware payload (XWorm)", "value": "4d451310e2dfd0cdc172bd954c56f43a41c87677", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996324, "uuid": "db28517f-834f-4c21-987d-5236f9a52c52", "comment": "Malware payload (XWorm)", "value": "138bff7527e6af85166d4ff802cb848279367bc4021cd4d81ff7f29092b702f3555598c9bb7485804be9505bda62e451", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996324, "uuid": "c42051f4-04dc-4430-83d7-95bb89122670", "value": "T1E072FC22CA16EFF0153E6292684B6C2659120B11E6347A1D798FEC9C3B3E331DFD54E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996324, "uuid": "5b87ac62-ed49-44e6-8eb8-c8ebcd4e1b7a", "value": "384:KxSZVOHYOAG/tnn452HjQLiQmWKn+y+zlIacXHwN:K4u44/J45sEiQxILe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768996324, "uuid": "68342652-b4e7-4049-9116-90d776865853", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768996324, "uuid": "63e52d3f-7d93-4ebb-b7f1-1e56afc17ff7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996324, "uuid": "0feebf47-0aab-43fb-ace1-4a8ab54b1292", "value": "awb_DHL_shipping_document_bl_inv_packing_commerical_docs_21_01_202600000000000000000000000000000000000000000000000000000000000000000000000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eee30e1-f6bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768996197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996197, "uuid": "abd940ab-2eac-4f32-98e2-d7d7ef37b2a9", "comment": "Malware payload (Mirai)", "value": "5d2ae38eb6b7c05f9960af0e1a3aca35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996197, "uuid": "751ec88f-450d-43cb-b86c-69771e9a03b2", "comment": "Malware payload (Mirai)", "value": "cfc9c08ae996ddfade40c49d3bfe094a0688310741635bdc800d450ed71776b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996197, "uuid": "b943a835-7aa3-44d5-8bcf-43df80e5eb11", "comment": "Malware payload (Mirai)", "value": "76ec686c5fe61977d28a0134cb126cbb69f74ee9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996197, "uuid": "15d9e5cf-3361-4139-b4ee-6c775ef6e2ab", "comment": "Malware payload (Mirai)", "value": "7925a18511a7bc9e63f9a99cb31ebc8a5c40ee80ede6ec9fd40db8550cbda8b8fea0a2cc7c7e1de28402a660eb8d8d3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996197, "uuid": "76d8176d-852b-4590-9c99-6472d2cbae7b", "value": "T15B93E896B8C28E15C5D423BBF92E00CD331667A8E2DF72129D106F2477CA92F0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996197, "uuid": "d4d584fd-6258-4a6c-a7f3-ad7f3f2d8cad", "value": "1536:FwNn21vn1P0YAvT7C+P7V2o6Ahb0rkHP8UijOX/w6M1WxlwU85W//53FYcpIziYy:FFP1sYu7JPZ2oP0r+0UijOPXMIEHCcCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768996197, "uuid": "37ca4d42-5e94-40f5-9d71-17721574d9c6", "value": 91440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768996197, "uuid": "45683f2e-9cec-4660-84e1-eede89569576", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996197, "uuid": "7a800f1c-f5f5-4b94-9375-b6528e2c2795", "value": "UnHAnaAW.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9140f9f-f718-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034707, "uuid": "1892aec1-8be2-4ab6-a2c1-61beea61fe8f", "comment": "Malware payload (Mirai)", "value": "104ba9dfb5197ff0552d052e87a40429", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034707, "uuid": "fb781555-22fb-4ecc-9de3-3b71fe26f52a", "comment": "Malware payload (Mirai)", "value": "d060c8627812f3e8c6e33a9bca56818797d135b34fb21774323f3c6a0ab6f8f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034707, "uuid": "2044f69d-16a1-4be2-a558-ea743f967c3c", "comment": "Malware payload (Mirai)", "value": "f894f6b0a80167d25af6c0f8ffe9867584a8f559", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034707, "uuid": "f951855e-0071-4f4a-b7e6-13f33bce65ec", "comment": "Malware payload (Mirai)", "value": "9581109fe4be13f23668fcd6dc199578d0b7ae616a1c8a84052243169506ab6bea67358603cf5027a954c6b405294b73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034707, "uuid": "adc9b73e-fe35-4b02-9270-55349b0a3e40", "value": "T15B238EA7C8796DD0D1548274B9248EBC1B23B405C5A33EFA5E45C66A8047EBCF61E3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034707, "uuid": "c6324008-48cc-4eb7-a570-262d1240619a", "value": "768:RaDwtkionAqeqUyYPU3IlaN+ruCynnkpCVode3fKCCg:RaDwtkhbxQU3l++kpRdoKCCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034707, "uuid": "6bf58370-787d-4127-ba42-c01f05aa239a", "value": 47704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034707, "uuid": "2d177179-cfee-46b9-9863-092fc548d64b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034707, "uuid": "fe930289-7b7d-42dd-830d-4359bfd17d59", "value": "StormStresser.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f3573c-f68f-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1768975700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768975700, "uuid": "5bc943b9-15f2-4f8b-9d09-7562df97ad6f", "comment": "Malware payload (ConnectWise)", "value": "2faab4420d60655665eaf2d46a82781e", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768975700, "uuid": "c1ad3eec-1d1f-4308-921f-1327bd03d8a8", "comment": "Malware payload (ConnectWise)", "value": "d1839d51e24820f29a9c6fe0db70f6d8448c0454c907936c72fd020683131c83", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768975700, "uuid": "2fe35e8f-ec6a-4f33-9090-e61867becec6", "comment": "Malware payload (ConnectWise)", "value": "d1e9d18f997a4c58f0c421b0847a759ee9484e82", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768975700, "uuid": "d964ecd1-8b32-41f1-b438-b416da4eb2a0", "comment": "Malware payload (ConnectWise)", "value": "885cca33e7822505d3acca7f7093759997161cc408e6cea6b709b0cbd5e9ec37e5a85ca6226346d274ae697e61b66f5b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768975700, "uuid": "b62f7bcb-df63-4d5c-b9db-29063c6d337d", "value": "T174A6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768975700, "uuid": "6b45fba3-3542-46cb-9c62-e0f316693677", "value": "196608:OKaLNkbgqi4Q/KaLNkbgRKaLNkbgBKaLNkbg:wWgqiHXWg1WglWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768975700, "uuid": "abade952-8a11-4276-a843-2795f8901f5e", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768975700, "uuid": "80051ce0-d8d9-4386-bcd5-8ddc02b237e0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768975700, "uuid": "15bd81f1-d201-4f23-ae94-3202ce97c042", "value": "7506 INV.Payment.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb518bfc-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768998607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998607, "uuid": "e513bd3d-9136-47af-a28f-afec99edf815", "comment": "Malware payload (Mirai)", "value": "073404f1f53748b9b9ace9df307181e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998607, "uuid": "befe7de0-2c52-48fb-8269-674bfea1b985", "comment": "Malware payload (Mirai)", "value": "d1c45037ad834d79fa3d59759c991bf4877e36805ba486a046bb6765be3c5432", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998607, "uuid": "21f0d3cd-a6b8-48e4-80d5-2baff7e28346", "comment": "Malware payload (Mirai)", "value": "a4bff32e1791b535d485bba2f7f82edda87987a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998607, "uuid": "b12b0e09-bda3-49ed-9193-5f1cc4d520c1", "comment": "Malware payload (Mirai)", "value": "8dad9d6567e55fd213c1d21b68931729cc6a969108a21d623e5e0cabd9bb792ca59884c850e40b082b0535252e04ea2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998607, "uuid": "d5eb39b7-fe4f-46da-bf2c-b20cf2b20475", "value": "T14FB3F9577750DF62C21DC23009F3C752ABEA2AD226D29549B26DDA0C6E7134D682FFE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998607, "uuid": "417f0f7f-9f78-479c-8856-88e0d7fbca62", "value": "1536:hSSvA4mJF5wdZVvtb+069fJqf84gw2SsMHQYjkqNVmbIzrats+B8MsGOvrU0S:kH4Eutb+06R4f84RJjTmI+BgjUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998607, "uuid": "a8110811-9d5e-434a-957b-aa9e91e5fc76", "value": 118108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998607, "uuid": "8e8bf35b-e511-44b4-973b-9fd468299280", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998607, "uuid": "7975cb22-79d9-43e8-82b6-ea2e68171d81", "value": "kk.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a10406-f6bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768996203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996203, "uuid": "738b8735-ff9a-4b71-a3d5-ae732ed121c4", "comment": "Malware payload (Mirai)", "value": "38b769a558be1215d53943ec474df99c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996203, "uuid": "d0571a98-81d9-448c-a4c9-f5abf4b58d6f", "comment": "Malware payload (Mirai)", "value": "d1f73ec484da6985d7bea5b2f7ff288b1fc5c729914ef2aaad67df3c0ec19608", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996203, "uuid": "a3d91d0e-c693-44b3-9f0f-0461507619c9", "comment": "Malware payload (Mirai)", "value": "66e08281c76dd228341300cb0130d1443fb12401", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996203, "uuid": "2dbc3e57-d6b4-4780-b75c-b68d55d32cee", "comment": "Malware payload (Mirai)", "value": "1f2048838e8115f31442010e3f6b115227f5c5d6189d066c07337d8cbb3778f68955887e017c8d2209c6da57af81bec6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996203, "uuid": "858d1098-c752-49e3-8dcd-c58668686b45", "value": "T12FA3C616BF350FF7E8ABCC3719A51705198C650A22F97B35BA34D818F64B25F1AE3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996203, "uuid": "860d8818-8ecc-4258-8583-756dfe02626b", "value": "1536:RvMKs9oRHbfZT7EQYQWealCvayy1CsiooKfALVZPpzKA2:RvMKs9oRHbfJ7rWxlsaDVcLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768996203, "uuid": "72577773-e876-49a1-ad57-d6d6099f1a54", "value": 105116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768996203, "uuid": "db6199ad-396b-4930-8d06-0daad53d0731", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996203, "uuid": "1f5441c1-a7f9-423d-bef6-2afe6ad5aaea", "value": "UnHAnaAW.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd4fe51-f6ac-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768988112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988112, "uuid": "2c96bc20-6088-40b5-85af-9c82912a9b3e", "comment": "Malware payload", "value": "da904afe61a90f5a593efa67f6c3442f", "object_relation": "md5", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988112, "uuid": "1f4d9fd7-0489-4859-a249-aa7170460078", "comment": "Malware payload", "value": "d23b6653b4a649c91e1c67f256a31e6f84d30c13ddf7b76c2b87310431db5e64", "object_relation": "sha256", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988112, "uuid": "df741944-f96a-487a-bc4d-f7649bad02c9", "comment": "Malware payload", "value": "6fcabf9eae3de6dd6d5639973bbedb41e0488988", "object_relation": "sha1", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768988112, "uuid": "94081d7d-28e2-4e0b-a645-0144b7713294", "comment": "Malware payload", "value": "4a71265c125f6ec02e3078dd051297623ab731416f7782bffa9aba01a375d6441d144c038af5c0fb9bca85f1836f2d53", "object_relation": "sha3-384", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988112, "uuid": "093e5d71-1b43-459b-a86f-b064baba3506", "value": "T12A462334B5377ADAF4D0923A6447B94E3FF924E49A341D080FBC62050ABD86DF99EC61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988112, "uuid": "69ed1857-a757-48ca-b3bd-bf81539e6701", "value": "98304:/l4fyqH5lZDctoIiZxDHwfBSUmybc+QFDqHG/LOX:IxctkMS5uBaD7Dc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768988112, "uuid": "69b9e22d-a95d-4f90-bbdb-4532bb31f8ba", "value": 5386982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768988112, "uuid": "9c58c98d-513d-4221-8811-cd04dba48fbb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768988112, "uuid": "a36c1645-d857-4597-8b1c-ac852028713c", "value": "overseated.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c25ec6-f6bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Loki)", "timestamp": 1768996260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996260, "uuid": "fef1679c-5199-496d-9ab4-62c5b4fa489e", "comment": "Malware payload (Loki)", "value": "add26bb7bf9e6eada5029e08cca22562", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996260, "uuid": "34a2ebf0-89d5-4b49-b13f-91f9fef842f3", "comment": "Malware payload (Loki)", "value": "d254776c19d7155845241a875bcae4470f1a2692f04cd558966a7a8268a78836", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996260, "uuid": "3066170b-a77c-440b-a360-1b1624057d83", "comment": "Malware payload (Loki)", "value": "2d9bc99e4231a38c3da5aebe139eb84b43ea5141", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996260, "uuid": "23478ca6-76c4-495d-ac24-9cc72c6a9daa", "comment": "Malware payload (Loki)", "value": "24ff9bc46c079acbeb1519c69a9d8872a56e691873d559497af50639f80fa9fdb7132ea1ea932a0fac70f6d92a522f95", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996260, "uuid": "a0c43da2-4d67-4081-b8ab-4356929f63f0", "value": "T1A344A624A3C47894238B1B76771FF1D9ED1F08AA3445088BE115FCA4B5AD71FEAE1A31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996260, "uuid": "3397bd37-9908-476c-b33c-9dcbeaaf38f4", "value": "6144:k8IUM+X3dbdajb1WqEaQjsGl+va5auSm2O0+qaaAtC:ktAKMqE1sXva5a62O0+9aAtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768996260, "uuid": "0608f371-3f6b-4b2e-9f8e-948884ab8f12", "value": 276295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768996260, "uuid": "c4ac1c40-3cad-446d-ad94-235ea459a198", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996260, "uuid": "d43a8c15-dfea-40b8-beea-6b5ef254a4f8", "value": "MT103_Payment_Confirmation 01-21-2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceca64a7-f6a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Hajime)", "timestamp": 1768986103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986103, "uuid": "a1214f6e-057a-49d5-b61a-dddc5a7045a2", "comment": "Malware payload (Hajime)", "value": "bff18a0246ac8adc81b4a178356bf091", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986103, "uuid": "144d3b4b-767b-4f5e-b999-c964b26f5cfb", "comment": "Malware payload (Hajime)", "value": "d349142ed73ca26e8884192cb2b8443e5f56f7e20402033f137897eef0b3ba59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986103, "uuid": "de36e8da-ed3d-42ef-8149-1276da71f29b", "comment": "Malware payload (Hajime)", "value": "771cbb59fc696de3edca6e3d95f43bbf316b4f86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768986103, "uuid": "fb4b74f8-219d-49ee-bab6-59f29124322a", "comment": "Malware payload (Hajime)", "value": "6c323db8477dec0f11aa56afd49fc9a5949f1b491593172fdf65c484aaf3a37c6dff4f73af6dca44b564049baffebe93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986103, "uuid": "f684196f-1212-457d-bb0b-29826989400e", "value": "T11673121623AD2971527145F1E7FE6F8CE10E3A688FF16C246C217C68B93236E5CD8519", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986103, "uuid": "d9c8c6e7-06c1-48f8-a9d7-ee72d0792005", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2K3R:yYI0ARqw1qAEv7UIFM8oJorFquyjkRkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768986103, "uuid": "e612883b-4f6e-489e-b448-2b9f0b3c0656", "value": 73872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768986103, "uuid": "f53eb5a0-974e-4147-b2be-36499162e423", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768986103, "uuid": "25ac1f46-777a-4a62-9a48-6083ed834149", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09735679-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034735, "uuid": "c45a873a-c585-426f-ad4b-fda720021109", "comment": "Malware payload (Mirai)", "value": "b2b79f5d628e77f7e56e3a742ed8d335", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034735, "uuid": "a6db7d81-e29c-4d8b-b445-da937656d0bb", "comment": "Malware payload (Mirai)", "value": "d39793f13da943383a698b5339acc0a8cb22a39630272a2554f657803794acf7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034735, "uuid": "e17e2890-a3da-4ebd-8242-45ffd7cccc29", "comment": "Malware payload (Mirai)", "value": "2233455850ace536c8eb39f3844ab804abbb2d51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034735, "uuid": "870e582b-db4f-4728-b67c-48afe35b16ed", "comment": "Malware payload (Mirai)", "value": "4ac3c6da2d0f15848a0a6adb366c2a5a450fe46a931d63ce6664e707aa5f45250e7cdef5f465aa7ee142d439e2d9016d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034735, "uuid": "c9f867d6-2bda-4235-a056-6ae4604b3deb", "value": "T184B35BB3CC26AF98C655D074B0B18FB92F53A59482471FBE19B6C2B44443D8DFA05BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034735, "uuid": "908ae61e-8fe1-43e7-b04d-b813e79ef6d0", "value": "1536:OTW/VCxsHZusQ2Li62C87mKjR5fvPVWARouW8j3W+gJH7I:OytCxsQx62NVjzVWxuWM3byk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034735, "uuid": "06194014-9dac-4bb4-90c9-92bee24bf4ea", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034735, "uuid": "790eecbb-6509-4957-b5f5-534956a4b08e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034735, "uuid": "8e93e612-23c7-4104-a832-e68a7e72d543", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32a46fa-f707-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1769027289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769027289, "uuid": "fcbbfbdc-22ec-4e44-a75e-fab7066fdaef", "comment": "Malware payload (CoinMiner)", "value": "e5513a66af0accea4ede98895302afe4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769027289, "uuid": "53b8a9ec-2ab6-4672-a475-e9a83fc6cb6e", "comment": "Malware payload (CoinMiner)", "value": "d3a5ae68b714fe3f575e7f9affb65c66ee9e16849c28fa040bd66f553d0ff7b5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769027289, "uuid": "599ded43-0f46-4e3e-9277-a7100277cee8", "comment": "Malware payload (CoinMiner)", "value": "94f0449008dae631176cc308f4cc392aa3be2a40", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769027289, "uuid": "eb109bbf-d856-4c8e-b5ec-eac92ffd3362", "comment": "Malware payload (CoinMiner)", "value": "0c69e97ad3c81f0c54d450b49fa1bacd0ee54f924fa436ec96d415fc6c7c3c16919084b6b06bf1785a0374d096862cf8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769027289, "uuid": "b43e505d-7420-44d0-949e-655c57764953", "value": "T10FE54A47ECA505F9C4AAE33189669212BB75BC480F3023DB2E60BB782F767D09DB5714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769027289, "uuid": "22a6db13-1a26-4556-bc7f-5fdb24239f6f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769027289, "uuid": "9080b8ba-eb30-490b-9014-f80caf9b3925", "value": "49152:qIcUjlJfdyi5AXPA4NmEfqam7q+FmKCMem4zJ+N+jsdGB:qKhuwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769027289, "uuid": "414d0e2f-1800-45d4-bba7-35b726a59823", "value": 3053568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769027289, "uuid": "afff9193-101e-4670-b28b-16670ec3c37a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769027289, "uuid": "7d0bf01b-ad8e-4158-b044-38454b553205", "value": "d3a5ae68b714fe3f575e7f9affb65c66ee9e16849c28fa040bd66f553d0ff7b5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89abbed7-f6cd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769002308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002308, "uuid": "06b5cdb2-d031-40bd-b2e7-bf590c916962", "comment": "Malware payload (Mirai)", "value": "76147010014e98068652d48702aef054", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002308, "uuid": "fab48999-4c48-4e86-86b3-a62ffc19e821", "comment": "Malware payload (Mirai)", "value": "d3e5e170a5739b64077e39bfc3e46a4c00f610dce39ec08660916b45b3ac34c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002308, "uuid": "0a4fb407-036f-4f02-a4d3-a3ac8898ed2f", "comment": "Malware payload (Mirai)", "value": "febeb6865c2bd8c05ab2c08e0ff76515c8849076", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002308, "uuid": "8a249c95-95a4-43c3-a62a-46ba0cfc06a4", "comment": "Malware payload (Mirai)", "value": "d7c89c75b0bc9dcbc80cd3342be3ba7c8fc367773d417fe25fae84e2cd21d928c40bd3a1161cf1fc2ba1c7d00d0f5f9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002308, "uuid": "9a8050d2-47c5-4a9d-951d-729a25de1c61", "value": "T17D73E80ABBB14EFBD86EDD3346AD4B4525CC924722A83B7A3974D418F24B18F49D3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002308, "uuid": "d9066e8d-1e12-4bdc-94db-a43d5639c9df", "value": "1536:s2NMCDnl58JwzB8/DXOWVhZfOFt34yCBYkYSufWT2bVR6SY:s2NFnD8CB8/1+tc1ueT2SSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769002308, "uuid": "93c1104a-2c1e-4519-ab64-98f61c1fa1e4", "value": 78872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769002308, "uuid": "e5ba85d8-9a2a-4747-a14d-d8c8de4c553c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002308, "uuid": "3e4edc49-08cd-4772-9ed3-8bfd6b9930a7", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7049546b-f6e0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769010426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010426, "uuid": "31cc351d-ff56-4187-b600-71a4b9203eb8", "comment": "Malware payload", "value": "e24714fa4b02345e938278d50d300c81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010426, "uuid": "f6a0b61e-4a28-4ba7-8a9d-19db39e3ee2c", "comment": "Malware payload", "value": "d45c1757c745647127c0178a4161f550c863f9439452001c9a6467861c23b6f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010426, "uuid": "1d2cebf7-2935-4e18-b61f-9587c813e444", "comment": "Malware payload", "value": "4aa1faa46f64c3b3da8a609bcf98dcbf434904b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010426, "uuid": "b5d0f15d-5d94-45b8-8fa9-ea4e89a183e6", "comment": "Malware payload", "value": "6f191af49368bf22d259d9bbe6f1b36727670d56c9f50596511f79100db184acd6a5194a1886166465c123f31ce75f79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010426, "uuid": "42f2333f-5475-4b70-9aab-e5511fb9385c", "value": "T17505B0B876047CE6F67F467BD996ADEC03B626239987A4CD5064B7C30A63371FE02805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010426, "uuid": "9afce14f-6f47-4544-83b7-6b699dda5052", "value": "082d95568b2e734f659ed7efb17b46d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010426, "uuid": "c2077215-af37-4ce6-b751-31466eddab69", "value": "24576:y2eYUBSQyEYhsG+OaJDWVqwr8zwfXLNv0hx7KO1bN/FJn:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769010426, "uuid": "8efbbd78-3b4f-4f7b-98a7-faf23e0332f0", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769010426, "uuid": "5d78679d-775c-4d82-a456-061206a86fb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010426, "uuid": "d81a7e94-11cf-4589-8585-9d7c274979e3", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc2843d-f6c7-11f0-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1768999819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768999819, "uuid": "15e4551b-2100-443b-81ca-cc3aa7583cea", "comment": "Malware payload (SantaStealer)", "value": "1d7057d722e1f4607893ee6e9b1e775f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768999819, "uuid": "1ed5b31f-8721-407b-b72f-bb44b5dc47e0", "comment": "Malware payload (SantaStealer)", "value": "d5e3d0af0ea15773fb6539d8164c631babe11af7aae7e9ae519ebe2e2fd0d79e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768999819, "uuid": "d09e8e01-6807-445f-87bb-39aa9445102a", "comment": "Malware payload (SantaStealer)", "value": "003ff689d57a789f55aecaa3c20d656690ff5bec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768999819, "uuid": "ea23ee27-4f32-4672-8306-05dcbc4d8073", "comment": "Malware payload (SantaStealer)", "value": "c17348cf67c05a2865c86919205e167e1de0eba690149b261790ed75e21e82b9dcdaaae42db3352878fe4c9e00716669", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768999819, "uuid": "d2a17e91-2062-4ef8-9932-84b0d36305bd", "value": "T19266D0CAD16B40DACC067FF598142BC39B3056324A340468366BBE595F739FAC11EEB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768999819, "uuid": "1e483581-b549-4e45-8fde-842c0eca9abb", "value": "09bf3c2c0d1e1c721043f5ca267758f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768999819, "uuid": "18652647-d2a4-4c1f-91fe-ab00d8710f23", "value": "24576:gNA5O4YnK7ghfrApaZqttBAFHqne2RGSIQ5nS5t2X/Hk/C2jHigsIJ9J1WAiMadh:gQGq+jNJxwgH0DZPixP86o8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768999819, "uuid": "a05e5456-2932-4d17-ad21-3675ff771586", "value": 6932480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768999819, "uuid": "56acc690-92d6-468d-95c7-f83fc0cd697b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768999819, "uuid": "b9aa0209-a241-4314-85db-9761a6626965", "value": "xLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23dfa458-f69a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980233, "uuid": "0bc9287c-b5e3-4ec0-92b5-0d89bd078fa8", "comment": "Malware payload (Mirai)", "value": "ec1ee8e3a3099950f9153c6296ffa71b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980233, "uuid": "567fcc93-c93f-4d67-9839-9f89bcbbf6bf", "comment": "Malware payload (Mirai)", "value": "d72aad55e5e50532b9928b639ab526f214bfdd66f04324da649351270bee8dec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980233, "uuid": "dd8b2501-4a0a-4f12-8131-2752d9f3ef28", "comment": "Malware payload (Mirai)", "value": "0da2ce489e6e56072acbb422bdbc1a6c8f01234b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980233, "uuid": "8a65b411-213c-4665-bc03-17239d0b748d", "comment": "Malware payload (Mirai)", "value": "e6206d6558fcd72934a4e374fa92aea3f188e5b440199a1a3fa2637b11963e20a549dccec75f2c66503be41de9f528e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980233, "uuid": "a18d235a-0fbb-4873-95c2-61ce78eea138", "value": "T1423302D770AAEF34E86254B3A00BBB84FBB23A67529367AD8D61792F046F19C1706011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980233, "uuid": "d2becdb7-e7e4-473d-8be5-6ade403475d3", "value": "768:fVNfIcpLIcwcSC3Kprj12rzlEPb4hPPMIl2gFXG+INK8U+z8ulr2p8jCsEeIwCl3:3f5LIHUG92tEPb4NM+xXGr5v6fsE7u43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980233, "uuid": "2607e8a8-fb47-44ed-8e76-507e37b86a3c", "value": 51340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980233, "uuid": "036f8e0e-a822-4746-a24c-80d543e68457", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980233, "uuid": "f04048e6-9c36-4650-b74c-f7d98158cc96", "value": "ub8ehJSePAfc9FYqZIT6.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b8b374-f66e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768961610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768961610, "uuid": "6c784360-a90e-4bc1-8bf4-eef01281036a", "comment": "Malware payload (Mirai)", "value": "bc9536baef60c9bfb037a004122c93d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768961610, "uuid": "514122d6-e568-431d-b105-7e88873dce8c", "comment": "Malware payload (Mirai)", "value": "d75ade600859348f4cd24ab444ec22a3a1318fe210819fbee187bbc9ad532840", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768961610, "uuid": "bc4ac134-a2a6-431e-a8b9-2cdca3c51971", "comment": "Malware payload (Mirai)", "value": "4def72b8fd04c3cb7e6684572df0e05b03118d69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768961610, "uuid": "90c9da8b-c055-41f7-9d98-76af3a4adb39", "comment": "Malware payload (Mirai)", "value": "fbc53f5e78adc4076088cd3372544e393ec90177fe508d9e30c47ecac9dbd739da6a91e0bcaa2912d7729f7b71a82925", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768961610, "uuid": "09d23242-db80-4578-a9ee-90f1e1c8261d", "value": "T1BCA35B02B5C084FDC4C5D1B80EAEA219D922F5AD31B2B55F27D0BF163E8EF102B5A665", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768961610, "uuid": "3d72fd54-ba6a-4e0f-b14b-9386547eef1c", "value": "3072:YlbFVwYea+mYmzQjDZZGuR1gv47Vkrnt/Ez:YlFVnVa9NRy8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768961610, "uuid": "8f90a81a-5137-4f42-acf5-8b342e6afd4a", "value": 104480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768961610, "uuid": "dd471ce6-7650-4d70-8866-ffbe42b3f8bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768961610, "uuid": "90a2d5f6-7cbd-4443-b5ab-a3267b8df793", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a107940-f70a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769028454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769028454, "uuid": "298d8637-51be-4d8c-8b57-6d8ab18675cc", "comment": "Malware payload", "value": "8a769c4a19a9885847e5d440a24a3020", "object_relation": "md5", "Tag": [ { "name": "Andariel", "colour": "#0DCC38", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PetitPotato", "colour": "#085BD7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TigerRAT", "colour": "#BD8FAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769028454, "uuid": "e9cde877-dc5d-4031-9936-8854040eaeff", "comment": "Malware payload", "value": "d7b6456b10677ee98c6f44bafa2dc5581f0a361224b57aa752809aafbf49a8c5", "object_relation": "sha256", "Tag": [ { "name": "Andariel", "colour": "#0DCC38", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PetitPotato", "colour": "#085BD7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TigerRAT", "colour": "#BD8FAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769028454, "uuid": "af8b2577-0c2d-4398-9f95-2dcf40746108", "comment": "Malware payload", "value": "52359ec9a48f69ad99dfd468a5a30cb1fe108c4c", "object_relation": "sha1", "Tag": [ { "name": "Andariel", "colour": "#0DCC38", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PetitPotato", "colour": "#085BD7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TigerRAT", "colour": "#BD8FAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769028454, "uuid": "0a5006b6-2bac-40ee-8fda-a55232537683", "comment": "Malware payload", "value": "9aa85d7cd5983d2269251ec6ea893705d461886107d8692eda5a03b0555483192a2207bd3e6736327aaab14224bc382a", "object_relation": "sha3-384", "Tag": [ { "name": "Andariel", "colour": "#0DCC38", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PetitPotato", "colour": "#085BD7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TigerRAT", "colour": "#BD8FAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769028454, "uuid": "3402d2f3-4ca1-46f4-b6a6-8da9e96b5c48", "value": "T160544A89B6A516F9DC7FC13D89511A01FA72B8150325D76F0BD00757AE73BA0BE3AB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769028454, "uuid": "c41382ed-00e5-4c46-8dea-6276597b9499", "value": "6ba73587950e00345eadb784066d8972", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769028454, "uuid": "a9c0dcae-b40f-4505-985f-165c8629aae2", "value": "6144:WdtW8ubDM8yelzLLglojqvOlIjgriPQlt4W4Lo4MwohbEJyPkovyEm8wT:Ki/LgloMOlIjYIo8yqE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769028454, "uuid": "a727af0e-98c6-43a2-a510-bd7fef0f24fb", "value": 293720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769028454, "uuid": "76f9fb1f-3cb7-442d-b5bd-576526438dfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769028454, "uuid": "8a18e7ff-24cf-411f-ba9c-1892d0607130", "value": "d7b6456b10677ee98c6f44bafa2dc5581f0a361224b57aa752809aafbf49a8c5.bin.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4867cabc-f69e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768982012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982012, "uuid": "6c00c56a-19ef-46ae-b480-b96c93d50fc1", "comment": "Malware payload (Mirai)", "value": "fef584e548b0034ff495a19aa8ee7f27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982012, "uuid": "a6b0f0c2-442c-4b63-800c-37c51fa1aa8a", "comment": "Malware payload (Mirai)", "value": "d8b487e4c9f23fa699b2d5a8bdc23bb5f15310550f765db7f774da4ee1095072", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982012, "uuid": "d807617b-0e7d-40b7-b376-5bdaf7e32879", "comment": "Malware payload (Mirai)", "value": "018fe3e7000cf07e236f5c95c2e1e4644c111863", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982012, "uuid": "a3336174-03bf-4263-b44a-bca7facf6916", "comment": "Malware payload (Mirai)", "value": "69bedcbcade19f0a2250e14ad4095f233397b8230638757460b362c9c9ff0526f38ae186ca79c08f37810f124472de62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982012, "uuid": "710e04b8-26a9-4348-9817-d2ecedc4d512", "value": "T16C04392F258192F0F6411B746BCBD3976C390BBF41A9909F6B516329B6E0B7BA02C447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982012, "uuid": "02224f5d-2d94-4b6d-b11a-e5fc2e4b35e3", "value": "3072:7mflblbBDfvNUZem/LVA7bGQU66gOVNLddnNgRdgJi55wo1UX9:7IJ5k1DVA2nDXNgEJi5ao2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768982012, "uuid": "25878ed0-f681-4fb3-9c78-c5273cc2f4f1", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768982012, "uuid": "30739571-a6e8-4a3b-a905-614284e9c86e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982012, "uuid": "0ec1d613-9175-48c1-8080-f6497268b970", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a49646bf-f6aa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768987321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987321, "uuid": "36aed974-9589-4863-9583-6b2190484beb", "comment": "Malware payload (Mirai)", "value": "3dfa1f215387a71ae98e348b1a4f6ad2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987321, "uuid": "24c65e30-448c-4b83-af35-d87257d32333", "comment": "Malware payload (Mirai)", "value": "db0ff4b19dc3154eb1efedd2f190eff785427ba86abf434f2188a5205609d4f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987321, "uuid": "2f924fea-bec7-447c-a348-40452ecf993d", "comment": "Malware payload (Mirai)", "value": "f03f3234aba7466c5962460fb989464f18b75728", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987321, "uuid": "725e4037-d1ce-47f8-a45e-cf4ca9be8988", "comment": "Malware payload (Mirai)", "value": "be3c751580caf07a2d1265b896d8e175cd3b29d5dba305b3fb680c3df9688779b09101f4745d3514fad8e3810b006f17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987321, "uuid": "f7cb2673-c177-4f45-9408-ae7daa20fbd4", "value": "T181148120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987321, "uuid": "43041b7f-0359-4999-9759-3622985234f8", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCRfUKG:IcY5JpMByVs9jSGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768987321, "uuid": "e852e8e8-2ebc-42c8-98f4-3a2e3fa12ce4", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768987321, "uuid": "c9ea7e7a-feb5-4244-a471-606fde9bf4c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987321, "uuid": "09470d27-0961-4cbe-bb99-9482798f8e42", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3f5a40-f69c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768981057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981057, "uuid": "c85cd4ae-a41f-4b6e-af98-d8800165e5b8", "comment": "Malware payload (Mirai)", "value": "ed53c585923fd5a78013c78c032a76c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981057, "uuid": "25c32399-8a0e-45dc-9263-7dac45b90f1e", "comment": "Malware payload (Mirai)", "value": "db2658866c177a5e254ebae8e0bbe0efd6ecbeffcc1c91f5c04f288c12b4c7e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981057, "uuid": "6f2790c8-2bc3-43cb-b31a-78d264a3f724", "comment": "Malware payload (Mirai)", "value": "4336b0e2a3478e0e67c0352c3544189fbf41da8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981057, "uuid": "ea5b4bca-b27a-4add-aa8e-c5321c7b5941", "comment": "Malware payload (Mirai)", "value": "d692ee5ef1ea611b2e99cd33e583d2d302fe804b12d5f6afc67a9bba7a959cccc9979a619a5540f81cc9213a1ac92ac3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981057, "uuid": "d81f4106-2c0c-4c0b-9552-4efbbd409809", "value": "T14633023A374122DAF546D97C57FA3BA51E3609601AF7ED043B1EE7D88F938745812E00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981057, "uuid": "cc8e4720-18a9-4479-84b4-ebd50939b8d8", "value": "1536:1Ot7LB89G8EuWW1F0XygiaGSQ2kbTuL9RVlVJub:10Z8ozGF6tGSQ2+srVQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981057, "uuid": "eafa08ab-2284-4d26-a403-49571bc237d4", "value": 52868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981057, "uuid": "f3db468d-b736-4625-b5f6-e0360aeb6176", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981057, "uuid": "c4d2448b-91cd-4234-b726-680d35a27502", "value": "ub8ehJSePAfc9FYqZIT6.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c60959a-f69d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768981616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981616, "uuid": "b22d4b0b-d6d7-4dfb-baf9-4a3cd16ad3ec", "comment": "Malware payload (Mirai)", "value": "e26e0421c2135f17907e09b6d565033a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981616, "uuid": "3a3da090-160f-4a07-b63b-aee99ff84c88", "comment": "Malware payload (Mirai)", "value": "db4bb374c33a4eafba67514bd501e0a2493d20bd191fa6ea2db172aa657757b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981616, "uuid": "b70727dd-cd5c-424e-8c59-4593dc933e5c", "comment": "Malware payload (Mirai)", "value": "1ee64acca834c08f94c32fc805f76aa57553ac43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981616, "uuid": "04bfed76-d692-4725-9f9c-4e18dda415ba", "comment": "Malware payload (Mirai)", "value": "17946f8fc8c93d238b82faf0ee32d58dc8b94e6ec50c1f8b101a1dc94008980a388cfb3dbf263d4f260def3a265f3abe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981616, "uuid": "a8b4bf15-9d10-4aa4-bca3-b4ba51ac97bb", "value": "T12D63AE73CA1A6D44C04C82B2B9744E787793E45046A72EFA5697C9BAC047EECF0413F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981616, "uuid": "266563e8-0936-4a7b-b4c3-df51c0ce92b8", "value": "1536:fau/+UwZQL9NhHKdYWmd8ZKhGoX5jspCFh8fcqod/wbZnU:fLz+ytKdY0ghNjsp68kzRwbZnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981616, "uuid": "1bbc1051-e220-453f-8945-039e4cbcc7cb", "value": 71584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981616, "uuid": "ecb353e0-dd4a-40c6-a4a5-d035dbd98be5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981616, "uuid": "5acd0712-30fb-48cf-b84d-9d371bfe8a73", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f356dd66-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768998620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998620, "uuid": "8683b9ee-5503-405e-967f-de83ee810315", "comment": "Malware payload", "value": "ab5f820c026189088c903755cbecf657", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998620, "uuid": "cebbf62a-6265-4e97-9467-7aec4a265b0d", "comment": "Malware payload", "value": "db8935c2db0935b26314990166745a1a1d565d4de92cd6f3724e5001dafa87b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998620, "uuid": "4ab6184d-99f3-406d-a724-ecd10973b3d8", "comment": "Malware payload", "value": "f8adfb6d4bc0fd25c23a91b492a490665d76018f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998620, "uuid": "545a5ba0-1158-4c74-a30b-ffa123bd8a9a", "comment": "Malware payload", "value": "ef9c8b7ebf9cefc9e6f8809a6ef73b11ae94e68f4000980ce17bbd19f71679260546600db32431188270aba1f60efe09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998620, "uuid": "aad7b3db-efe7-4922-8228-5fbedb4efadd", "value": "T1AAB31B4ABDA01FEBC01ECF30466F831712DC98CED2A5632E72BC8D9D396974549D3998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998620, "uuid": "8afb8d26-0cb4-432a-839c-b6802b55d4e1", "value": "1536:T9jNQSFVVEmPDUhFlIlb4M4UNvZbOWTSVHoPupHzCDtYLPkkkKO4r:TvQYEmPNGSjbOWuVIPQCBYLskB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998620, "uuid": "0c02776d-8f5b-4d92-9062-788e715730be", "value": 117772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998620, "uuid": "6cb2dc89-38e5-4568-82ab-0994abd8f987", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998620, "uuid": "a198a3c8-c14c-4d8a-9427-9024e5145148", "value": "plasma.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb09ba06-f6e5-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1769012699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769012699, "uuid": "05700336-373b-44c6-b29c-4e58fb994d51", "comment": "Malware payload (QuasarRAT)", "value": "8accf57b7761036a1adfe6d7ff541bd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769012699, "uuid": "40476682-a379-447b-a0e8-3ed402f7456b", "comment": "Malware payload (QuasarRAT)", "value": "dd21e34db67700a88de8eab9e152fe7f8d8bb9c6818063e2e9a3e01c37159df5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769012699, "uuid": "7786973e-e3f9-49ba-8866-130e49458f47", "comment": "Malware payload (QuasarRAT)", "value": "c47006c449669d15147267a262e853a3ff8727f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769012699, "uuid": "03bc2b53-4b2a-4e7e-bc0a-5a04289d902b", "comment": "Malware payload (QuasarRAT)", "value": "74b4e52210c32d230e860b63940997c09ae86589772f93ce1c703a5950ad38d56fff74275681e1d3d2004dc76919888d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769012699, "uuid": "eead9a44-bc6b-4b2e-8363-91ed222bc35d", "value": "T17AF56B143BF85E27E1BBE277A5B0041267F0FC1AB363E70B659167BE1C53B5098026A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769012699, "uuid": "167f8602-5cdd-4efa-a24e-a7c37c0bd359", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769012699, "uuid": "60952d8a-9b78-436d-91f5-871026aefad8", "value": "49152:uvxJ1+2g7axHTYPVlO0Szgcp5bWdzRJ6HbR3LoGdVvTHHB72eh2NT/:uvbY2g7axHTYPVlO0SEcp5bWdzRJ6ZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769012699, "uuid": "b01d66b7-6fcb-4f01-94f6-45781adf8c14", "value": 3334656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769012699, "uuid": "49b53539-8804-4bf1-851b-72775438acf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769012699, "uuid": "8f3a029a-bb14-43af-aacc-b79e22c740b3", "value": "Window12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28777a21-f6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768984965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984965, "uuid": "ed841bca-a310-4bfa-bdb3-1f7714214845", "comment": "Malware payload (Mirai)", "value": "fda448f6026d7247352e91753b66ab33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984965, "uuid": "d5c247ef-9118-4dc1-a77f-e5f15b1cfc64", "comment": "Malware payload (Mirai)", "value": "dd6cc89768cbdd5cc6d76a7d2d3a796840539c1dadfd99796a8df9e36c1f6523", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984965, "uuid": "dd35e116-8869-48e0-ba58-9382c014958b", "comment": "Malware payload (Mirai)", "value": "f7686b098b04cf38eff239472f485c30adf2d7e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984965, "uuid": "5b556e50-5735-4955-8340-6eb405b97e02", "comment": "Malware payload (Mirai)", "value": "4dc09daa287f5749ae55085e35f4a1006287667a2920055fa0abdd28aa3927c968c2acd7e53ee59ea0908bac7bdde201", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984965, "uuid": "264ba124-0ea3-4ab3-a57f-80897bbf1d17", "value": "T1B204D60AAFA11EBBC8AFCD3705A90A4239CC641722A53FB57674D524F54EA0F49D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984965, "uuid": "d02ed51e-5e30-47b7-9590-b9916132a66c", "value": "3072:+d2kBaoMRjENmKlMH2XLxWAFXbtG4J0O6P:+d2kBao6jENuH2XLxWAFRGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768984965, "uuid": "a6acb744-657e-4ff1-a16f-3e31b6abb85f", "value": 175596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768984965, "uuid": "1a74dc05-1239-4a2c-bfe5-5926df9f51fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984965, "uuid": "6655be4b-dd25-46e7-831d-d80efe426236", "value": "ub8ehJSePAfc9FYqZIT6.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aee427b-f69d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768981614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981614, "uuid": "85788c2e-ba3a-4f95-b252-c519b9924f49", "comment": "Malware payload (Mirai)", "value": "2921233224400941b97887f5e1a26fc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981614, "uuid": "b4aed4b7-f607-49c3-a97b-8bfcf8a13d71", "comment": "Malware payload (Mirai)", "value": "de4a52d34f3ba32ef454d926f6c7466868bc79368634a00f06685405a2ec7e3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981614, "uuid": "498059bd-a8f9-4534-b240-2011b062b19e", "comment": "Malware payload (Mirai)", "value": "33deae57fb475a6eacbe0d6c0595069d88845b2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981614, "uuid": "0f9129fe-9257-4cf2-8885-7291113b5bd5", "comment": "Malware payload (Mirai)", "value": "6cf14731070ec6965fc64e652f96dda6eb7545235e5b4b8dc7a0d1b22e67e8d5954a0210f2aa0199fe2cd24f0bd178c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981614, "uuid": "e56e8ded-6bf3-4d2c-b549-7b8cb663fee9", "value": "T188B35B63CC392F58DA18D0B4B2B48F396B53A55191871FBE556BC3B88043E9CF9093B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981614, "uuid": "44566942-f622-473c-9c1e-464b3126b582", "value": "1536:iaM/u1GmwDYFqLQCN9+xAfr7KW6ya/SrpKcQ/pWumm3:iiG1YFqsA+xKKWHjrQc3m3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981614, "uuid": "9bd300d3-ef70-4a50-b45a-d1eb80b7d6f8", "value": 114852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981614, "uuid": "3ebcdc60-4f86-40a1-b870-777058886f10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981614, "uuid": "02623cde-f7f3-4082-a09c-78cfd5d646dc", "value": "ub8ehJSePAfc9FYqZIT6.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1da55bd-f6a0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768983021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983021, "uuid": "df80c871-513e-4019-bc77-3fb41754c8ae", "comment": "Malware payload (Mirai)", "value": "9a8dd9269c737a761a6c473818490f65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983021, "uuid": "efeac27a-2f0a-453e-946a-9cc25438eb9a", "comment": "Malware payload (Mirai)", "value": "de8fd4f9d5874ae69fe0dd311dc27fd03fe38e383adbbe05feffb78366dc58f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983021, "uuid": "bae3d878-366f-4b14-a2e8-3b8fd8dc7aa1", "comment": "Malware payload (Mirai)", "value": "565a92aa70e5fffcaf0a83ec90f6fcd3ca5ee692", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983021, "uuid": "52e2bf10-8999-461d-b3fc-224bfb34590f", "comment": "Malware payload (Mirai)", "value": "482bb316ad556c3bb4b4643323269f3bbfdafa5d11ea30407433143dc176192218cd85454f345b3bf5dd8b0ee5e2df42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983021, "uuid": "3488e81a-bd67-4aff-9042-7b6611d97d25", "value": "T15CB36B63CC792F98D219D174B1B48FB92B539921928B1FBE5567C3B48403D9CF90A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983021, "uuid": "47205f58-6634-448c-ba32-aa8d3fa5bf81", "value": "1536:AaX831YV+YWyTxxR8CW9plubTWcbvVJUkpKr62li8nkh2t:AhYV+LyTvR8BplsTWcrsBrXkct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768983021, "uuid": "93837f68-9d84-4905-a9cc-032b076b1b78", "value": 114884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768983021, "uuid": "2f8c871e-b5a3-4814-bffe-02f190e86152", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983021, "uuid": "66a359a7-9415-4c6b-8a5b-b6dd81dd5941", "value": "ub8ehJSePAfc9FYqZIT6.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1e999d-f69a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980408, "uuid": "22be5a01-04a6-41f6-b82a-e71b0ea3e922", "comment": "Malware payload (Mirai)", "value": "a6511b5df3cd3ec5b9139158bbe2ffa6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980408, "uuid": "5591638e-f3a7-4451-a0a4-9bcaff0d3fb4", "comment": "Malware payload (Mirai)", "value": "dea4860b90acb61fec131425f192065f884c6369580df701be16dd92a954f13f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980408, "uuid": "9817eebf-75bb-465c-a919-79dc18a3adfb", "comment": "Malware payload (Mirai)", "value": "694a88fde895cb19e11ba6de2c79a6d55ef01d59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980408, "uuid": "3f77cca4-8d93-414a-bd2f-89af9e644ee2", "comment": "Malware payload (Mirai)", "value": "22bf81c7e0da24edc9eedfdb4729aff8acaaba711373798c5d764fe9ea12f8168175e0d73388936d6c724dddd3cd083e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980408, "uuid": "f3ee268c-8a1d-4c3c-89fe-44a4f0154376", "value": "T1BCE2F1595709C8A2CFB42835D43AC64DE28176FC80DA787B78208FA4C5D8A53DAF54E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980408, "uuid": "ebbc86f6-781c-474c-b963-c3707ab00d2d", "value": "768:4EV2aHVGQMhWGaDaR3TacAvvcFq4T5XKr3kzEX09q3UEL5l:rJHVclQaR3TaAqO6rkEXdLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980408, "uuid": "9573c7c3-996f-401a-862b-84e745ccbe20", "value": 32700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980408, "uuid": "346d96f4-9dbf-4aa2-86f5-a4bca9859c3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980408, "uuid": "c5bc950c-622f-4f86-9872-32f2d0844d84", "value": "sdxkzX_UXA229x.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee6fa58d-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768998612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998612, "uuid": "1421df8d-062e-46d9-8650-4141b05b5d9e", "comment": "Malware payload (Mirai)", "value": "db1e5a932adf8e5dd183ef2341612ebe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998612, "uuid": "58638f6f-7598-4b30-9dec-5cf6b31da73e", "comment": "Malware payload (Mirai)", "value": "df7879a8434c1d1c656ab71b6c90df95040590ff9e2340437232bcf5cccfe79e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998612, "uuid": "3f818240-3e3e-43a2-a1f0-db5ce6fb5842", "comment": "Malware payload (Mirai)", "value": "ee6ed7dc990633324f4d362568ea616488ad16d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998612, "uuid": "1a09d04a-0431-4bc1-9ae2-bba1dd047a94", "comment": "Malware payload (Mirai)", "value": "022e697e2ca2167fca399ee62ead33609d44219310cfb5469bc9cc4d3cdafc564de1010050e81e22f64dc3c03a3a8760", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998612, "uuid": "1f1e6bf1-45b3-404f-bec8-bada947a4f02", "value": "T199B31946BEA05FEBC05ECE30462F831712DC98D9D3E5732E727C8D8C79A924949D3998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998612, "uuid": "d76569ef-6e69-4218-816f-91887508aeca", "value": "3072:z4nR6TBNcSEjsWlYe7NL2CvFx9Xt5um0:z4nR6TASE4WlYeICNxAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998612, "uuid": "4430924e-f13c-47ba-8bb5-8339782627a3", "value": 118112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998612, "uuid": "443f0f42-5f57-4d06-b207-75db507af8e9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998612, "uuid": "0b4c2d4a-5b77-477b-b7f3-e021820b3331", "value": "kk.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030a4d24-f697-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768978889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768978889, "uuid": "019a8d46-b753-477f-8f8c-d4c14b0577ac", "comment": "Malware payload (AsyncRAT)", "value": "2bf284483d1d64659d898a03eb0e11d4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768978889, "uuid": "1f4f3ac5-3d00-4cc9-8f0a-1776b12ec4eb", "comment": "Malware payload (AsyncRAT)", "value": "df8c3b637a6ce86745a1f6588e0ee822867754a5b4324506f0970ffc3b3a5cc5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768978889, "uuid": "d3290067-b44d-47b7-b2c7-88eb27299ed4", "comment": "Malware payload (AsyncRAT)", "value": "fdcc54328158abfb73b397d2a7be2dadb2426070", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768978889, "uuid": "8e987692-f3e0-4b26-93f7-969e1c2fb963", "comment": "Malware payload (AsyncRAT)", "value": "56fc734be4a611d404bcacbd4582602488bcd8c704dbd13033542333c00570d4f925f71352ad52b5e4b7adf47d152ad3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768978889, "uuid": "a55e28a5-6ea3-45a4-a272-7048b7e7ed3c", "value": "T128450082791D8DFCC9749A01911B79CFFDAF802A60CA161F3571E8EF85414EE22E9739", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768978889, "uuid": "82c7a146-9178-4544-ac0e-c3ff27953d9d", "value": "384:VrpKUeHKUIOrqZsqMeHaSQZAowACIWR+fP5r434d7fwx0TYDkG0cLujoBDPOoVLy:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768978889, "uuid": "f46e244d-e67f-4c9d-b1a7-e217663d1cb7", "value": 1230020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768978889, "uuid": "0fbad207-0bc0-4c7b-9457-b8ec338018b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768978889, "uuid": "e5b623f1-db86-4bc0-a3e7-810e42bdcaef", "value": "Final Quotation Request- AHPR91 Our Ref BR 4837.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "116c13e7-f6d7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769006401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006401, "uuid": "b6cb1116-9488-4052-8083-d1e32bc93c88", "comment": "Malware payload (Mirai)", "value": "a22dcbe2e9037116d441b5afae2675b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006401, "uuid": "3f4f14b2-aea7-4f67-80ae-e794230f2a5f", "comment": "Malware payload (Mirai)", "value": "dfd8a925739e4df860e83995e0625d562ec32ab5f7b338b204a30939b2019f3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006401, "uuid": "ec791ee4-4814-4d22-ab8f-964080f2b49d", "comment": "Malware payload (Mirai)", "value": "cc229e25163da0a364d71811b3c8bac566d7a73f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006401, "uuid": "4823c9a8-dc52-4b93-b2d6-aca89c097b82", "comment": "Malware payload (Mirai)", "value": "7555a09d70beb3069ec95ca540e4effc16963ac602a74bd77b60e176ddf7164eee275397d8d148da776ff8b88e820da3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006401, "uuid": "e5a2c2f2-9a2d-478c-aa1d-b68590563fb7", "value": "T10CB2E133CB30AB31C930083BBC3AD511DF565B3195BA745A19694B552FC1ACF53BC689", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006401, "uuid": "11f7e627-0212-40fa-b707-c1cbdc930ced", "value": "768:PbOIC33oVXf7LfjsB1oKKwDP4Bms3Uozl:Pbeop7LbsBjKCPuzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769006401, "uuid": "a7c2fc14-5b83-4306-a905-bcc99868181f", "value": 25644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769006401, "uuid": "d1bff8b7-0dc7-4303-8479-83d8fb03193f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006401, "uuid": "f7389b5e-a4b4-452c-b72d-31d99ddc9f07", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb85e69-f709-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769028271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769028271, "uuid": "fcbd1fd9-34d4-4f62-9b0d-66404c1d09c5", "comment": "Malware payload", "value": "856c20c37aa62eefbd0c11d3c3c6ecb3", "object_relation": "md5", "Tag": [ { "name": "Andariel", "colour": "#0DCC38", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TigerRAT", "colour": "#BD8FAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769028271, "uuid": "ca18c567-5c7d-477d-81a0-f25fa9c97521", "comment": "Malware payload", "value": "dfee8fdfd963923fec13c5c93f8977add45b5c6ff9c0fc322dc64549e46f1178", "object_relation": "sha256", "Tag": [ { "name": "Andariel", "colour": "#0DCC38", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TigerRAT", "colour": "#BD8FAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769028271, "uuid": "4a0b235e-1c7c-48c1-9509-e534e5115e4d", "comment": "Malware payload", "value": "da081ce7e01023e61e13047316f2d8c078d5fdf7", "object_relation": "sha1", "Tag": [ { "name": "Andariel", "colour": "#0DCC38", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TigerRAT", "colour": "#BD8FAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769028271, "uuid": "99554d18-8bdd-454a-b722-711f946f542d", "comment": "Malware payload", "value": "ea8f3afdc35e0f0251de522fef0ca9e8c36874c836641756ab3b11fd815dba0188e0066e39f7f2382d4944722a9bbdb8", "object_relation": "sha3-384", "Tag": [ { "name": "Andariel", "colour": "#0DCC38", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TigerRAT", "colour": "#BD8FAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769028271, "uuid": "9362175b-f028-468f-9c99-ecad4dee777c", "value": "T10946F816E7B640E0D4BAC0398566A26BFCB23889C77957D787414B5B9F227E0EE3D700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769028271, "uuid": "e28a3ca9-272d-4db9-9f4c-c6a65fb59c4e", "value": "370950a7651bcec14b35425ba5b1ae79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769028271, "uuid": "df6a06b4-8f8e-4c17-9d31-b8cffd059bcd", "value": "49152:bhMJ1IomI45VKge+xS/kb+CJhgFLVBTwmUMGaS8JhtHCTBW3rHvDseP/82BuBpgB:umfO+KGauOjRLMuE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769028271, "uuid": "82868b02-5d1f-425d-b1fa-c076884a4058", "value": 5783552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769028271, "uuid": "643ace73-6ead-41bd-a265-d4298c23e56f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769028271, "uuid": "73aba6c3-15c0-4cb5-8622-16863b90c6eb", "value": "dfee8fdfd963923fec13c5c93f8977add45b5c6ff9c0fc322dc64549e46f1178.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25222c25-f6aa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768987107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987107, "uuid": "db6c1611-c7df-42eb-846b-094491d9e8ca", "comment": "Malware payload (Mirai)", "value": "758d5e316faf8ac7030498f433234e35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987107, "uuid": "94e705d8-d6eb-46ff-8268-92cd1b33a0db", "comment": "Malware payload (Mirai)", "value": "e02d987038c529fb868b42d92f2d4eb081c45eaa09766b5c8434324f0a8b8e7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987107, "uuid": "06072b15-c688-4196-a102-8ead5953f472", "comment": "Malware payload (Mirai)", "value": "74030835ccd10c0c43c74c6867afc8f0d6985b78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768987107, "uuid": "62c81543-0287-47ab-a3ea-7ffb55bf0703", "comment": "Malware payload (Mirai)", "value": "a9e5f037f0fe36b8f8c8f261e9f55f98150b0b4ec4b3d81b85ffb2fa0ae14c585cf9d372dfb5aaf720ace3fc24d46ad9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987107, "uuid": "69fd210d-6273-4474-8834-5ca3b9170b54", "value": "T177146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A9977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987107, "uuid": "26178880-4bbe-4b8c-bc62-19b767ddfed8", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtz:BZAyFzQSdS7I6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768987107, "uuid": "9c65f7ca-04c5-454a-b732-e846a2a35aa8", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768987107, "uuid": "75805633-21f1-42d4-a8dc-476e6bc6d8c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768987107, "uuid": "d5f15f19-1306-4a65-a6df-616622fe8772", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28fb8ab5-f6cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769003005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003005, "uuid": "83b0d51c-2a31-41b3-9317-276e09082ec4", "comment": "Malware payload (Mirai)", "value": "6ddfbc58ddae3e4ba11337765cd3f53c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003005, "uuid": "09354d6f-3c5f-4fd4-abe3-11c5f25ab96d", "comment": "Malware payload (Mirai)", "value": "e06319a2a6d0f18a56e46139d3d51a334dbafb491c0c8bbe8f08a504e45dbdb1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003005, "uuid": "2fa2068d-2b8a-4199-a72a-130a5197ade9", "comment": "Malware payload (Mirai)", "value": "62e1978bacfaf484fe455adbf3b00e09a6dc505c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003005, "uuid": "2fa581c6-2246-48dc-948a-a06c89016b52", "comment": "Malware payload (Mirai)", "value": "2fc83281ec85a2652eed50bd4fc8232dcb5f62322b27bab554cba7bcbe45ca1af4c72596c38c606cc0eb4adbe35173a9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003005, "uuid": "c2eb5114-a8b8-4d04-a002-bc0420d5d47f", "value": "T1A811515F0245AD94C08DD47A37D2870DB4844FCD287B0657AD6240B940E06CE773895A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003005, "uuid": "4891db12-8ac9-4d27-9c45-23ab65690cdd", "value": "24:H7NASa7AQSa72Sa7DSa7vR+Sa7bSa7gDSa7bDSa7rSa73ASa7neST:HzaMa/aqabhaaaNaeaiaLhaHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769003005, "uuid": "e4217e1c-bbb7-4394-9265-cc9a7081bd1b", "value": 1010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769003005, "uuid": "897fe3f3-c1d4-4775-9c4b-e4d13481be91", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003005, "uuid": "f7e494ce-9cac-4a85-92a5-e5464a2f480e", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d04ab90-f6c8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769000086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769000086, "uuid": "408578d7-391b-426a-9f46-1ae64a18069b", "comment": "Malware payload (Mirai)", "value": "cad426aeb3a3d82737b05c73b6015d57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769000086, "uuid": "240f79da-525a-428f-8e22-0f25ce0c5412", "comment": "Malware payload (Mirai)", "value": "e2229ecb29616af8aba244f560e6468bb660d12453ecbf10046e452ed1e4d091", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769000086, "uuid": "90dd18ef-f12e-477a-978c-bcf75e34e7df", "comment": "Malware payload (Mirai)", "value": "e70b95ef1f3579e9e1020ef2c39d4a20b54ab3b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769000086, "uuid": "1b4d8d2a-a2dd-4a58-800b-b56f72222f32", "comment": "Malware payload (Mirai)", "value": "07871eb40c39be17e68169869a8e9a7f3555cf4882b333e6b7812f814eb287261f5de8f93f0267d655edc41f9260db59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769000086, "uuid": "a8d6b560-35d4-4657-af66-bec92aecb7bf", "value": "T17B144911FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769000086, "uuid": "a22df16b-9b6a-49ab-8907-7797575b2100", "value": "3072:ty5+GoCEggi4NerYqltSwJpH6+cYstkgUat:o5H5BT48rYq1wjY2+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769000086, "uuid": "ab5a1275-ed3e-4642-8e43-5f009ea2f5d4", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769000086, "uuid": "bd73a5bf-7ab3-4386-83e3-cf2f285e99dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769000086, "uuid": "511ce9c5-c96c-41aa-a19c-d4f1759c2f50", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445bce14-f70a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769028391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769028391, "uuid": "bf396859-eb7f-4659-95be-73b8cace71f7", "comment": "Malware payload", "value": "260466664947d6a0372c99d664879204", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769028391, "uuid": "38d80d7e-1d46-4538-8ace-c630155ae140", "comment": "Malware payload", "value": "e26f140471d992e4a721cd8916b19213c499f180c6378f66963759ec9c2f10a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769028391, "uuid": "9d5dc3af-cc4a-46d9-a357-0e322b382fc6", "comment": "Malware payload", "value": "05c6d6d4eddc3e16307b4d63b3fa0c0404bfea4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769028391, "uuid": "122d9a85-9f01-4a9e-b328-75990b79e029", "comment": "Malware payload", "value": "3dc38c9b36ff67fc5d160853afd7dfb8315d0b0e3a071156ae183c6eaece0f1d9c1002b5a26f20965b0ac9c4a866f6ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769028391, "uuid": "692f6fa3-0c97-453c-a854-4df2ea750542", "value": "T16066D0CAD16B40D6CC067FF598142BC39B3056324A34046836ABBE595F779FAC11EEB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769028391, "uuid": "d098a8fa-1a6f-403d-9481-05ee045b0aeb", "value": "09bf3c2c0d1e1c721043f5ca267758f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769028391, "uuid": "c4e912db-8c81-4b6f-b52c-7c6a810bd003", "value": "24576:v/u5bUzp7Z2Zu9wWP+l5xCHZfobbkaCsczUnblie1mNX+eCXK9J+cULDui4lieOm:vm2Y/cNBj2TTJXawd5QEo8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769028391, "uuid": "5b01e1b2-3c82-478d-9bd4-1a3c41a2139e", "value": 6868992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769028391, "uuid": "ffcbc6e9-16cd-4a99-9ec8-513f062637ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769028391, "uuid": "c0702940-5940-4d15-9351-29e96d2fd1a8", "value": "Overrule.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d11c3f1-f69d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768981618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981618, "uuid": "0d1775fc-9562-413f-8a08-bbbf8e3399f3", "comment": "Malware payload (Mirai)", "value": "b71ad00a2b18c98c0dda0298c33457fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981618, "uuid": "9aa30493-ba64-4268-a404-a7b8a7eb2b60", "comment": "Malware payload (Mirai)", "value": "e2813a846d88dc5efe6649e079d5610ece5514c5803192e6be88dd04683f7cc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981618, "uuid": "7eef6cbb-6a55-41d1-bf51-be4503e6a2fe", "comment": "Malware payload (Mirai)", "value": "e3867ef0532e787a20107dc82dbf9db3db9d4959", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981618, "uuid": "2771b1b1-a85a-4e4f-8531-3be48625de0b", "comment": "Malware payload (Mirai)", "value": "8f3bd076de2ca417ff9a0ddc10bc828cd367ef9f27744c64f4731649f92ae2108a02f5d47ce55642b3e44da47606f31b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981618, "uuid": "005b2b46-a90e-40d5-867f-681c1b63fd9d", "value": "T1D423F122A2CB3EC494B10834DCFC56D23B5B1AA8D0E7325339EA486456597DA7C7C7CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981618, "uuid": "7c9d1c11-4fe4-4a0f-bc9b-3cf4a9e2201c", "value": "768:Z2GtAqTm1H99qhXGxtWdXpyJPe1v58GEI1t9oIB75KDBRxoQXDN/wpz8UIfWSs30:8iAqCF9wBGxteMRe1v524BBFKDBj5z9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981618, "uuid": "0cc8e414-4a28-40fe-8999-9fb181c82da2", "value": 48316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981618, "uuid": "6ada0dd2-ba15-49d0-8133-490c054e05cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981618, "uuid": "4ce2f46c-a4f4-48d5-bd60-b0c22286c187", "value": "ub8ehJSePAfc9FYqZIT6.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77cebb8c-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034920, "uuid": "a135ac38-774d-495f-8558-279b14ca9d4c", "comment": "Malware payload (Mirai)", "value": "e4b01c9b46b4915c0ce0c09b57b5c24b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034920, "uuid": "149d54a1-9f75-4e00-b650-4baeeea4c4de", "comment": "Malware payload (Mirai)", "value": "e3276f094bf82698b497987fe239a4b7415ecff528dac27d43c7059560ff0451", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034920, "uuid": "1112c9ef-6044-4d59-8a58-9a9f5d5c4204", "comment": "Malware payload (Mirai)", "value": "9e700a92ab616c81f21f1b923242c6e81eabe538", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034920, "uuid": "6b976c38-3eb2-4b97-b07e-5c0fa452da60", "comment": "Malware payload (Mirai)", "value": "10fd06c1ab866d0e033931ddebd3f50a93581954e4dafa2ca376f49cead03fccd45d686ce867c861f261e6816aad5d79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034920, "uuid": "02dedc99-ae72-4c03-9a03-79e1f42b6ce3", "value": "T1CCD3E70ABB514FFBD81FDD7306F90B01288C792726A93B757534E858F64A18B19E3970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034920, "uuid": "6707bf25-beaf-4dcb-956d-cb9d2da4b04c", "value": "1536:oJuRPT8/m9hJ3a7u2/JxcshzGgIdXxATS0iOqwNj20ZaFJ6v6yxiFkQJukAPb1Im:auRPT8/mqu2/vtqwVDOJ6v6yGqGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034920, "uuid": "b56627c3-922a-40b1-9cb0-a15ba7ad95b0", "value": 130216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034920, "uuid": "89b4a72b-d06c-4f81-bf06-c977d618b5ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034920, "uuid": "12be8316-88e3-49dd-a95c-7281f6000fe6", "value": "titanjr.mipsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1537528-f6c5-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1768998912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998912, "uuid": "b4ad5900-8511-422c-85f6-0322e30873e7", "comment": "Malware payload (QuasarRAT)", "value": "3f4c866f68140f59bfc92edabfbbf6a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998912, "uuid": "ef05240b-dd6c-49b2-8954-92a2fe565cea", "comment": "Malware payload (QuasarRAT)", "value": "e41b36b6d92fc760256888c8cf9de47a28d79e8f3f8713b4ad1596d53d09f492", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998912, "uuid": "b666ce9c-0d94-4768-8d5d-0fb483f9f242", "comment": "Malware payload (QuasarRAT)", "value": "a3881ac95e6c102f928a59990fabc969eb84f721", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998912, "uuid": "f9a472e2-9698-4fdd-be4d-33e91526a959", "comment": "Malware payload (QuasarRAT)", "value": "36001b1e6c72534e082cfd36568f751be40bc0fe84218857b4b5295b5c879c1c5c0b32115f513444e784f0c77bb57bed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998912, "uuid": "d12ad8f5-32a8-4385-b24f-edd59feda787", "value": "T11EE55B143BF85F23E1BBE273D5B0041667F0E82AB3A3EB1B5191677E1C53B5058426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998912, "uuid": "95b5e06d-41cd-4bd6-8cf1-972474739159", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998912, "uuid": "e26ef694-4b3c-43c6-a027-c855c84441ce", "value": "49152:mvkt62XlaSFNWPjljiFa2RoUYI4WxNESEgk/iELoGdzbiWGTHHB72eh2NT:mv462XlaSFNWPjljiFXRoUYIBx3Kj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998912, "uuid": "be32618d-b55c-4749-9458-d0715f8e29c5", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998912, "uuid": "a313299f-c1cb-4adc-8d08-44760a3aaf8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998912, "uuid": "efc7c868-a720-4aa3-ab6f-9758dcd6cc47", "value": "r4tMpI3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66430596-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034891, "uuid": "3b107eea-cd3c-4728-ab83-1d56f8b318ea", "comment": "Malware payload (Mirai)", "value": "3759e27625e84a21043d0000d7373efb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034891, "uuid": "9dfa0da4-3437-44ea-aa10-0a0dc24eeeab", "comment": "Malware payload (Mirai)", "value": "e41e5677380874d4dc1a6cfe1de973ce81f144f6aaf70d9aa45cf32d3dff3d68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034891, "uuid": "ecace147-13b7-4f64-ae29-c94767c4791f", "comment": "Malware payload (Mirai)", "value": "cc15588133d9b98a5dbf0598ba5977b60e7e44f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034891, "uuid": "cdd68527-e842-48c2-95a6-5ba2201cead1", "comment": "Malware payload (Mirai)", "value": "fc7066d940608c714da102fbf2c1f0df06a01f6fbc29a10fc864347c43a449c55f088a031a4b7cef9c8a53e2b78e1d3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034891, "uuid": "91da4048-ab59-4fab-97e3-b295798ecf20", "value": "T10ED33922753A1F2BC4E4A87E12F34361B1F217C925A8C94E7EB20D4FEF652502647BB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034891, "uuid": "1dd6d815-df2e-4d9f-b784-739baf41ea16", "value": "3072:k4o08JGjBWZLBKkiS+IzL30pyVz5l8y9eQM/Y4QnsGC:3o08JGtcLBuQXj5mSeQM/JQnsGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034891, "uuid": "7b184e50-1ae7-4e74-9291-71bf5a8b673b", "value": 142264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034891, "uuid": "ed4db5b9-d569-478c-bfbd-7f0e14aeb37d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034891, "uuid": "525ae01f-94b1-4a54-90fd-58fdd4843050", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78d88b3-f718-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034678, "uuid": "df96c06b-4da3-4457-af31-78106715fe8b", "comment": "Malware payload (Mirai)", "value": "7b0b1d00ece93e67fbc8e2df106a2388", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034678, "uuid": "dfb99f95-f89c-4d4e-87ce-f016132ea9d0", "comment": "Malware payload (Mirai)", "value": "e483dd10e64ad2c828b20395c1a882f93fe34b65361898898771bc1cb86a33d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034678, "uuid": "c47ed91f-c6af-431d-9fdf-1b0cf3eea699", "comment": "Malware payload (Mirai)", "value": "5188d66df3141ec65d595b44d4fa943e13dafca7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034678, "uuid": "1874147b-64f4-46f0-8563-d0d566c0c65c", "comment": "Malware payload (Mirai)", "value": "399ff4ece2d799e250c9854616c71e0173ea3a9ac9c8d45e21f01666a130b53d25b6ed421016fc825134ab0aa2047cc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034678, "uuid": "8be16dfd-9fd5-41bf-91ac-6f20e971ded6", "value": "T123434C13BABC2A1BC4D0A67211B38362E1E91F4581A4E68FFD650D4FAE453841B777F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034678, "uuid": "66fce990-4592-47b3-93c8-6f63a9bf8f3f", "value": "1536:IrnwiMLX+p7JMKgJUyfIVnEw4B2rsOynAq/gfrNF8Oz:I7/Jp7l4sbIOyAqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034678, "uuid": "fd8d7e61-7f22-4240-83e5-e951923b66b8", "value": 56816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034678, "uuid": "c6035472-f03a-42e3-9a76-3f77633be72a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034678, "uuid": "edb2e4a5-6ff0-4ed9-a2a3-c7abd7be08c8", "value": "titanjr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d912cb2-f69a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980410, "uuid": "92467d95-fa8b-4b26-ab6a-6228307846cd", "comment": "Malware payload (Mirai)", "value": "f3a875c563fcc4dcfe97db7248912a0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980410, "uuid": "553977a6-0ff4-45a2-a0e8-a773def8f12b", "comment": "Malware payload (Mirai)", "value": "e4b2423966eb1322044171133f54176df529fb42325cb02430bd704fbceec2fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980410, "uuid": "a686952a-950c-4182-9d2f-fce33e53d777", "comment": "Malware payload (Mirai)", "value": "ec0e6c6dfa70c369c404dbb2f4cb92e5c8911c91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980410, "uuid": "f5356779-8270-41a4-af16-973712f0aed9", "comment": "Malware payload (Mirai)", "value": "3aad135c69ea442481ff1932e355012aeef494663f722622a944ab7f5d0a65f470eaf7b8c7ebbf76417acc68ec1174cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980410, "uuid": "d3c2d1d4-3f37-4940-9d9b-273a447f2d6c", "value": "T12033F134929ED4E2CDE00D77E83E04D7BF5B37F822796542372C4444BA994821E6BBB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980410, "uuid": "2fae339c-bf3a-48b4-89ed-222f28872c9e", "value": "768:cIcqn5TnOPnoeOrUJn+nZ2p1gtMO/j31asgyM19q3UELyvv//OistIC/4RzC5VZQ:vN5TnOfoDnPr3M6MIL8v/tsG5C5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980410, "uuid": "73292161-7669-4e2d-b053-ff3839363da9", "value": 52640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980410, "uuid": "f5eb1d77-c05b-4db6-bc25-2c4f52c3e884", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980410, "uuid": "1c49e19b-0440-462c-ad68-43c21ccbdbc3", "value": "sdxkzX_UXA229x.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2819d3e1-f6d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769006869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006869, "uuid": "db2bc1d3-79bc-4357-9112-d34699e7a2b1", "comment": "Malware payload (Mirai)", "value": "6dfa76b0aa7a781807d3f0e4b12d1fd2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006869, "uuid": "ccb31130-0418-445e-af6d-ca7f673f65ba", "comment": "Malware payload (Mirai)", "value": "e4bc55006ba054042113c1d0dd217705ec1b8680f7b81714d0e6b5676a1ee55f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006869, "uuid": "ef9b0b6b-3fa8-4c7a-abd2-93b195bf693a", "comment": "Malware payload (Mirai)", "value": "482fb18f289fff0344f55f3d60597689a1ed88f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006869, "uuid": "a491a956-fd6f-41fa-9a8c-a1f705c1ce1f", "comment": "Malware payload (Mirai)", "value": "77132af7f4c99344ea1956eb8f29476e3b46aa472d10b2042fbf1193ab4e868f5a4f0942ed7f07c9f8b527dfbea75466", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006869, "uuid": "095d6eb4-c628-44c7-b988-eb00455fa49e", "value": "T1185312271AA5902DC474CB364B2CCCB2437642599B788657E5ADB9BF2E02E05F190F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006869, "uuid": "bc3be418-04c9-40d4-b2af-7403af2e7390", "value": "1536:zoZ/Yzn9l6maZh7RybbM6EwryUxNW78z77SshP6rzAQg:cSn9jaBybw6E4yUu707bhP6rUQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769006869, "uuid": "4f0ab695-8677-406f-a5cf-064e5371916a", "value": 63912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769006869, "uuid": "b1668410-9db7-4c0f-8635-d48a7febf8bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006869, "uuid": "c8916831-cce0-4058-9724-6468f99dd761", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "670fcc2d-f6d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769005257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005257, "uuid": "3ed69dce-073a-441d-9616-f88b59460834", "comment": "Malware payload (Mirai)", "value": "be9161936396b68133ca7419181586b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005257, "uuid": "636aecd0-b562-4679-940e-1d1d14aa8b8b", "comment": "Malware payload (Mirai)", "value": "e5f33ed851f209b174f91bee819b2e80655a0517e5759202f163fc6035ece138", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005257, "uuid": "1e1dde17-cbb9-4f95-8988-6842159db0ff", "comment": "Malware payload (Mirai)", "value": "7260523b8da6dcbf23d136a42e6dc5ee5eae65c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005257, "uuid": "20fdf014-507a-4b59-88f8-d7511d3ba5da", "comment": "Malware payload (Mirai)", "value": "73176e3b99ad9f32d8472b056545e924bd28d1ce8b61b2847ba597d72c28c3a18bb253b7949a5aaf2441d78ec58a6524", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005257, "uuid": "ce0e331c-8df1-4a40-a1d7-b3415b113488", "value": "T15D044C56E7418A13C0D717BABAEF4245332397A5D3D7730699246FB43F8269E0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005257, "uuid": "119f1ff3-2ed8-4cf3-b1ab-b46b1c4d0e55", "value": "3072:GxktOitbO+AAagk4B/YnGswmhsIXaksO1+XUnPM/9CY3tZ:sksitalAagk4B/YGsvsAaROUXUPM/9C8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769005257, "uuid": "d7e04a1c-6681-446c-ae5c-f9dc015b2d1b", "value": 180727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769005257, "uuid": "ed2f70b4-c9d6-4408-a09b-84f8b084136d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005257, "uuid": "649b1d29-fd5b-4a48-a0e2-c933fd1aae7f", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c85bf5-f6ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769014648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769014648, "uuid": "71801357-7795-4e23-897e-c1b2c33ebf4b", "comment": "Malware payload (Mirai)", "value": "bf7e7e03b659ef7bc029cad7273019ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769014648, "uuid": "cf09a897-5fd8-44e6-beb8-d81e8549f1ed", "comment": "Malware payload (Mirai)", "value": "e5fa9517ae35e916913e60115a385e0173239103f707688804b299ddf5c3ec36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769014648, "uuid": "9758c6ed-d275-46fd-91a9-972892a2a9c9", "comment": "Malware payload (Mirai)", "value": "03fb946a001ba3d5a4366949fe0df8eedbc395bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769014648, "uuid": "582a0be8-f0ec-4b38-a80e-4500b63e9756", "comment": "Malware payload (Mirai)", "value": "f3dddac53b7a480b44a72e6d8a3e1303b528b2b45359cc755f957866afabbcdc50132659bee813305023b0fb9d2630ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769014648, "uuid": "943c8a34-d62d-4ff6-bedb-50e2d2149174", "value": "T19823026FEE4898C1DD5C2DF2229C16E26C7861C1365E8B9ED32909808A732063DDF3D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769014648, "uuid": "737ccfdd-209f-42bf-9692-c44548e9f44e", "value": "768:I5iXeMKbg0d5hMDS7V2tEvdZyeQli3KeEciYAhM9xe7Gt+yE832Z0G5BN+0pwAWw:HXeZh6DSJLZyvlOPma46cyNKHV+09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769014648, "uuid": "d91e46a2-bfaa-495f-9a68-66b600ffc965", "value": 46756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769014648, "uuid": "4cd9c703-9a52-4956-8395-9df2babdaec1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769014648, "uuid": "be688771-77e8-4b51-97f3-406719d5bce6", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d988ed-f6ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769014670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769014670, "uuid": "31b286a0-b878-447b-bcc4-3ccdc6173877", "comment": "Malware payload (Mirai)", "value": "fc2cad13148c78a8c0923f9ca7a34b19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769014670, "uuid": "d729f1c1-5afb-4fc6-8599-dc56f7f230ab", "comment": "Malware payload (Mirai)", "value": "e643a8a1f6f0411b1bb845513ad8cb18c920e1ca068a8f19b8874a54457328b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769014670, "uuid": "634eadf6-4e65-4605-860d-7ea282882285", "comment": "Malware payload (Mirai)", "value": "8565d50c635eed179a2efdd2de787780053c24eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769014670, "uuid": "5c3ef66c-365c-4d29-a133-1a731ab770ef", "comment": "Malware payload (Mirai)", "value": "daf1082b4eadda48fee4f4ef1517fb13a59151a97616aaa82befa539fb8155c2370275a049555b7c34e092f1a7898e7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769014670, "uuid": "40d6dae3-9093-43c7-8551-ac3d9eb20703", "value": "T1A4C3F80ABF110FF7D86FCD3706A90B0625CC555B22A57B3A3634C928F54B65B1AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769014670, "uuid": "075b3566-d262-40c2-b9eb-9f4581ed1ec4", "value": "1536:ZPvZHT+DemrUy2+32vfjQJXpi7Oi97ZrnqAwg0tS547+ZSvmCei:ZXZHT+UFMJXy97M75vmCei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769014670, "uuid": "aed1fef9-90da-4b31-a818-e132b937cb23", "value": 122316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769014670, "uuid": "1e60694c-9a9a-4b7a-8f33-22a3ef4df860", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769014670, "uuid": "f4354090-a61f-421f-a2aa-2a556da607af", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecfa85b8-f718-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034687, "uuid": "9e4efe67-334a-4b76-bca8-a73f01902340", "comment": "Malware payload (Mirai)", "value": "e0bb6d797a872ba9e6bb1127b376c22d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034687, "uuid": "2124b531-c44d-4140-bf7e-bce935ebd6a1", "comment": "Malware payload (Mirai)", "value": "e688bbb59ed32d3775747b4b520a51d54de18be384ae0dbad02079d35ad2399c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034687, "uuid": "6532be8e-39a7-4ed0-9a32-584e2269d77f", "comment": "Malware payload (Mirai)", "value": "cca698b4d3c7194cce098d6ae7797c19474db464", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034687, "uuid": "bb68c722-7cc4-4a03-830e-2d2ed8be3ac3", "comment": "Malware payload (Mirai)", "value": "0803d6f793e3a1c7e72cb55957331ee159209ed2701eaae0b7683fd41704a2cdd535e0bfe6566e787280e096bbbe3f30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034687, "uuid": "7c639e89-d5ed-43ea-b9ca-8de62d36f2ea", "value": "T175332BA7B701AD3EF99AEA7F84130A09F530779500930B3B63BAFD935D322945D16E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034687, "uuid": "5934dd82-201b-466f-80f0-5c4944d6f3e8", "value": "768:eHedjusHZxILuhg3kcJbpwc5ROfIGI8uGQYzx9DBw/a/gT8IDL2/:K4jpIL1U+tbvGI1GQq9DBwa/a8IK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034687, "uuid": "059f724b-364e-49f5-b58f-5423d8f61ec9", "value": 53168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034687, "uuid": "476353a3-8171-4cb2-bbff-495d285912e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034687, "uuid": "bb79ec30-2f45-4426-a13d-c6f55f9eef6b", "value": "StormStresser.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a2bdd5f-f6e5-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1769012456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769012456, "uuid": "40289085-62fa-42cf-a786-bbc208604bd1", "comment": "Malware payload (DonutLoader)", "value": "fbc6d04669349bbd68cc409487df19ba", "object_relation": "md5", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769012456, "uuid": "1df35a3e-0c5d-4f49-a4b1-04355028333e", "comment": "Malware payload (DonutLoader)", "value": "e6ded8c0427a4772e5159dea6895eea59a2c2b6f2fc786c900f71723b85f5c75", "object_relation": "sha256", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769012456, "uuid": "bd266e6b-578e-4f56-ad61-463ea78c6f65", "comment": "Malware payload (DonutLoader)", "value": "ab399648b8c943a8d6feceb7e0bec2d1abee1520", "object_relation": "sha1", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769012456, "uuid": "2e056c92-14a7-4af3-adeb-5df666124f29", "comment": "Malware payload (DonutLoader)", "value": "a52563df3a4fb0f5f4e0fae39b1f4b2f6f524789108542ea88eac58f6a8b86c09d6e0e6bc3d478b3b625b5c24ff959ad", "object_relation": "sha3-384", "Tag": [ { "name": "118-107-29-135", "colour": "#122BF9", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769012456, "uuid": "42ad7129-31e0-4e03-a29d-b14caccfa01f", "value": "T13A162229F85536B2F84DC5B006F01DA403E97E3522AB17C82272766F8773E6D9F64A34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769012456, "uuid": "a7667a20-a29f-4d19-83b5-f4026fe477f4", "value": "49152:O9t3r4V13ZUa8MTcgKlc0ffJtsqX15fo4+yq3cvy8376puOCGEZcF+tEZfqn8GIS:wt3r8cg8/XT1poKq3csZlEbEZfqnnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769012456, "uuid": "f586659e-0598-46e3-85a8-9c3512c15a99", "value": 4237528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769012456, "uuid": "fedf12e1-fbf9-4939-bc41-ea056cee7ad6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769012456, "uuid": "15da7a20-a681-418b-a8f5-386b0410d2c5", "value": "overseated.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0cc2382-f6df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769010212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010212, "uuid": "e7e979da-0e2a-4970-bea4-76ebcc9a190f", "comment": "Malware payload (Mirai)", "value": "e7e08af405d09fae6df230b1b7401660", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010212, "uuid": "ac913944-f2c5-4bd4-807d-6a6b046860d3", "comment": "Malware payload (Mirai)", "value": "e71ebc45af9a61cee4364af79a121ff4aedf5111870b5aba1b4b21880055b2d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010212, "uuid": "77ceb819-cdef-4ffc-b623-0e906d2108bd", "comment": "Malware payload (Mirai)", "value": "e1195f204eccf64ce887ef8f14379bea7d0644d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010212, "uuid": "f9f2d756-5a16-43dd-9b44-a9dacbc6c744", "comment": "Malware payload (Mirai)", "value": "568c45c554e09d0da226af475769bdfcb8776b3af4dfb71f09848923e7d9695689d25f95bfbb7ea39d8ead1308f53ade", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010212, "uuid": "476faa9c-8beb-4bd8-88e1-6611c5b731d7", "value": "T100D30945F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010212, "uuid": "2cb95c60-c284-4029-b306-a1499dc0d684", "value": "1536:wKdzElm18uZJNb4A4Fa8eAZHk4VB7fzTTfHh+gYSvvqeqZfB20ly+wyw6RNP8TGO:wKp50XU8e947LPHh+zS6thBZ6xKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769010212, "uuid": "975d8584-fd2a-456c-b871-a7762d8c9ca2", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769010212, "uuid": "63d04cf0-a0d8-41e7-a30d-c19cc48e97f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010212, "uuid": "5382391f-94e2-4834-9d0a-5f12ce54ffb4", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511454bc-f6bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768996200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996200, "uuid": "fe70cf9d-7f92-4b0e-895e-ff9697c91fe5", "comment": "Malware payload (Mirai)", "value": "0716ed73870318e279090e40b33d1c38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996200, "uuid": "0fe9eb2c-60df-4a79-9e49-eccddd4d8e1f", "comment": "Malware payload (Mirai)", "value": "e71f1dbcc6585b7220353ad5f0b5cca7b5a52cb04d07e19a432b6fe56bfb7457", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996200, "uuid": "28293163-7542-4d96-866b-4483264f0b5c", "comment": "Malware payload (Mirai)", "value": "844b73d371dfe3a6edf3902c1bcf963989359942", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996200, "uuid": "f0fe0879-15ec-47cb-8abd-e8ef401f9509", "comment": "Malware payload (Mirai)", "value": "7aad137c79287cf234944cb4253daeb66b858e3448c0b7e836c9670e164c66b78fd9397ba645f8ad603d302327ac846e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996200, "uuid": "94d5faec-92ca-4384-8359-4642c0ef61b5", "value": "T1DF638D66D419ACD4C4844338D4E64B792B63B808C3772EB6AED585BA4043EFCF9193F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996200, "uuid": "daa3d8f1-63f3-4b80-907a-831efcea0c37", "value": "1536:WaZ3TIpOqFyJJFrwtkTuoQt3Qz/Nj/pw2ThfDr2C7q:WAkMqUJJFrQlywwhfDr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768996200, "uuid": "797deeb7-6b4a-4559-99b9-c901124041b6", "value": 72248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768996200, "uuid": "50b6d2a1-33a0-437d-b9cc-a8acd3a38845", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996200, "uuid": "66b9c6d8-1c7b-42fc-a4ae-68f62faa0e12", "value": "UnHAnaAW.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e414ff3c-f718-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034672, "uuid": "8e7c3469-7665-49f3-b79a-a6aef8bd6ed2", "comment": "Malware payload (Mirai)", "value": "79b35e9b950141afde09b2c80e5d139b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034672, "uuid": "3f63edb1-281f-4f70-bc3a-89a8f9457ec0", "comment": "Malware payload (Mirai)", "value": "e88ab7dd6d81d9f3d26aa7a8d6553acf4311171a42cb3af8dd60d0f27e8901ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034672, "uuid": "c0753ee3-75c3-4175-877a-d75e6153af90", "comment": "Malware payload (Mirai)", "value": "f04554bd6cafc07289b094d372e0336cf0e87ac0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034672, "uuid": "72aba85b-ffd0-4fc3-beb9-b805b7232e75", "comment": "Malware payload (Mirai)", "value": "5b05b94c295659c607f7624518c2da45ab890b5135b61606d7ef5f646d601689f3dd18be655c9788f56242900f5bede6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034672, "uuid": "d20d310b-f186-45bc-98ae-ee9c76b9b660", "value": "T1AC430846FC93486AC6D057BA772A96CA33A323B5C2DF3353C8180F516BCE64F0E66951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034672, "uuid": "b1c4a874-ebfb-4f90-b909-c81d8dfe59bc", "value": "1536:jL/rRN+97eo93kJ9+kFjfy9vAVjvZ4/f+1L:jZN+97e7rjfUovZ42L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034672, "uuid": "4acd7daa-1b46-48c2-8385-004a3919079d", "value": 58356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034672, "uuid": "26800ae5-b74e-4453-b23b-a5b231d8c1a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034672, "uuid": "ac96921a-9ce0-4c8d-bd65-6829ef2d219c", "value": "titanjr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed349170-f675-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768964679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768964679, "uuid": "113cc38f-a8ab-4b83-b954-13a510d01258", "comment": "Malware payload (Mirai)", "value": "a3ce58adbcb099f4f524eb2b94d49877", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768964679, "uuid": "858d9067-6c9d-4c79-8223-b547f533b889", "comment": "Malware payload (Mirai)", "value": "e91f824c0ceb0954b02b418644f2862879df70e94280e36834a4b1524b8e267f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768964679, "uuid": "98c6384c-2025-4893-b25b-128660179b14", "comment": "Malware payload (Mirai)", "value": "46b6810dd6446e3d832ef240d0b1ee5c1f9b2b24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768964679, "uuid": "2624757e-804e-4cd9-84b5-2dac6030f818", "comment": "Malware payload (Mirai)", "value": "81a3c6a1911385609827ad74c37542a9e8a48cec255c8cb25c4f777763e49406f8406e3bd5c89fba55b84233e72e13fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768964679, "uuid": "0f56d59e-e60e-469b-9d52-cd46cf4018af", "value": "T142434B23698090FDC4E9C3745B6FA226E933B07E1135B25E27E47E267D8BE301B19A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768964679, "uuid": "4608dda9-3f73-4812-93b2-dc4de55b2c84", "value": "1536:qAAOMOlAyupzupmx+WHx/ar5YZqmY5SgTeoZ:qDOMMpu+WHYr5ynY5jqoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768964679, "uuid": "d9c92b10-9e3b-43d3-ab99-c3a787d01946", "value": 60464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768964679, "uuid": "35a36a16-6e85-445e-9ca7-5a9f8d704212", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768964679, "uuid": "b47d013f-8dc0-458e-9c56-87d307a75b01", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "490113b8-f6a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768983302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983302, "uuid": "d9aad337-5736-4e28-84cd-71d18bf27819", "comment": "Malware payload (Mirai)", "value": "aaaf8891642695e09bb80cbd23990f6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983302, "uuid": "d79a2c84-30ff-48ca-8fe9-8905479aec8e", "comment": "Malware payload (Mirai)", "value": "ea56f6aafd50effd39c7fa14be1424d027a093cccfb84165ed88ca0f9f23a1fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983302, "uuid": "e81710b5-f3a8-4887-b5c8-fda9a8c28ef1", "comment": "Malware payload (Mirai)", "value": "42d72e99c6c1cf56ec4771de3c02e168c9b373a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983302, "uuid": "091e34ed-b023-4378-8e1f-368cf9295216", "comment": "Malware payload (Mirai)", "value": "70d96434e34b7de7ac9fd2745284ee35abd63b3ed199fa6222a36ead7888d262b7ac9c11fa1eafa4ff6fd440511b8de5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983302, "uuid": "74928451-7d3e-459c-a682-d5f53391ba7e", "value": "T1C6D35C0A79D270FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937DE05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983302, "uuid": "1f84fe0e-0aeb-4a39-912a-cb91d8904ba3", "value": "3072:lAFWsh8fkY6i3iP+9gK8JYYvk9d5dAl8tFEU84YTYZ:yssqf/3iPcgrerAl8fEtHYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768983302, "uuid": "76175476-e24b-40e4-ae34-c7f51017132b", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768983302, "uuid": "9ce28ea2-7085-49ff-95db-359d4d3277c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983302, "uuid": "1d3d8d64-c491-449c-aa79-c0d520fd412a", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d7ace1-f6b6-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768992309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768992309, "uuid": "1a4847b7-1d41-4e61-8844-93ee29389794", "comment": "Malware payload (AsyncRAT)", "value": "275fb9b37413a52ea6ef2a3f89c49523", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768992309, "uuid": "c1258f4f-7cc8-4551-8be0-6508e1187fb7", "comment": "Malware payload (AsyncRAT)", "value": "ea8b8315a4031314384cc178445e0d7c4932dc6e3ddc932dd7fecd5f73b75d67", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768992309, "uuid": "f4415cdd-d5c2-4e02-a8dd-42ac2b282ae4", "comment": "Malware payload (AsyncRAT)", "value": "21e67e6b09d5d757b4c0b764b86759142e79b328", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768992309, "uuid": "e1610b71-9727-49de-9aa2-4242a306b8c1", "comment": "Malware payload (AsyncRAT)", "value": "8bca1e8f6674bb5df956a89e2697ab3990da64c2806f2a8dc9e78810aff16da33b45e59b5d372c5581527768a4b72176", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768992309, "uuid": "fd57abf2-7cbd-4cbe-a8c4-1c1a1e9643cd", "value": "T18FE54A4969A510E8E176D1F6FDFABA48EBB129C743110BCF565003BECA177A41B3E630", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768992309, "uuid": "a66fad1d-ae57-4fe6-beb2-58af7169c13c", "value": "0bdcedff96641705069d6e7c2e0f41e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768992309, "uuid": "bd90fab3-52cd-45e4-9241-5530aa772a5b", "value": "12288:PVP7J+5Q7rEVuZksISn1BrrtXMJN3uMSQycKmZHWPbtrxjJjBUYPhVzehYlLcW05:PhJrFTZVzeGlwW0hOGl12VdTpX6Djzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768992309, "uuid": "06d56427-9b0a-4b76-a0d5-9db41775c9d3", "value": 3272192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768992309, "uuid": "a3dc8ddc-7151-4655-9b5e-8ce337fdbda0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768992309, "uuid": "8f5c7074-5877-41eb-88b5-1758d3ecf1f9", "value": "xea8b8315a4031314384cc178445e0d7c4932dc6e3ddc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762bc0fb-f701-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769024609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769024609, "uuid": "6dcceef4-7ad4-4417-ac8f-c2022cee2bd3", "comment": "Malware payload", "value": "458eb78b68ad931cacd212a2823485dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769024609, "uuid": "e12170d8-3b7c-49c5-a380-674975cf206e", "comment": "Malware payload", "value": "eab636bb2dcc35f2eba051007e0bc8522f1ac3ed86c943d2067ef13c5effbe77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769024609, "uuid": "58e5c6ac-1e17-434d-b64c-400ecf5124db", "comment": "Malware payload", "value": "76715cd7854f186abc31be76a40e89dc01de9110", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769024609, "uuid": "d47385f0-2e7f-42ab-a25a-9e4ac4d39f19", "comment": "Malware payload", "value": "81912142dffd619470aa3edb5bff6ab4ba869a97cb4527dab0d468e336ae7bfbb50cb1b867caa79ee22a94b8f1903d15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769024609, "uuid": "4cc6b864-1a20-4d34-9416-b3ec11fd9f5e", "value": "T120670103F5A05034E4B73232A53E633E8D327E629B3685DB97846CD46FB42D1653A36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769024609, "uuid": "a1ea0168-2fa4-4c92-860f-b4d1adb68849", "value": "d221b1dc8c3a08622f6512e7876527c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769024609, "uuid": "3d036b44-736d-4e66-9961-56b3d6461c2e", "value": "786432:CoYEMjDcz0izBlrTc3Z39EaQ+/uAcgNzs+Z2MvJ4E1SZ+0Jm2E:CoYz40izBlr431CEcIXZ2M+EsZ+Gm2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769024609, "uuid": "74381c28-5290-477c-bd63-e52b470fc37a", "value": 32631598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769024609, "uuid": "bd73cff1-6a37-4bbe-bd6e-7b8b855bf3d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769024609, "uuid": "d22fcea7-046f-4d8c-9848-556a109ca9f6", "value": "Chrome-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a517aa1-f69d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768981479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981479, "uuid": "2bf0254c-6400-4068-9efd-74baba771172", "comment": "Malware payload (Mirai)", "value": "097f7c07d0d98c46226dcb7ae010d616", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981479, "uuid": "df161fcc-4f52-49df-bc66-2a837a56c899", "comment": "Malware payload (Mirai)", "value": "eafe6dca4af13996c28deac0b679468187794e17b0e136e7d59054493c51351c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981479, "uuid": "437d0b27-dba1-4990-b529-05147958b196", "comment": "Malware payload (Mirai)", "value": "a979da6a54c418a99695cbbab5fa24f98d25ff27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981479, "uuid": "74338503-1c94-4352-a736-e0963b199fda", "comment": "Malware payload (Mirai)", "value": "1168b78c89ee0eed189d79dac0bf10cc8c4f7f418d2fe93c23a67d03d155199ddfd296cad3fbf928779c3fa1bb4e1326", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981479, "uuid": "670b212c-6a63-4e1c-b674-c6ba83f85918", "value": "T1A923E7C7B8C2981EC4C45A7F676FA12D33A293F4C5CB3613A9E74A11328716A5F16F48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981479, "uuid": "fdede446-ed6f-4f55-ab75-4f44c7e61c02", "value": "768:UMkIRNiWpelY8gIEQFZIXquvbFKTZvfFJDNKgTogaibygMzdH6anuKmz:7piXlgXQFZk5CZ3FJDAgR2gAda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981479, "uuid": "ef6163be-6af0-42de-ad2e-507aab11530e", "value": 46676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981479, "uuid": "874a222d-ee5c-4c95-8e4a-37404d1d520a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981479, "uuid": "96fcdde5-7227-4b9b-b9c7-242ab41bd69f", "value": "Orbt.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5170b8e-f69b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768980879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980879, "uuid": "2948df80-16fc-451f-aea1-4cd3503926b8", "comment": "Malware payload (Mirai)", "value": "7ebc4b5893d460ccba2dddbcdd7632f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980879, "uuid": "150cf8dd-3d1d-44cb-95a0-20075792678e", "comment": "Malware payload (Mirai)", "value": "eba52ad175fc1136d91ad9792e5b1f0fe0f47de55059e73f71d9dd00e01a9104", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980879, "uuid": "32fd7154-af89-434c-8b84-b6c90b8d9373", "comment": "Malware payload (Mirai)", "value": "dc72614dfa3fab62c72dfb6ffbbc2c1f4768de0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768980879, "uuid": "a3c77a6c-088e-4cd4-bb55-9e355d0a0c2e", "comment": "Malware payload (Mirai)", "value": "2a4e6fbe8566775720b900264244637fe5c708c8f6326b7b671432a3f4e0d3ead25973b5ac27eb7771f12f8f0d5a6f6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980879, "uuid": "1e343426-40da-461d-9542-c0151d341944", "value": "T174B39DEFF24B1591C8228BF013C39BDE3E2722119F6BC4E72D0E263A55752DB490A391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980879, "uuid": "04f6cc75-e3f0-4834-a3c8-0034d33b3648", "value": "1536:5q7n+xFxZqQLLT/ToWdUAe7w1I3WXf9giR1B4gv/LWQ:47+xTZqQvzsccw1y29giRb4gvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768980879, "uuid": "14ee217e-008f-4cc3-a222-bfb4b2e83b0b", "value": 107840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768980879, "uuid": "462182b5-f501-4385-8d26-5cd7e38ffaea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768980879, "uuid": "f6430a2d-0158-4950-8a05-dcecaee99881", "value": "ub8ehJSePAfc9FYqZIT6.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a4b77a-f6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768984962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984962, "uuid": "9176fd7c-7c7e-4150-8607-0f9a1ad9a11d", "comment": "Malware payload (Mirai)", "value": "b93aceea34fabadc04c5bf653c943273", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984962, "uuid": "00ff6c6b-b992-4d75-879e-80a9a15444fb", "comment": "Malware payload (Mirai)", "value": "eba66e39af78117ef11b165ae49dc370cb1862c75ee242db2394a6e4457efc06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984962, "uuid": "611c9f8c-1851-4ff3-b047-de23283b108b", "comment": "Malware payload (Mirai)", "value": "41031f54a5c531a9acbd6bee2b4126e7bda97082", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984962, "uuid": "0afbc571-be4b-4d7a-b216-5290a43b4639", "comment": "Malware payload (Mirai)", "value": "6375f2a89844f8ffe99c66757a3c452cabec2da0070ccb01fa296d7415fc83b0db25e62f85578022fbba2de67b3858f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984962, "uuid": "51a1b90a-ac36-450f-9782-6765b1ba7a52", "value": "T1E5F32B46E7808A13C4D61B7ABADF420633239B64E3DB33069918BFF43F867994E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984962, "uuid": "2b1a24f6-5252-45c7-9cf8-42b4e1781137", "value": "3072:HXBrqZU3Nw0mOIG1+KGB1vSa9tCDKu1byM/9fOLmew8qTiF7:HXBWZqK0mOIGUK61vSa2DKu1uM/9fqmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768984962, "uuid": "f2b1f96c-fd7c-4385-a596-c4ec6e76092c", "value": 158993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768984962, "uuid": "c9a4200c-7df7-4e07-912a-48b9ab7c9c7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984962, "uuid": "440c1f6d-7f16-4912-ac8c-125471ab7211", "value": "ub8ehJSePAfc9FYqZIT6.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c68b1c-f6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768985120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985120, "uuid": "6ce29b60-2fab-49d0-8c89-e1148498f4c7", "comment": "Malware payload (Mirai)", "value": "d16f55ea6bde8ca909d4590616a97ad3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985120, "uuid": "4baf552c-d1c3-4b39-9d26-a7c02172a871", "comment": "Malware payload (Mirai)", "value": "ec4781d1b1eae0b315226a33e74628e25e7d1817779c61c6be0d4e82db45f958", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985120, "uuid": "af0656f4-e590-473e-abf8-7efc506a8240", "comment": "Malware payload (Mirai)", "value": "7e71cc77dd3de5d06051f372bc8ae637f58c3da6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768985120, "uuid": "b18e5da1-917c-4714-a0a0-7236eacd028d", "comment": "Malware payload (Mirai)", "value": "c1c7d11a46fb8bb2c066b0586f18558266bd303b635aff193e9b6dd8f8375d92e8f27cc7f534eeecd31ad33500bc30fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985120, "uuid": "ee8f70f6-dcfb-4ad0-b67f-e1befd133cb1", "value": "T1A36302CB6EB02B26D0DCA1F1703815DAC83A9DCBE643869D87E1E799073842755C8B5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985120, "uuid": "77428afe-9913-4414-b9e8-ef844d7dc5ae", "value": "1536:saxZLmYKVDNSl2y08yumeJyGYVmIMGUYbtNj:saxZLmYKX+t08jmeJhYTUKNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768985120, "uuid": "c42b2321-a0a9-4cda-a290-581e67ca8b1a", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768985120, "uuid": "eaea58db-eb5e-475d-8787-d710be78008d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768985120, "uuid": "8a9b92c6-d22d-4dcf-a678-9f3e74529b74", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb01e4f8-f6cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769003277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003277, "uuid": "de356060-53c8-47da-80f6-32b0253a03da", "comment": "Malware payload (Mirai)", "value": "c9a13e15007bc68ac44d12509a2501f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003277, "uuid": "403222f4-ba09-4c4c-8cf8-a46bd0ed014b", "comment": "Malware payload (Mirai)", "value": "ecb8556507607d03a0cb9d4c344eab477f8618e169c800a200bdf72ec4159a3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003277, "uuid": "30e7e5ef-e291-418c-aff1-6c66e602f6b9", "comment": "Malware payload (Mirai)", "value": "98db429f7a2e76ceff55166708f2e5da1d1f04ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769003277, "uuid": "ab00c9bc-61f5-45d5-acec-a55b3b63271f", "comment": "Malware payload (Mirai)", "value": "1d69ed4db26136ee208db9c111b4ee04eed8da8be5e5bc5827b066d4f8b57f2fc6305a845c0d715ad5ce6d2c55c311e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003277, "uuid": "02fc7389-547d-47fe-8d36-bf67be9effcb", "value": "T1D15302D190E1E429C56293F612048F4A238ADA917B05CDEC35CB531BAD5FA5F2F886E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003277, "uuid": "3cef4ee8-7f72-44a5-9bd4-70737bd841be", "value": "1536:LznwRRM10ac1B010ZtaS4SV/zQUjsPwttl6oLLkg4azHY:XrREB5taUVLQlwtt0gLGazHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769003277, "uuid": "e39e7e11-151a-4bf6-888f-40f3c7ef1793", "value": 60788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769003277, "uuid": "fac114aa-19a3-46a9-8826-ad289eb6034e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769003277, "uuid": "7160e596-d9d1-4590-8175-3ae3a2023dbd", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883960c6-f6cd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769002306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002306, "uuid": "8150c233-f44a-4b53-bcfe-dfc963652d63", "comment": "Malware payload (Mirai)", "value": "ab1463c24b08ea11e364e5d9c8b5f1e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002306, "uuid": "658360cf-2d07-4a26-bdd4-548a9e36e1c8", "comment": "Malware payload (Mirai)", "value": "ece2992fb23c2e2fba56eecaa1c90d977954c9543c7dd3dad7134a0e7afad5a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002306, "uuid": "4825f2a3-3653-4db4-88c7-16d797c1052f", "comment": "Malware payload (Mirai)", "value": "1c89d2dd7f224a5cd8e09e4ae0fd1a2f0f14f99a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769002306, "uuid": "ea9ea69a-78c9-4959-90e8-a5f73b2c73c4", "comment": "Malware payload (Mirai)", "value": "d580e5f6086792c8a2e708819545587b78f6ccaaf72306be05973a8c1ef708f1cd3a82f0af60d1ab5ad509120a84548a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002306, "uuid": "0849ac3d-35ff-44c9-98b2-f6a073123cda", "value": "T143933BD2B400DC7EFC1BD2B781570B15B134B7A65E422F2BB636FD63DA2A1A41C1AD42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002306, "uuid": "8fbdc685-6d8d-464d-9922-59a878b48123", "value": "1536:5ZbXuFuJfUFgk4VtHyhRiQ6sBJR9bDaI6gVIQZ3QFh2kPa/bJUS0HZbkW8s+cETl:5BXuF+qgNVtShdrmI13wxCUxHZbkRcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769002306, "uuid": "fe7744c3-74d1-4f30-b199-aed1e90b7333", "value": 94840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769002306, "uuid": "f7d1e58d-9be9-47fd-8d72-968006c20764", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769002306, "uuid": "e7f96cdd-217e-4339-933f-85f0c9569263", "value": "jklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5076b6-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034904, "uuid": "e97d8e48-3e7f-41f2-b6b6-bb54798dee98", "comment": "Malware payload (Mirai)", "value": "5cd09d76c085ac34261b66c207d4aa12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034904, "uuid": "2e0696a6-6f98-436e-8ab9-f3f7917cc98c", "comment": "Malware payload (Mirai)", "value": "ed2400f0b058f632797e1c8d3f767473ee2bc150576f729d21990bdb67eb45d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034904, "uuid": "ea272a1b-81bf-4287-89bc-4e0e5f5c5b28", "comment": "Malware payload (Mirai)", "value": "3efe70a486a25faa1a7af2ebb0594a32c44baead", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034904, "uuid": "4dd8dd0e-1d17-4b81-805f-ed62e3f1fd30", "comment": "Malware payload (Mirai)", "value": "36536a653151ebab3d607a98b513797f154e26670edbbd239d847cd8bb3eb453476f252721212b56d324aab2630ac122", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034904, "uuid": "8136f446-8cb0-44ff-8991-572ef799e3f5", "value": "T10FD36B0673180F17D5A34AB02A3E1BE083FED5D021F4BB89651F9B569672E3B1486FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034904, "uuid": "f66467ad-bf08-4020-9da3-6cf0ba2c7a0f", "value": "1536:8+ebaW8zqIjkVWV3KY0gPWhZ/JiZW+tUh+XPc41UpcHARLf3qCQyOXpkwi+qQDQd:858rAyPWnJph+XPc41U8qvQyOXQ38te", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034904, "uuid": "8f6ae171-8b6c-4d7c-b7f8-3a9190643774", "value": 138176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034904, "uuid": "bf006d2d-76b7-41f7-a17a-b19b0dba57f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034904, "uuid": "afb1af7f-4233-4c1c-9d8e-1e91fca989e9", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c55fc0-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768998627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998627, "uuid": "2a8526be-f039-4e82-a7ac-16ecfd0d9055", "comment": "Malware payload", "value": "6adca6fb1635ea658f37367b7f42844b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998627, "uuid": "92907e57-ecd4-416d-b18b-94801cd4da98", "comment": "Malware payload", "value": "ee9544403373b1b79b453d18fea17b890647c8cf16d1ca9966dfdbcc37e01fb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998627, "uuid": "ecb8eaaa-142f-4ba8-84f0-b2a786fbb39b", "comment": "Malware payload", "value": "4beb2c63bb2b94b86e171640470fc74ee1acfdf3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998627, "uuid": "6db20993-a358-4c99-b1b8-eca014e99b9f", "comment": "Malware payload", "value": "83de401d69e53ce5276f3231357612a5e37eee75277420c709e4f99ecaacf7ba13a1f4296170b76768977709024992d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998627, "uuid": "3fef10c9-d4fe-4788-bae4-86e79c9f360e", "value": "T14B633942BA9294FDC09BC17447AFD126BA32BC5D93207DBF6B85BB312E36E215709740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998627, "uuid": "853c9213-0e69-495d-afdf-e4e5d74ee3e6", "value": "1536:EVIImehR48G1oFB+FZQ0g/jcrO+HsbBorz:EVIImcRuo/+3mmfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998627, "uuid": "075e774c-1792-45fa-b901-ff2c6c178b53", "value": 67744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998627, "uuid": "8bfb6d5c-b6d4-4688-95e0-f58b6d482ac6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998627, "uuid": "c9441523-a7f1-4cca-8e8b-284598a42402", "value": "plasma.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ed821c-f719-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769034967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034967, "uuid": "64035551-f944-4ce8-bc6a-0cdff66f4a97", "comment": "Malware payload", "value": "68e7e50ac5f9b9abc8e806d3eb4307ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034967, "uuid": "fddc7e2e-8fe5-4692-8f7f-fb5ec03698f7", "comment": "Malware payload", "value": "ef9eb6768d28e1fd3138689207aca27eba7e8294812e82f06bb6b62c6aba1c79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034967, "uuid": "a7013759-2cb6-4d18-a6d1-8496176d7f0c", "comment": "Malware payload", "value": "410a81af5ded196cf27b49c6fd5d2cd6e3a26633", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034967, "uuid": "e46cdbc2-e0de-45c0-96b2-f1e541271204", "comment": "Malware payload", "value": "8dc7aaa9d82154264517483e9dd1dac28479fb5623186e06f06a6204dc5791b027b58f407acfe43615058708e7a7d235", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034967, "uuid": "ce8d7de2-e529-4168-b4e1-a884b924fc44", "value": "T1E1D35DCAF402DE7DFC0FD68E44630919F631E72131931B2A52CBFDA3A9711A64D56E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034967, "uuid": "85c8d94a-931f-44f5-ab46-a5012f82d8db", "value": "3072:syRLWDOIWGbgMVPKNeDJ/UPN/bzpKyjLPvELTU5:MyIWogMVP+NBvjLPcU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034967, "uuid": "91ada5d7-bbfb-476d-82af-ad0e994f179c", "value": 137360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034967, "uuid": "fd99ead5-2d4a-4575-bfb9-5f5b559253f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034967, "uuid": "468e05a8-69ad-43b7-8e24-f3cc36839b78", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07aa554-f69d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768981838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981838, "uuid": "99eedaa6-2b87-42cd-85d4-262985a95b63", "comment": "Malware payload (Mirai)", "value": "a1e554897295905238e073df007d8414", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981838, "uuid": "c945d214-e968-4c73-a736-3210cbfc73a6", "comment": "Malware payload (Mirai)", "value": "f0507eb091a0fa1414ea096a22857eb96dc991209272a2cc8bf6958602b3e2da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981838, "uuid": "bf5e8787-1ef4-4ee9-8474-da718db2e2b5", "comment": "Malware payload (Mirai)", "value": "7fe59b566fc3c2807189b34629273b5c065ce162", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768981838, "uuid": "88ba19e9-f414-4903-8ef1-e82bd9ab756c", "comment": "Malware payload (Mirai)", "value": "cc5ee56aee64137126a61a112eaaaf1dad50bdd4e93b96cfe11f8de10e20b8dd86c9f7f37ad869f1525c223f12f7532f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981838, "uuid": "e53c459c-b106-47a5-9885-af09517fb893", "value": "T1CFE22A9BA592882FC9D04336BB6F126E3302F398D1DB3707DE198B5D368B1899D5F940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981838, "uuid": "906f49d2-c7ea-4894-9faa-7e1fcc7297a1", "value": "768:R3/rLYwSgdsjAhjC53NvYNMidUoKWrRI/oS:FtZxdCrYNMiqWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768981838, "uuid": "bd5ee849-7a2a-47b9-9144-02586fe9a8a0", "value": 34100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768981838, "uuid": "68aa0245-81b4-4a13-8aea-d02957484af4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768981838, "uuid": "066bbde9-38f7-4c8e-83f8-8671b769ec2c", "value": "ub8ehJSePAfc9FYqZIT6.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4d5999-f6df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769010233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010233, "uuid": "c440de02-8e2e-4b47-86dc-43a22f679c8c", "comment": "Malware payload (Mirai)", "value": "2318d8387f63275d8a245e099086410a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010233, "uuid": "35e0d0a4-bd79-43f2-99f6-5cd1a69efce5", "comment": "Malware payload (Mirai)", "value": "f066499b9084e594211e2264b3523108d7740f52a5d31190ff1cca032fa10e23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010233, "uuid": "90325734-1ced-4e7a-b84a-2514e403b4c3", "comment": "Malware payload (Mirai)", "value": "588b5b894d2b51f4bdb8dd5764bbeb5cbdb5a2f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769010233, "uuid": "b7282ecc-2fa4-4de3-a9d4-83cbaab65f90", "comment": "Malware payload (Mirai)", "value": "c5e2df9094536394770ea6656ad59e5712688fab162753b2079da827a81bc10ed0aec1860832b39a96889e3b9263ce41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010233, "uuid": "af2a8dec-bfbd-4e5a-b062-7724eb466fdf", "value": "T15DB35BB3DC26AF98C655D074B0B08FB92F53A59482471FBE19B6C2B44443D8DFA05BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010233, "uuid": "225e4c77-fac2-470e-8b41-0016fe17ae6c", "value": "1536:WTW/VCxsHZusS2Li62C8vqKTR5/PPVGAto2WszrW+TNe7E:WytCxsSx62NFT7VG92WcrbwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769010233, "uuid": "6c03f720-2ee2-4520-b142-c069c41584c8", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769010233, "uuid": "50dcca04-beee-4a64-a967-4232c9205c1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769010233, "uuid": "287b3c3e-5c1b-4fe4-bbab-bba9c928c178", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1106740b-f6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768984926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984926, "uuid": "d1e0dc4b-fe69-472a-9cea-cc043225eb32", "comment": "Malware payload (Mirai)", "value": "1803a5e29af4b6e97e4d30cafbd553c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984926, "uuid": "c75c127d-7bd1-44da-aea7-2a93714807cd", "comment": "Malware payload (Mirai)", "value": "f0c00c47ab00f051efa5776deaac34d0ccd2ebb8a9fff90db83cb877c50732b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984926, "uuid": "e0cb59ea-fd50-4c7e-8ef2-6490c2bc864b", "comment": "Malware payload (Mirai)", "value": "b0d99b4cb9aaf6ea482d8d7a490d8d09cc7d443f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768984926, "uuid": "7df982de-ef63-44db-9685-a4eb85b02225", "comment": "Malware payload (Mirai)", "value": "0bfa3b57f7b22d333434ed0976090c9447d598c75520c9c1550f45dec2ff48a92f1633985d870599330202a491345b67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984926, "uuid": "361247fd-9bf0-4e08-ad2d-0d45aec2b609", "value": "T11A430176F708DE53D8A0BE7CE49F48A7D796AC68C259B4C214D8C7C88C93447077AA87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984926, "uuid": "7a71569d-4292-4e5a-b9bf-3bf902cf9a22", "value": "1536:PLUtm4L4R66+xeaBbZub+S6TPyLjGD0YLbte6LholhXS+:Pmm4L4R66+AaBbZLnyLjh0bV9ik+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768984926, "uuid": "2625e48a-17ee-4cbe-9d53-61828e266a26", "value": 60572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768984926, "uuid": "c5e11535-3318-4f6b-8e71-03a11ba3101b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768984926, "uuid": "86635007-63e9-4f45-8d6b-7ea44ac2f675", "value": "ub8ehJSePAfc9FYqZIT6.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c5a837-f719-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769034881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034881, "uuid": "c3c9b71f-5b87-4f33-94fb-2f8da44e8fd8", "comment": "Malware payload", "value": "83058a3f7b9ebee94fad8702c23fe514", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034881, "uuid": "b5d973fe-6eb0-41c6-b6a9-acd05c633411", "comment": "Malware payload", "value": "f2454e87e3c4e6ffb392632ea2e1e5db7db1cb51757bbd2d987a34555ab165bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034881, "uuid": "fb0c85a6-783d-4f16-96a2-55029d3624db", "comment": "Malware payload", "value": "3e516bd027387a718817bf79d9dc18cef9936fb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034881, "uuid": "eee73966-070d-4df9-97da-002b30ed5446", "comment": "Malware payload", "value": "5d0211c5c58b5c6151c9a1021d2ad20eb438153fd3c1bf209052a7693e588bc4095b6b60665947baa051040e100449f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034881, "uuid": "f677b4e8-2c65-406f-a26b-2eddec2c5c28", "value": "T139C2D0A0A7120761C1B73CBBFB346ADA31961EB9E1E8B1411A64D31F26D331226F4787", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034881, "uuid": "3219eab9-4b1c-4bba-950d-9d725c292667", "value": "768:jf+8dSf74kDT4zjcUGqesuTateo/97+7fCZBTs3UoU:jf1DkQ3ckeiteo/97+OZB+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034881, "uuid": "d6c8ea6d-43c9-423f-a607-904e719ca2e0", "value": 28137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034881, "uuid": "bb6f2b7b-e0c3-48e0-9779-69c82f642d9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034881, "uuid": "473f1adc-51cb-4ec7-95e7-69f6b37d6075", "value": "xans.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d397037d-f672-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1768963348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768963348, "uuid": "92262d3f-b443-468c-8add-28b153a01cd5", "comment": "Malware payload (SnakeKeylogger)", "value": "54fc13896b0725509bb6551a51d32755", "object_relation": "md5", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768963348, "uuid": "3a944349-f0ce-47c6-9f00-b84e023fdc6b", "comment": "Malware payload (SnakeKeylogger)", "value": "f2941b214c2d846891bede54add408564f90ba4df795081bf9c1e6a45c2afa1c", "object_relation": "sha256", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768963348, "uuid": "57ff3bf7-e857-44ae-97c8-a91f76d008c5", "comment": "Malware payload (SnakeKeylogger)", "value": "d5b00e82b505e30be78563b610b529e085cf625d", "object_relation": "sha1", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768963348, "uuid": "d4f7f204-7b08-4a7e-ad99-119c99e580c6", "comment": "Malware payload (SnakeKeylogger)", "value": "47bcb81134fbe0f0a8e787aa7dcafa1a0b9987504d420511c95a3777b51b421cf5aac7d669103aca9650bcac71598059", "object_relation": "sha3-384", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768963348, "uuid": "ba438cdc-6a1f-4b04-8d39-333bd3fb1925", "value": "T12E260115E3E904B5D46BC638CB519333C6B179620331A58F0A9DE21A2F77EA16B3F712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768963348, "uuid": "c25d827b-4de3-470e-af12-fb10a89c9624", "value": "71c166d345b7940c20e4ea5ff304831a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768963348, "uuid": "4b09b287-69bc-43d6-bac4-84df80765b2c", "value": "49152:0wcSccxJGP+0bA4ZstA4IHeE25wGByeN3U2b5Nbz7p9PQJz4KcQkuxowgMncmHVh:03R+JlFXqOwgMncmH9ZSpzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768963348, "uuid": "a4d0d574-2c4f-4b94-a3e6-14aef088f1a4", "value": 4791296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768963348, "uuid": "8a2e39a3-2031-4bc2-9aa0-dca1c533fcfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768963348, "uuid": "ec4dfd2a-5fd4-4b43-a9f9-2ebe51d039bc", "value": "f2941b214c2d846891bede54add408564f90ba4df795081bf9c1e6a45c2afa1c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51cd70d2-f6bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768996202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996202, "uuid": "50b79b67-2616-4b77-9f95-bb408065de93", "comment": "Malware payload (Mirai)", "value": "5094f7c99ec680cffc602435c115efe1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996202, "uuid": "ce8eaab8-936b-4a16-a051-27a3a32c3d4b", "comment": "Malware payload (Mirai)", "value": "f2ab2ad9748544eebfa9d68df52dafa9a0787d561323cc377c5946fa6e38629a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996202, "uuid": "6e5b7275-fcc8-43f4-94e8-efa86dfec2ab", "comment": "Malware payload (Mirai)", "value": "1f0f0f39b2ed5cedd655ae19724d5149bc37a3ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768996202, "uuid": "84b35914-06da-44e8-957a-6656b03ac19d", "comment": "Malware payload (Mirai)", "value": "44022a86be298a1b2adbec32fa067392817df285fdb5e2477317a65ac91bc06ce737983d3aa63bb023d33b2e9124c189", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996202, "uuid": "bfaed94c-063a-472f-8faf-ec78cd0b798c", "value": "T103633AC0A593ECF4DD1507B53077EB374A77F136612AE9C7D3A8A923BC82A41940B29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996202, "uuid": "0dd4303f-37df-422d-865a-d73583c0ba88", "value": "1536:h4uwwSB8qv117K/Mn9O/Eb/vRkWNZLF/EfNatGVkfqan6tDzzcS5KfXQE:hBxEV3Db/vRkWNZLF/EVatGV3a6RcSAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768996202, "uuid": "efdfa2dd-05ed-49ed-a579-92d392febbdb", "value": 70672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768996202, "uuid": "04b4912d-5376-4835-94fa-add3b84d38d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768996202, "uuid": "d67e8a11-abe7-4cd1-90b8-d1132b5ea0ff", "value": "UnHAnaAW.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329608b2-f6a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768983694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983694, "uuid": "0f113737-fabb-4111-a060-6666a26a850b", "comment": "Malware payload (Mirai)", "value": "b5f1b759774a26b73bea3a6bd7d1a04a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983694, "uuid": "8a953a06-cd30-4f04-9f4c-ea8b52fde5d2", "comment": "Malware payload (Mirai)", "value": "f34697a2edb725cb986d921219ab536525c20fa0cd65e59b810f569f5ec8bd9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983694, "uuid": "5582fe93-7135-4671-a5c5-721e0dfdab8a", "comment": "Malware payload (Mirai)", "value": "003ee09fd6b68d51347a98f6e8fb791a00428104", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983694, "uuid": "ef47e270-8b6d-4387-b42e-530a6d5004b1", "comment": "Malware payload (Mirai)", "value": "671c2ae55675af73e16d84007ea57cdf0035c9d964b85c9651438f592ca396532d9db4b50eb3ddc7b46542b2cd51118c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983694, "uuid": "9204aab2-401e-4433-97f3-0c491873fd88", "value": "T14793D70E2E219F7CFB9C873447B78E2156A8339A26E1C342D15CE9006E7434E795FB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983694, "uuid": "c1cb47b0-ceb1-4821-b5ff-76ebe983eaa1", "value": "1536:jCSIa0fvaJys/H0994tBc+3ykPaIqznop8LyOQKxjUSVMnIuglsJ:GSIfLsv099UcCykIhQKxjXVMIuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768983694, "uuid": "ede6a19f-c63e-412b-9d3e-ade5edb2e563", "value": 95708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768983694, "uuid": "c16b044e-1e79-4bbb-a8dc-a53dcffc5fcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983694, "uuid": "3f4c5b11-74f9-4917-bd28-62ae048c621e", "value": "sdxkzX_UXA229x.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0210fd4-f69e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768982213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982213, "uuid": "ae01d33a-b899-43c5-aee5-f954e3146d5a", "comment": "Malware payload (Mirai)", "value": "4e793093528fbbda212561d4def0249f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982213, "uuid": "6ed2237d-4d0a-4dc5-8646-3ecd95198516", "comment": "Malware payload (Mirai)", "value": "f3639e05ddc7cc0a5d0ebb36a683c1c6dec5ddcdd835fbbd4ad0da19e7495402", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982213, "uuid": "1e57c6e7-213c-450d-a876-361c9b256c06", "comment": "Malware payload (Mirai)", "value": "64e2e7e281abdd22dccd8ff0fb5aebf741da44e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982213, "uuid": "4757a250-09af-4a17-af1c-69152092a53c", "comment": "Malware payload (Mirai)", "value": "e4d4b2230165101640c26b6e15b37d812c2758474d228ebf9de1f216525ba5353f9cbe5bae049d8f458919ca22b85da7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982213, "uuid": "ca63c7da-957f-4460-aa05-2cf7ac06113e", "value": "T112E3BEB3B34F14A0C8220AF40BCF675D2A2325115E6B9BE76C5E363F5A335DA59063E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982213, "uuid": "c00f83bb-09ad-4ebc-91b5-2ece02d5f9e2", "value": "3072:6xOYDXxlXfoBKSKjYKrvBZVgDCwVWKxA81qQ:Pw3ojKcoZZwCwVWK11qQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768982213, "uuid": "1911dcce-ff73-4bbc-a43f-2e17012e484e", "value": 149008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768982213, "uuid": "fbef04f6-d08e-4689-98d1-af29ddf0b4f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982213, "uuid": "51bc9941-0149-45f7-bb02-b6ab7b006e09", "value": "Orbt.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75130d93-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034915, "uuid": "e72aea70-6b78-43d3-b9d4-3a6bbdbe31b4", "comment": "Malware payload (Mirai)", "value": "be0f2a41713d92dff4ec6077f6517019", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034915, "uuid": "09334009-2224-4564-9567-fa753db98b93", "comment": "Malware payload (Mirai)", "value": "f3800a9cbf404482ac433655e0d0ffc4c48b133f6cf6f9b76d7f29652dfea787", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034915, "uuid": "47fa4f40-081a-4876-80d1-9ff4256e0f72", "comment": "Malware payload (Mirai)", "value": "175634b0ce4c104d74de79d2e8f685c38200c0ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034915, "uuid": "d5588f84-f8f5-4edb-b2b6-5b348c465971", "comment": "Malware payload (Mirai)", "value": "1fd8582dbaed4793c645e25713787a8d02e2b7d5de38d7077be979d2205920d726437adce7ae9ce75018ddc27e9528be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034915, "uuid": "3d0530bf-19f4-4a49-95ec-101f90f04711", "value": "T16B832CC27A43DEF6E81315F112F7AB354972FD3E0826D982D725FCB19A025C1A6253AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034915, "uuid": "07448752-698c-4932-b8b1-1db82e3b7cdd", "value": "1536:Dj6vta9RaMmDj930NDGp7sF3o/TyEK2cn+ipkL9:Dm49LmX930lksF3mTyELwbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034915, "uuid": "9d810bf1-cc4a-42f4-8ba0-f6cf6253ac33", "value": 87232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034915, "uuid": "b938e111-fd42-47af-9944-7dcc4301e16d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034915, "uuid": "1886a5df-9259-4954-affc-aa2329d9d476", "value": "titanjr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09295b57-f705-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769026144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769026144, "uuid": "c96fc3d2-8e51-4c68-beeb-841cd1b03733", "comment": "Malware payload", "value": "57896616f36c1aedcd8559ae5c8e4e45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769026144, "uuid": "253a34a5-2c86-4bbd-9f6a-37eaec66bd48", "comment": "Malware payload", "value": "f5bf61df78592d507ccb4f665b2aadb746ec2a3b9ec58675a32ac7c807c32b5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769026144, "uuid": "77cfcbf5-ff5c-419f-9c13-2119d7ed33c6", "comment": "Malware payload", "value": "0e7c2410e60c4e4740f35f01d1c58c76cbc2ef20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769026144, "uuid": "2b287e4e-d56a-49c0-bd28-b72273f2160c", "comment": "Malware payload", "value": "064f39ba381ae09fabcd6bb80c5075fdfffb953c3818f6b43e1e4221e61f4bef0385b27445ff577d439fcecd6cf70c6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769026144, "uuid": "b32ba11e-c63f-46b7-bb45-1ca1895eee76", "value": "T1E6187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769026144, "uuid": "cd67da17-73f2-47bc-aaef-7a8b69bc6bd7", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769026144, "uuid": "fb929dda-bb1f-4582-bd57-17672b9cb8cf", "value": "786432:tAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:tAZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769026144, "uuid": "084542b6-26e6-4275-a9d9-6d80f8851037", "value": 90424320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769026144, "uuid": "8a41a207-4f06-40fb-9303-f0f142d0ff8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769026144, "uuid": "42062525-c9bb-4336-afb1-3ae95b85ed7c", "value": "cherry13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6555bb60-f6c2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768997523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997523, "uuid": "6c07cd9f-ee33-4672-aab4-9e6a243e019a", "comment": "Malware payload (Mirai)", "value": "db059ad3d350037cb5aed6b09c944f8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997523, "uuid": "2f74fd18-fdc4-424f-8b36-39bfc9de3ebf", "comment": "Malware payload (Mirai)", "value": "f799100e8ada6abbd441f93054ef2c10765bb755807b3dca63da539329202766", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997523, "uuid": "30ca255b-5563-4ee3-a4e3-5d493052b265", "comment": "Malware payload (Mirai)", "value": "df204d4e88c660bf7e5b22ef0e8d6fb2ab4374d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768997523, "uuid": "9c9fe803-4c3e-4bac-ae37-1cb0c81a2f4e", "comment": "Malware payload (Mirai)", "value": "cc185892f392de85f9eafa3f3feae9f83585dea19b3660cdd488e308360a02a398e55aa08f6373a397ca5a8afe7d04ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997523, "uuid": "8d686e3d-0b3f-4b5c-81b4-80bab1809f33", "value": "T10AC31966B9529612C6C72ABBFB5E418D37171378D3EA31038E246F1137CB82B0EB7591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997523, "uuid": "c08a68c3-89c7-48b5-a1ca-5b57867471aa", "value": "3072:zV5juPg6+3XejzCInmbgmod1i8brVfTWNz:zVsPgfcuSdmod1iarVrWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768997523, "uuid": "b3aa15a2-ab4a-40c2-953e-88482bcc1308", "value": 124868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768997523, "uuid": "4a1a156a-c9ec-47f7-8992-e7cb817b520b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768997523, "uuid": "8c7d0a89-c613-4574-86bb-42094c81a529", "value": "goon.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c37ddf5-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034901, "uuid": "73fd138e-34e0-41c9-8279-d8ef3ccd8abf", "comment": "Malware payload (Mirai)", "value": "4171990e799a156a57cd6b78e17be677", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034901, "uuid": "af0c517a-a337-4788-bac9-d3085c28bfc0", "comment": "Malware payload (Mirai)", "value": "f7c16a1a44a9dc6b3ee1f73afffdcd425ca67e0e9c70df44544d488826ad5d8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034901, "uuid": "379e5138-c325-47ae-a05e-a145b02e0e15", "comment": "Malware payload (Mirai)", "value": "40501444a5b95933cef4c70a6517a158af45fad9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034901, "uuid": "56c8a524-c77a-44cb-998d-da42cc669b02", "comment": "Malware payload (Mirai)", "value": "3e1fab921ea5a272efa6a632d398cf89beb85063b4855e247e83693d674f79b66eb2d238503e21e75ddeb4fd6a1ba63e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034901, "uuid": "5272abe8-290d-45c7-9fbf-4652c606803d", "value": "T13B93E551BC82562BC5E063BAE67E668D336173E4C2CF722B88215B547BC561F0DA7F80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034901, "uuid": "aa697bd6-3b79-4a4b-9e16-3acc24746afb", "value": "1536:jNd+cbAs/f3EdbWAkSgF3rm0qZYc7oosBuvtyTEt86FGFMDsLN3zDJjZ:jj+c1/fPtgd7sT6FG2YRDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034901, "uuid": "45acb1e7-c767-4717-847d-cb79229e0a9b", "value": 97304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034901, "uuid": "a8310c5b-33ec-4bcc-9bf4-b9bea34169cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034901, "uuid": "aee98dbf-9656-432c-bab9-124b3a2d0ff6", "value": "4rm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f521c721-f6c4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768998623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998623, "uuid": "5eddb064-71e6-4e82-8ad2-ca27f43e86bd", "comment": "Malware payload", "value": "1f25fa1196d2b67d0d0920cb7d3b0d61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998623, "uuid": "3d90c705-be77-4b65-bf8a-7c316874f786", "comment": "Malware payload", "value": "f94f9a56df012280a62cd5b5938c734ac5a44f6e71165b74eb6184a6f4534631", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998623, "uuid": "cad4570e-c8e9-4a37-970f-f09537ad7f16", "comment": "Malware payload", "value": "b545ec217c1f625056050d5b6d0578eaaa845c29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768998623, "uuid": "cc3b8392-ea7e-4de1-86bf-cfda9f53e13d", "comment": "Malware payload", "value": "dac4b2290bbd20809a4740f9357035afb9c0d6c2e0971045b7d4e3df5a31598fba19a75e3a309b4956b5d3e87e7f6ad8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998623, "uuid": "c7e51a14-1c59-4f32-b3df-08549621b588", "value": "T174834C06AD5184FEC49AC5385BDBE136B336BC0593117F6F3788AA363FA2F25170A644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998623, "uuid": "25d9819f-5430-4f3b-b42f-d1afef2ec31d", "value": "1536:sn6NnV5S2fPnmH6ZFTD8J7TJ6/r/F5fb/or6BVWL93o7yLeL:XW23jZFTwZJo50Je", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768998623, "uuid": "81ef9ddc-a1b1-42d9-8550-aeb1cb9edfa4", "value": 88088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768998623, "uuid": "438825d8-a075-4ff9-a458-b65a303e7156", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768998623, "uuid": "bc563896-dbcf-4ed0-ba99-625213498606", "value": "titan.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ec4b62-f6d7-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1769006411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006411, "uuid": "02ad8169-4ed7-4e70-b60c-b64abf197f34", "comment": "Malware payload (QuasarRAT)", "value": "45b2ce122d9b40b071306bd75c9026da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006411, "uuid": "0430cd9e-0fb7-4d18-aff2-a2912da3bfcd", "comment": "Malware payload (QuasarRAT)", "value": "f9849d69b4330bca9caab82a85036852a97c402e8708490a107a8acd8a51df47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006411, "uuid": "97b75087-68d1-4931-be63-4c8a11eba783", "comment": "Malware payload (QuasarRAT)", "value": "e188df3674003836166df97d840ae2ffcda63c86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769006411, "uuid": "b55e7c30-5ca2-499d-9d42-6c8bdeb7f11c", "comment": "Malware payload (QuasarRAT)", "value": "d5a3962a6dba83add3bc6c0c0bd0e7ff52ce6b1cb85437b52fb054140da547c9b7630e425bebc70db9227745789124a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006411, "uuid": "5d994126-f35a-4d22-b4dc-6f14b7dbb24e", "value": "T1F9E55A0577F85E62E16BD3B2D5F0542363F0F82AF3A3EB0B5191677A1C93B4098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006411, "uuid": "104dac3c-363b-4943-bbcb-5fd5495d94ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006411, "uuid": "f22dc7d4-4213-4220-a54b-83969d122ae5", "value": "49152:Ovkt62XlaSFNWPjljiFa2RoUYIicHamzMZoGdCTHHB72eh2NT:Ov462XlaSFNWPjljiFXRoUYIicHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769006411, "uuid": "a12a7d8d-2cf9-4ba8-b95c-518a2b9e93b4", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769006411, "uuid": "7b62999d-94c2-4e72-aaa5-adf0bb0decca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769006411, "uuid": "6bfe696b-c6e4-4e0e-895a-5bd0302f2df0", "value": "r4tMpI3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359197ac-f69f-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1768982410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982410, "uuid": "a276558e-92f4-4882-ac88-9710e5a45f4b", "comment": "Malware payload (QuasarRAT)", "value": "949753c949eeac5b0ddf6e2de5e0bc50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982410, "uuid": "cfb22ba2-9e04-4843-bbab-8057a8f50fd8", "comment": "Malware payload (QuasarRAT)", "value": "f9d0d6ad8fa31cfd45c41a3315d92b2646b19eeda470df617806bff1809306a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982410, "uuid": "09c4b501-2395-438c-9f6b-3d90cc7491d6", "comment": "Malware payload (QuasarRAT)", "value": "9b189d699bd31bbdbe4475fb77b851da08bad42c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768982410, "uuid": "78a4b626-9d5d-4340-8a1f-6c2d9c8d2171", "comment": "Malware payload (QuasarRAT)", "value": "2e3166298c3c98d94180a049e6366d8c4b825c49419aed00160f196e02942f7a2a4e39d0a669a67c15b1ddbca6d9c357", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982410, "uuid": "33384bc3-9992-4b82-96a9-2e9fe1167788", "value": "T141E56B143BF85E27E1BBE677E5B0041267F0FC1AB363EB0B6581677A1C53B5098026A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982410, "uuid": "52e2d70c-a781-46bc-80cf-e0b64aa25d6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982410, "uuid": "7765c994-60c4-42a7-acd3-05808ee41e63", "value": "49152:xvGzn3r24paQe+GPhlz1Tt6U7PkD9TRJ6bbR3LoGdEoTHHB72eh2NT:xvCr24paQe+GPhlz1TwU7PkD9TRJ6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768982410, "uuid": "722c63e6-5e70-49d5-978d-0d7d4eef5a6f", "value": 3270656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768982410, "uuid": "801c6001-4e3b-405d-bd37-894e6956ecc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768982410, "uuid": "21a30b22-f0ec-4eb6-80ff-ad9e37588e13", "value": "install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2b2bee-f6dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769009080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769009080, "uuid": "471bccd5-ef94-4bf3-beed-3ad3e9b72dac", "comment": "Malware payload (Mirai)", "value": "f29b9b9797b22818b6a061f5de2172a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769009080, "uuid": "12b66303-e371-489d-9e01-331e88e04853", "comment": "Malware payload (Mirai)", "value": "fa30435bf2065dd63294091f0db4ce6cef9d668e3614e403116359b74465f5a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769009080, "uuid": "57044cfc-88b9-4cec-afb4-26435d000c10", "comment": "Malware payload (Mirai)", "value": "c9a4f159bc481ea9d04bdf67d2f8ea923efbe272", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769009080, "uuid": "34ea5925-5e03-45f0-87bf-13964acff1fa", "comment": "Malware payload (Mirai)", "value": "b39c9aa28e2731f91eb00debfce623d94fd7f6959a87f82b45c8633272220832e69fc71108bd1104fae7d6be2fe28a58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769009080, "uuid": "ec6996ef-ac2b-4960-8793-783680212d06", "value": "T1AEC3F185BB636991D0A342FDA4C00AC387912E318BE217480699F774387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769009080, "uuid": "afa9c69f-fd63-4997-b6ec-16922c83b9aa", "value": "3072:SBdQK+TG2nIjnRdZaUXUSgkLCCVwHWiEiBtbMMTnu:eMQRtXU9kLCP8ifbxTnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769009080, "uuid": "142517f8-0c7b-46c5-8e02-b7aa2d18d0ee", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769009080, "uuid": "a2675425-253a-43f1-9188-1efe3665a933", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769009080, "uuid": "0b34029e-caed-41e5-9094-31f91db3f63c", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e28c992-f6d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769005188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005188, "uuid": "296d8e9a-f4b9-4aa6-ae6a-fe3eefecf8df", "comment": "Malware payload (Mirai)", "value": "ced3a5c000c28ba8d5cac5102c797313", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005188, "uuid": "d8c8c71d-6b7b-4702-8ce1-ec0c478f52d4", "comment": "Malware payload (Mirai)", "value": "fa67b277479419302ccc82d5862c7c47723de5185f5798c3f21befbc0e26af9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005188, "uuid": "93ec55ce-15c9-41e0-abcd-ee2b21192f7b", "comment": "Malware payload (Mirai)", "value": "f5300a37d7483408623194cbfdd72532be9c3f5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769005188, "uuid": "4df73c0c-a44c-4a0c-b6e3-791157898371", "comment": "Malware payload (Mirai)", "value": "bcf52f2ef1183fed304e6eb5f25a49f8d381e1c34cbcae8ff82fd79e43770947b4e1afd4a52ed30b47d0bbec97e3c6c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005188, "uuid": "65dc8321-94a1-48f8-979f-937c42045408", "value": "T1766302186B57BAE0DD3066388DE80744AF51E7B856D730A21784C918FAD67136FF7C82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005188, "uuid": "1467f2b2-ffb5-46dd-8e57-81c25fa1692e", "value": "1536:Y4YeCK8lpEyEBafotAe1w2sRFLSsVC11BuD8:YzeCK8HlfyAeoLkUD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769005188, "uuid": "33b519ef-d960-46b3-8a11-2704f6811cda", "value": 68800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769005188, "uuid": "0bf6668d-d38c-4796-b5e3-ec27b5f17146", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769005188, "uuid": "78ab075b-9c0b-4953-a45a-f73e4c8b8ba6", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3795c3e6-f6e8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769013767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769013767, "uuid": "4d9b50fe-faa0-4214-81a3-9b1c4c95f592", "comment": "Malware payload (Mirai)", "value": "762991edaaf311c970bd368b91606fee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769013767, "uuid": "854a1849-d09a-4253-a794-93a076f9a2c3", "comment": "Malware payload (Mirai)", "value": "fb73d8b20485136882c270df6fc64b7499dd9af4c1361bb8893f6ff827e8926d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769013767, "uuid": "72116255-cea4-4932-b582-7efbd7fe94cc", "comment": "Malware payload (Mirai)", "value": "074bbe66ef11d33f21d27a8b514240070697fa59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769013767, "uuid": "512d262f-ca84-4a59-8e2f-e010a6915bdc", "comment": "Malware payload (Mirai)", "value": "d26e15ad44fd356b96dfadd8510751d0085934cda20c28ed9623fbb665e3cfaa0770ec7cc468e09120b1edf7511f3c80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769013767, "uuid": "4e23c75b-94ae-4cf5-9334-a3eae0ed1f26", "value": "T1B0D39D8BF78B04A0C86306F007CB0B9E6EA321D15E5BD9E37D29A63B5E754DB0905BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769013767, "uuid": "8993fde8-9a72-4cc7-a42e-0b01ba10454b", "value": "1536:cNPl84Yxdno7UIc/dfzGm4GPOhaHwoVc56cNlO1ZFAx6RRgsKE+/LWB:wl8HW73Ifam4IWaQ6c56goZF9gsF+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769013767, "uuid": "9e3c0e0f-f6c2-4fd5-ad39-8d0bec72c200", "value": 132688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769013767, "uuid": "b76342f8-bb49-43d7-b7ca-0a4e6aa71a4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769013767, "uuid": "ad789006-317b-4b74-ba3f-0ed175a578f1", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab3d9d9-f718-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034683, "uuid": "be336836-2caf-4d7b-b8cb-1b25e8334d1e", "comment": "Malware payload (Mirai)", "value": "398a9e41f589a129c4de9f4bb25446ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034683, "uuid": "b59125b5-d23b-48ad-a97b-d08999fb1b92", "comment": "Malware payload (Mirai)", "value": "fbe633b882fda23a1a703497bcb1b61e3aff29eee21e1d58d57653edcdfe2993", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034683, "uuid": "7bd3ca55-4f15-455c-beb9-a0defa2f96b9", "comment": "Malware payload (Mirai)", "value": "4a1d5949e4f1b95e7c133009ddbe25000a2283d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034683, "uuid": "5bde254f-b7a7-4586-8206-6a209f04e45a", "comment": "Malware payload (Mirai)", "value": "34e9d4619fb485d55299d61aec99b6170041eb4153fdd742a2b70ca15b7a20a502b2a21c8a8528bd1a01ae40d2e53738", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034683, "uuid": "c7260a68-8958-488d-abc8-f881e88da423", "value": "T14DC33B46EB818B13C4D51776BAEF424533239754D3DB33069928AFB43F86BAE4E23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034683, "uuid": "fe4c0c91-1980-4a02-9cb4-35e6f01ceaf4", "value": "3072:zuC8Mh2CnERxlDYwAHYw6C4SlYjzHQHM/9iOU7:zuCqCEvlDYwA4rCtSzH0M/9iOU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034683, "uuid": "0c10ce7d-767b-4818-8eb4-c4cc0aaf94bd", "value": 126759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034683, "uuid": "3a16452e-f7ed-4110-8927-da89da05021c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034683, "uuid": "57d7c46d-9320-4f55-a511-3e5bf677d920", "value": "StormStresser.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a748f6e-f6a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768983251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983251, "uuid": "28aea010-b4ba-429e-b45f-27cc797b58c0", "comment": "Malware payload (Mirai)", "value": "b9ef167bb2134ec55697eac254d09a5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983251, "uuid": "4da5e4d1-16a5-406c-8434-6bda03639ddd", "comment": "Malware payload (Mirai)", "value": "fbfa08595456fdb22c2fb81621efb1b4f2eee2861b0111118b9b75db0e86a862", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983251, "uuid": "bcb65116-a6a2-4f10-97f4-efbbf3108a78", "comment": "Malware payload (Mirai)", "value": "0a0ccff1ff55499abd9c0f840c2fa55d67975497", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983251, "uuid": "ad71f7d3-80ba-4531-a80c-f6b702ca66ee", "comment": "Malware payload (Mirai)", "value": "003a8c7528712a60194c669ca2d193fb183279642f5fa352d017f234cda55280057055103169d9ce336e43ce40503623", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983251, "uuid": "61f362a0-b6a2-4a9b-a2e9-ed69f358ccdd", "value": "T1D353023726B6D06DD034CA3B0B5C8DA583754148AB34816BF5AAE5FF2E41E05F860E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983251, "uuid": "27238365-dacb-4daf-9084-2a8712a62c02", "value": "1536:zoZ/Yzn9l6maZh7RybbM6EwryUxNW78z77SshPM9JZAQx:cSn9jaBybw6E4yUu707bhPMaQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768983251, "uuid": "f1889b70-6c2a-4a8d-8362-1fa7b1f9ab83", "value": 63912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768983251, "uuid": "fe833ba5-65de-49ac-aff3-923d98775499", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983251, "uuid": "5160aead-6044-44e3-a6a2-0c109dff92dd", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1906538-f6ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769001113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769001113, "uuid": "6d059ef1-1c08-4e64-9205-0e1289e28e21", "comment": "Malware payload (Mirai)", "value": "c80ce8a4b54d886bb10ca83bebdce1dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769001113, "uuid": "ebfe87c9-4662-4e73-a6e2-755863e19e06", "comment": "Malware payload (Mirai)", "value": "fc239bfa722b0257ed4e333eec7c53c50cb7aba78410f0f3c5b0b6158ed1bffd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769001113, "uuid": "8bb650f2-3e3d-4bea-b824-1501d0f052ad", "comment": "Malware payload (Mirai)", "value": "e73206f2c95e5ebf6a85df73aa07d8e64ee38e79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769001113, "uuid": "c82ca49d-7b78-4631-9ca0-3c27ff4288a0", "comment": "Malware payload (Mirai)", "value": "6dcc662b6c1d58443f02f9741e8098295f151958dd26d34f4f9b32aceff9df523687ba51314ed996865121c6c9b39683", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769001113, "uuid": "ad737382-09eb-42cb-bb8e-ec9eea4c17d1", "value": "T17F04392F258192F0F6411B746BCBD3976C390BBF41A9909F6B516329B6E0B7BA02C447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769001113, "uuid": "49472af4-e1ac-46a4-8a96-6a231cdbb0d3", "value": "3072:7mflblbBDfvNUZem/LVA7bGQU66gOVNLddnNgRdgJi55wfUX9:7IJ5k1DVA2nDXNgEJi5acN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769001113, "uuid": "fe72648a-c086-434f-ac92-bf4eeac6acc7", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769001113, "uuid": "1a4da296-5f0d-40ed-ab36-525447adc0a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769001113, "uuid": "e7dbc665-289c-4efd-b782-aca2a620f6a2", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a091e3-f719-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034921, "uuid": "5999e0f7-9fa6-42e1-afd6-aa3a5b77a3b4", "comment": "Malware payload (Mirai)", "value": "63f47eff0e7818644e6faa516af6ff4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034921, "uuid": "c3afae2d-50e9-4953-8854-463102b0d964", "comment": "Malware payload (Mirai)", "value": "fd36eea5b3ad438cfbfed110126b65a32171a9b965a2e4521b3ab5cdf92760ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034921, "uuid": "a1c00352-a5bb-4f74-850e-c895fa82cea8", "comment": "Malware payload (Mirai)", "value": "cc5213369c3bcc14987f44a88726c67058175e7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034921, "uuid": "deee3dde-607a-489c-8e65-b5175b8c1c76", "comment": "Malware payload (Mirai)", "value": "68f4332c337ead152ed86f1f851446b1fd3fe253d04610c90f72c16afead20c7b1467fc2f7368b82ee8ca90ec9a1b7eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034921, "uuid": "0b8d8ea5-f921-44f8-8ff0-73f74cc090a5", "value": "T196A32B0377090F43D05329F02B7B17E197AABEA514B4A6C4752EBEC582B1DF22586FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034921, "uuid": "0e75ecb5-d86b-419b-95ce-765378aa2105", "value": "1536:XrQrTtTf/rsa+3iqqBWiOSgTuah/QPGy+EzJW9UfY70tBpVh02RWTi2T+b/:XcVTLijRezG90dVtN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034921, "uuid": "79d24882-064e-4a71-892f-f01564a28521", "value": 99752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034921, "uuid": "aac56c79-16ad-4d98-9f34-39e6e072158b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034921, "uuid": "ab585c7f-a4eb-44d9-9a8e-3a837eeacf3d", "value": "titanjr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f495957b-f718-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769034700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034700, "uuid": "3eb38f4e-16e1-48c9-ad0f-63537313c99c", "comment": "Malware payload (Mirai)", "value": "a79a0511888d857bfc3f723671543f3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034700, "uuid": "63ad5f22-6c67-4ec7-8796-021cf65e70a5", "comment": "Malware payload (Mirai)", "value": "fd8e72b89585bf329a9e68bd2d178d546ad040b59c805c289afad3bcff5ce03b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034700, "uuid": "dc54c8f1-ee2f-4d9b-9f37-5b8bb78b5aa9", "comment": "Malware payload (Mirai)", "value": "2ca41db205dfc0b4be37f22e0148dd2935b8b8d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769034700, "uuid": "0ecd3dc2-5ee7-4b80-be7d-183add550cd4", "comment": "Malware payload (Mirai)", "value": "00abe9da9d52eaee53240c82e3d64f584091fb045dffbea053ba2bb3a23d225471c9d16b16dd20a7f4be318a35ec6767", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034700, "uuid": "b85e7fd2-82ca-42ee-99a8-5cfa802df38e", "value": "T124331985B8C18A17C5D013BBFA2E41CD332667B8E2DF32079D252F14778A82F0E67655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034700, "uuid": "3cf7d0ee-61cf-4fc3-840e-fa6f3a76bb43", "value": "768:qZeCCSdF9OKgkMsrusdHDdpa/I14c2qSz+obikTcSP+t5Y/NPcB4kYXz7o:PCjdKvsdP314cozAkTca+t5Y6B2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769034700, "uuid": "13430819-3249-4e67-9c0c-acc60dcdc24c", "value": 52904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769034700, "uuid": "dc0c9411-bc9a-43c1-8441-5dac17e90368", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769034700, "uuid": "ea672b3a-d221-4afa-8348-43616228bcb5", "value": "StormStresser.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fad1a57-f6a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768983447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983447, "uuid": "b0500bf9-e74d-46b0-9c45-f1946cd64846", "comment": "Malware payload (Mirai)", "value": "45daf7b7ecdd65d10da8e96f8ec355d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983447, "uuid": "0181528c-3d0c-4362-8789-5599b083de7c", "comment": "Malware payload (Mirai)", "value": "fea50faf0a6567ab70d6d38f5a1a0f167e813a728d16bffdc8e2cdb550adccdb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983447, "uuid": "2f4ee7f6-8c83-40b2-a3e3-55e22c244f26", "comment": "Malware payload (Mirai)", "value": "9d82e5202cbc4ef41ddaa2094ea7cb0b975e4a8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768983447, "uuid": "e37ce6ed-a9ba-4cb1-9ede-0c13938a44c5", "comment": "Malware payload (Mirai)", "value": "55c35c108ee58dec3cc1f9f0a3c0af9f4b6f6a48cb336cfc7359b278bbc427927f9e2dcb8335e2c57311706fd535ef59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983447, "uuid": "55274b6f-87e2-4bd4-9268-b3d974918553", "value": "T17772BFE53261922185A0547FEC7986C177B303F0A2F37631521857EBAF8746A3BF5352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983447, "uuid": "df11bff7-ad99-4da5-841e-b487da5e8284", "value": "384:Hj6ZV1NvnQqevbMvzen28ztapIgV63hymdGUop5hmf:D6nv2YvinBtu63s3Uoz8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768983447, "uuid": "5633b11d-0b46-40a3-9ee9-44091e9153af", "value": 16632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768983447, "uuid": "9c6b1eb2-17a5-46d6-912a-aa114cd39671", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768983447, "uuid": "689b4a5f-2400-4d93-8b3a-ba726c0445d4", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f68bedf9-f6f1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769017953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769017953, "uuid": "dc4183c7-307c-4ce7-b9b1-48077ac17420", "comment": "Malware payload", "value": "87bc17f56e744e74408e6ae8bb28b724", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769017953, "uuid": "2c943c69-274a-4083-8fb5-00b3b635842e", "comment": "Malware payload", "value": "ffb24fc36ade87988f9908e848d0333ce7ffb2b4e4d0ffb43f6556246069d057", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769017953, "uuid": "31bf41cd-72bf-4d69-b9b9-8f8fc2e39883", "comment": "Malware payload", "value": "3aa572388083ff00a95405d34d1189c99c7ff5be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769017953, "uuid": "4edf2f9c-054a-4a25-b053-f2eca18f380f", "comment": "Malware payload", "value": "c8cb01223a5118ee91629e95d43ed1fe8e0bd9152c41e21e1bbdaa2b2d615a56f1e03e879069f395f73015c10f77b694", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769017953, "uuid": "57068f29-2576-4f04-9ffb-5dcfa616ca37", "value": "T1C306D6C3B54AC9B2C14B673AC7C7160443A2DD852323DB1A3ACA33653E73FBA4965587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769017953, "uuid": "664f6d2f-096c-42b1-b074-8795dc5ff378", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769017953, "uuid": "3ff29a2a-9de7-4b70-bf6b-9d1212a59d55", "value": "49152:cbvLSgf+VOdx3Vw5+mbSgwJKI0Qpvs3c2KTn4Xj9Bh:cTmgf+VOdc5vbSgwJKDP24Rf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769017953, "uuid": "ba6fbf72-e183-4cbd-b8c6-3f16bb874800", "value": 3668408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769017953, "uuid": "738995c1-0740-476c-9b64-437bb357061e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769017953, "uuid": "4024c372-a33f-46b4-b5d3-05507e3fd762", "value": "Fiddler.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }